Overview
Schnorr signatures, activated on Bitcoin through the Taproot soft fork in November 2021 (specified in BIP340), are a digital signature scheme that offers significant advantages over Bitcoin's original ECDSA signatures. Originally invented by Claus-Peter Schnorr in 1989, the scheme was under patent until 2008 — ironically, just before Bitcoin was created. The key mathematical property that makes Schnorr signatures valuable for Bitcoin is linearity, which enables multiple signatures to be combined into a single aggregate signature.
Schnorr vs. ECDSA
ECDSA Signature: Schnorr Signature:
┌────────────────────────┐ ┌────────────────────────┐
│ Components: (r, s) │ │ Components: (R, s) │
│ Size: 71-73 bytes │ │ Size: 64 bytes (fixed) │
│ Verification: Complex │ │ Verification: Simple │
│ Aggregation: No │ │ Aggregation: Yes │
│ Batch verify: Limited │ │ Batch verify: Yes │
└────────────────────────┘ └────────────────────────┘
Signature Equation:
ECDSA: s = k⁻¹(z + r·d) mod n (non-linear)
Schnorr: s = k + e·d mod n (linear!)
▲
└── This linearity enables aggregation
Key Aggregation (MuSig)
The linearity of Schnorr signatures means that multiple parties can combine their individual public keys into a single aggregate public key and collaboratively produce a single aggregate signature. On-chain, this looks identical to a single-key spend:
3-of-3 Multisig Comparison:
With ECDSA (P2SH multisig):
On-chain: 3 public keys + 3 signatures
Size: ~297 bytes of witness data
With Schnorr + MuSig:
On-chain: 1 aggregate key + 1 aggregate signature
Size: ~64 bytes of witness data
Indistinguishable from a single-signer transaction!
This has profound implications for privacy — a MuSig cooperative spend on a P2TR output looks exactly like a simple single-key payment to any outside observer.
Batch Verification
Schnorr signatures support efficient batch verification, where multiple signatures can be verified together faster than verifying each one individually. This is particularly valuable for nodes processing entire blocks of transactions, as it can significantly reduce the computational cost of block validation.
Why Bitcoin Initially Used ECDSA
When Satoshi Nakamoto created Bitcoin in 2008, the Schnorr signature patent had only recently expired, and ECDSA was the established, well-tested standard with broad library support. The Bitcoin community spent years designing and testing the Taproot upgrade to introduce Schnorr signatures safely and with full backward compatibility.
Common Misconception
Schnorr signatures do not replace ECDSA on Bitcoin. Both signature schemes coexist. ECDSA is still used for legacy, P2PKH, and SegWit v0 (P2WPKH) outputs. Schnorr is used exclusively in Taproot (P2TR) outputs. Existing addresses and transactions continue to work exactly as before.