If Alice wants to prove to Bob she is the holder of private key x, without exposing x, they can use the Schnorr identification protocol which has the public function sG = kG + exG and the private scalar function s = k +ex. In these functions, G is the static generator point, k is a hidden nonce chosen by Alice to protect x from being revealed to Bob, and e is a nonce chose by Bob so that he can trust kG (can’t be calculated by someone pretending to hold x).
This all makes sense to me, but I am curious if there is a reason that e is multiplied with x instead of just following the same addition operator as k. So the equations would become sG = kG + eG + xG and s = k + e + x. k has a very valid reason to use addition, that is how x remains hidden. I can’t think of a meaningful difference for the goal of the protocol if e is multiplied or added, maybe I missing a core concept?
