Schnorr Signature

A Schnorr signature is the digital-signature scheme Bitcoin adopted in the November 2021 Taproot soft fork, specified in BIP340. It produces a compact 64-byte signature paired with a 32-byte x-only public key over the same secp256k1 curve Bitcoin already used for ECDSA — but with cleaner mathematical properties that unlock capabilities ECDSA cannot offer. Claus Schnorr's scheme actually predates ECDSA; Bitcoin used ECDSA at launch largely because Schnorr was patent-encumbered until 2008 and lacked standardization. Taproot corrected that historical accident.

Linearity, the defining property

What makes Schnorr special is that it is linear: signatures and keys live in a structure where they can be meaningfully added together. Because the math is additive, multiple public keys can be combined into a single aggregate key, and multiple partial signatures can be combined into one signature that verifies against it. ECDSA's construction, with its awkward modular inversion, breaks this property. Linearity is the foundation for key aggregation via MuSig2, for threshold signing schemes like FROST where any quorum of signers can produce one ordinary-looking signature, and for adaptor signatures — a trick where revealing a valid signature atomically reveals a secret, used in Lightning protocol upgrades and discreet log contracts.

Privacy and efficiency gains

Aggregation has a very concrete payoff: a 3-of-5 multisig spend can be made to look identical on-chain to an ordinary single-signer payment. Observers cannot tell collaborative custody from a simple wallet, which improves privacy for everyone — the anonymity set of "boring single-sig payment" grows to include vaults and channel closes. The same aggregation shrinks the data footprint: one 64-byte signature instead of several 70-something-byte ECDSA signatures means lower fees and lighter blocks. BIP340 adds engineering refinements on top: tagged hashes that prevent cross-protocol signature reuse, deterministic nonce generation guidance to avoid the nonce-reuse failures that have leaked private keys in careless ECDSA implementations, and support for batch verification, letting a node validate many signatures together measurably faster than checking each one alone — a direct benefit to anyone running a full node on modest hardware.

How it fits into Taproot

Inside Taproot, Schnorr is the signature half of a two-part design. Every Taproot output commits to a single x-only public key that can be spent with one Schnorr signature (the key path), while alternative spending conditions hide in a Merkelized Alternative Script Tree (MAST) behind that key (the script path). The intended common case is that participants cooperate, aggregate their keys, and use the key path — revealing nothing about the contract that existed. Only in a dispute does the script path, and the policy it encodes, appear on-chain.

Why it matters to the sovereign Bitcoiner

For someone building serious self-custody, Schnorr is the cryptographic groundwork that makes modern collaborative custody cheaper and more private at the same time — historically a trade-off, now a package deal. Wallet stacks coordinate these spends through the Partially Signed Bitcoin Transaction (PSBT) workflow, with each private key contributing its partial signature from its own device. The practical caveat: aggregated schemes like MuSig2 require interactive signing rounds, so hardware-wallet support has arrived gradually, and many multisig deployments still use non-aggregated Taproot script paths. The direction of travel is clear, though — smaller, cheaper, more private signatures, with the fancy custody arrangements disappearing into the crowd of ordinary payments.

One more detail worth knowing: BIP340 uses x-only public keys, dropping the byte that distinguished which side of the curve a point sits on. That saves space on every output and, more subtly, forces implementations to handle key parity explicitly — a small example of how much careful engineering sits underneath a 64-byte signature that most users will never think about.