Fiat-Shamir Transform: Non-Interactive Schnorr Signatures

Identity

Secret key x–

Public key y = g^x mod p–

Message

Fiat–Shamir Signing

Nonce r (ephemeral, secret)–

Commitment t = g^r mod p–

Challenge c = H(t‖m) mod q–

Response s = r + c·x mod q–

not verified yet

How it works

The Schnorr identification protocol needs a live verifier to send a random challenge c. The Fiat–Shamir heuristic removes that verifier: it replaces the random challenge with a cryptographic hash of everything sent so far plus the message, making the proof non-interactive — a real digital signature the prover can post once, with no round trip.

Sign(x, m):
  r  = random nonce in [1, q)
  t  = g^r mod p                (commitment)
  c  = H(t ‖ m) mod q           (challenge = hash, not a live verifier)
  s  = r + c·x mod q            (response)
  signature = (t, s)

Verify(y, m, t, s):
  c' = H(t ‖ m) mod q
  accept iff  g^s ≡ t · y^c' (mod p)

The demo uses SHA-256 (via the browser's real Web Crypto API) as H, and toy Schnorr-group parameters p = 2³¹−1 (a Mersenne prime), generator g = 7, group order q = p−1, small enough to compute live with exact 64-bit BigInt arithmetic — the identical equations run with cryptographic-size primes in real Schnorr signatures (RFC 8032's EdDSA and Bitcoin's BIP-340 are both Fiat–Shamir Schnorr variants).

Sign — draws a fresh random nonce r, computes the commitment, hashes it together with the message to get c, and derives s. The ring shows the commitment point t (blue).
Verify — independently recomputes c' from (t, message) and checks g^s against t·y^c' on the ring. The two markers land on the exact same angle only when the check holds.
Tamper before verify — flips one character of the message that verification sees (the stored signature does not change). Because c' = H(t‖m) depends on every bit of m, a single flipped character sends c' somewhere unrelated, and the two ring markers snap apart — visible, unforgeable proof that the signature is bound to that exact message.

Commitment t Verify LHS g^s Verify RHS t·y^c'

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.