Home › Glossary › Schnorr signatures

Schnorr signatures

Also called: Schnorr signature, BIP340, BIP 340 signatures, Schnorr, secp256k1 Schnorr.

Schnorr signatures are the 64-byte digital signatures standardized in BIP 340 and used by Taproot. They are simpler and more flexible than ECDSA.

Schnorr signatures are a digital signature scheme that Bitcoin added with Taproot. Like ECDSA, they prove that the holder of a private key approved a transaction, but their simpler structure brings several practical advantages.

BIP 340

BIP 340, by Pieter Wuille, Jonas Nick and Tim Ruffing, standardizes Schnorr signatures over the same secp256k1 curve and SHA-256 hash function Bitcoin already used:

  • Signatures are a fixed 64 bytes (the x coordinate of a point R plus a number s, 32 bytes each), instead of DER-encoded ECDSA signatures of up to 72 bytes.
  • Public keys are 32-byte "x-only" keys rather than 33-byte compressed keys.
  • Verification checks s·G = R + e·P, where e = hash(R || P || m). Including the public key P in the hash (key prefixing) protects against related-key attacks, which matters for tweaked keys such as Taproot's.
  • Tagged hashes keep this hash separate from every other use of SHA-256 in Bitcoin.

Why Schnorr

BIP 340 lists the benefits: a security proof based on the hardness of the elliptic curve discrete logarithm problem, non-malleable signatures, and linearity. Linearity means keys and signatures can be added together, which makes MuSig2 possible (multisig that looks like a single signature on chain) as well as batch verification, checking many signatures faster than one at a time.

Where they're used

Schnorr signatures are valid in P2TR key-path spends (BIP 341) and inside tapscript (BIP 342). They activated with Taproot at block 709,632 on 14 November 2021. Older output types still use ECDSA. Compare the single-signer standard with its multi-signer extension in BIP 340 vs BIP 327, or read the Taproot guide.

BIPs that define Schnorr signatures

  • BIP 340: Schnorr Signatures for secp256k1: Deployed. Defines a standard for Schnorr signatures, a simpler and more flexible signing method than the ECDSA scheme Bitcoin originally used, on the same elliptic curve. Schnorr signatures are compact (64…
  • BIP 341: Taproot: SegWit version 1 spending rules: Deployed. Taproot introduces a new kind of Bitcoin output that can be spent either with a single signature or by revealing just one of many possible alternative spending conditions, kept hidden in a tree…
  • BIP 342 (Tapscript): Validation of Taproot Scripts: Deployed. Specifies Tapscript, the updated scripting rules used when a Taproot output is spent through one of its hidden alternative conditions. It switches signature checks to Schnorr, removes some old…
  • BIP 327: MuSig2 for BIP340-compatible Multi-Signatures: Deployed. Standardizes MuSig2, a scheme that lets several people jointly create a single signature that looks like an ordinary one-person Taproot signature. This makes shared-control wallets cheaper and more…

Related terms

  • ECDSA: ECDSA (Elliptic Curve Digital Signature Algorithm) is the signature scheme Bitcoin has used since 2009, over secp256k1, for all pre-Taproot outputs.
  • MuSig2: MuSig2 is a Schnorr multi-signature scheme (BIP 327): several signers share one aggregate key and produce one ordinary-looking signature.
  • P2TR: P2TR (Pay to Taproot) is the SegWit version 1 output type from BIP 341: one 32-byte key with optional hidden scripts. Addresses start with bc1p.
  • Taproot: Taproot is the 2021 Bitcoin soft fork (BIPs 340, 341, 342) that added Schnorr signatures and P2TR outputs which hide unused spending conditions.
  • Public key: A public key is a point on the secp256k1 curve derived from a private key. Others use it to verify your signatures, and addresses are built from it.

Learn more

Guides