Schnorr Signature

A Schnorr Signature is a digital signature algorithm that proves a message comes from its claimed signer. It verifies authenticity and integrity without revealing the private key. Bitcoin standardized it in BIP340 as part of the Taproot upgrade to replace ECDSA.

Schnorr signatures operate on the secp256k1 elliptic curve. The signer uses private key x to derive public key P = x × G, where G is the base point. To sign message m, the signer picks nonce k, computes point R = k × G, and derives challenge e as the hash of R || m || P. The signature (R, s) satisfies s = k + e × x. Verifiers confirm s × G = R + e × P.

Schnorr signatures matter for their efficiency and privacy features. They cut signature size to 64 bytes, reducing Bitcoin transaction fees by about 25% compared to ECDSA. They enable signature aggregation through protocols like MuSig, allowing multiple signers to produce one signature indistinguishable from a single signer’s. This hides multisignature usage and improves scalability.

Key characteristics include:

• Linearity: Supports secure key and signature aggregation.
• Non-malleability: Blocks unauthorized signature changes.
• Batch verification: Verifies multiple signatures faster than individually.
• BIP340 specifics: Uses 32-byte X-only points and a tagged hash for security.

For example, Bitcoin’s Taproot leverages Schnorr to make complex spending conditions look like regular payments, enhancing fungibility.