schnorr.Verify must be fixed

[calctopian]

As it was previously pointed out, schnorr.Verify must be fixed but the previous commit didn't fix it.

But why is it so important?

• EdDSA is Schnorr instantiated with the Ed25519 curve: if you fix EdDSA, then you must also fix Schnorr when instantiated with the Ed25519 curve.
• eddsa.Verify is hardly used (IdentityProxy), however schnorr.Verify is used everywhere: dedis/cothority (darcs, viewchanges, roster extension, authproxy, evoting, ...) and dedis/dela. The vulnerability is on schnorr.Verify, leaving it unpatched is irresponsible.
• schnorr.Verify could verify signatures generated by third-party libraries that don't conform to the keys/signatures generated by this library: a defensive approach must be taken to prevent malicious signatures.
• in kyber, the implementations of schnorr.Verify and eddsa.Verify are identical by design (i.e., what schnorr signs is verified by eddsa, et vice versa) except for eddsa.Sign having deterministic nonce generation and schnorr.Sign being random: as pointed out in the paper, "Ed25519 uses deterministic signing which removes the need for fresh random numbers during the signing process. This choice does not lead to any particular consequences for our security analysis since we model the key derivation function as a random oracle." ( Section 4.2.5
• in fact, there is a test checking the compatibility between schnorr and eddsa signatures: thus, they both should receive equal treatment.