Schnorr Signatures

Schnorr signatures were invented by Claus Schnorr in 1989 but were not patented by most of the relevant parties, allowing open implementation. They were considered for Bitcoin from early on but ECDSA was used instead due to patent concerns and library availability. Taproot (activated November 2021) finally brought Schnorr to Bitcoin.

**Key advantages over ECDSA:**

**1. Linearity (signature aggregation):** Schnorr signatures are linear — multiple signatures can be combined into a single aggregate signature. For a multisig transaction (e.g., 3-of-5 multisig), Schnorr aggregation (MuSig2 protocol) produces a single signature indistinguishable from a single-signer signature. This: - Reduces transaction size (lower fees) - Improves privacy (multisig looks like single-sig on-chain) - Enables Taproot's script tree hiding

**2. Batch verification:** Many Schnorr signatures can be verified together faster than verifying each individually. This improves Bitcoin node performance during block validation.

**3. Security proof:** Schnorr has a tighter, more elegant security proof under the Random Oracle Model than ECDSA. ECDSA has known theoretical vulnerabilities (nonce reuse leads to private key exposure — a real exploit in practice). Schnorr is more robust.

**Cross-input signature aggregation (CISA):** A future Bitcoin upgrade proposal would allow Schnorr signatures from multiple inputs within a transaction to be combined into a single signature, dramatically reducing multi-input transaction sizes and costs.