Malleable version of Schnorr signature Given an elliptic curve defined in $\mathbb{F}_{q}$ with a generator $G$ and a hash function $H_{q}(x)$ which maps $x$ to $\mathbb{F}_{q}$. A Schnorr signature variation for a data block $B$ such as:

$SigGen(s, B)$:


$m = H_{q}(s||B)$, $M = m \times G$
$c = H_{q}(P||M||B)$
$p = m + c \cdot s$
Outputs $\sigma = (M, p)$


$\text{Verify}(P, B, \sigma)$:


$c = H_{q}(P||M||B)$
Check if $ p \times G \stackrel{?}{=} M + c \times P$


What would be the implications of changing $c = H_{q}(P||B)$, removing the dependency on $M$?

The only thing I can see is that there exists one $M^{*}$ such that $\sigma = (M, p) = (M^{*}, p)$ is equally valid. But an acceptable compromise in my point of view, if one actually needs to construct a scheme that maintains a deterministic value for $c$ given $B$.

Are there any other drawbacks?
OK, I found my own answer.
A catastrophic drawback is $M = p \times G - c \times P$, by changing $c$ to any desired data block.