Schnorr Ring Signatures - wrong hash results
If $g^a$ in the modular version translates to $aG$ or $a*G$ in the elliptic curve version, then $y_i^{-H(m, R_i)}$ should translate to
$$\begin{align*}
(-H(m, R_i))*Y_i&amp;=-(H(m, R_i)*Y_i)&amp;\text{(1)}&amp;\text{ or equivalently}\\
&amp;=H(m, R_i)*(-Y_i)&amp;\text{(2)}&amp;\text{ or equivalently}\\
&amp;=((-H(m, R_i))\bmod n)*Y_i&amp;\text{(3)}&amp;\\
\end{align*}$$

The form (1) leads to an expression requiring one point subtraction or inversion:
$$R_s=a*G-\sum_{i\neq s}(H(m,R_i)*Y_i)$$

The form (3) leads to an expression that requires none:
$$R_s=a*G+\sum_{i\neq s}(((-H(m,R_i))\bmod n)*Y_i)$$

Note: By definition, $u\bmod n$ is the uniquely defined $v$ with $0\le v&lt;n$ and $u-v$ a multiple of $n$. When $u\ge0$, $(-u)\bmod n$ can be computed as $n-1-r$, where $r$ is the remainder of the division of $(n-1+u)$ by $n$.