Cofactorless verification. A “cofactorless verifier” instead checks the equation SB = R +
H(R, A, M )A and rejects alleged signatures where this equation does not hold. Any alleged sig-
nature that passes cofactorless verification will also pass verification. The signature of a message
will pass cofactorless verification, so it will also pass verification. However, a signer using a secret
key outside the above signing procedure can create strings that pass verification without passing