Definition
Schnorr batch verification is a property of BIP340 signatures that lets a Bitcoin node validate a large set of signatures collectively, far faster than verifying each one in isolation. It exploits the linearity of the Schnorr verification equation: instead of computing one elliptic-curve multi-scalar multiplication per signature, a node can fold all signatures and public keys into a single, larger multi-scalar multiplication.
How the speedup works
Naively, verifying n signatures means n independent checks of the form s·G = R + e·P. Batch verification multiplies each equation by a fresh random coefficient and sums them, so all n relations collapse into one equation. Random coefficients are essential: without them an attacker could craft signatures that individually fail but cancel out in the sum. The single combined multi-scalar multiplication is much cheaper than n separate ones, approaching a 2x or greater speedup for large batches.
Why it matters for Bitcoin
A node performing initial block download or validating a new block can batch-verify all the Schnorr signatures it contains at once, materially reducing verification time. This is one of the practical wins Taproot delivered alongside its privacy benefits; ECDSA, which Bitcoin used before Taproot, has no comparably clean batching. The same linearity also underpins signature aggregation schemes like MuSig2 and threshold signing in FROST.
Batch verification operates on the signatures that authorise both key-path and script-path spends. See the key it verifies against in Taproot Output Key and the commitment scheme behind Taproot in Taproot Tweak.
In Simple Terms
Schnorr batch verification is a property of BIP340 signatures that lets a Bitcoin node validate a large set of signatures collectively, far faster than verifying…