Schnorr signature

Schnorr signatures do the same job as ECDSA — prove control of a private key — but with cleaner, linear math that unlocks aggregation. Long patent-encumbered, they finally arrived in Bitcoin with the 2021 Taproot upgrade as BIP-340.

To sign hash m with private key x (public key P = xG): pick a nonce r, compute R = rG, derive the challenge e = H(R ‖ P ‖ m), and set s = r + e·x. The signature is (R, s), verified by checking sG == R + e·P. The defining feature is LINEARITY: because s is a linear function of the secrets, two cosigners can simply add their R values and their s values to form one joint signature valid under the summed public key P1 + P2 — provided rogue-key and nonce-related attacks are handled, which protocols like MuSig2 do.

On-chain this is transformative. A multisignature or a Taproot key-path spend appears as a single 64-byte signature, cutting fees and improving privacy because an outside observer cannot distinguish a 1-of-1 from an aggregated n-of-n. Schnorr also enjoys a clean security proof in the random oracle model, which plain ECDSA lacks. BIP-340 pins down a specific variant — x-only public keys and an even-y nonce — so that all Bitcoin implementations interoperate.