An article to understand Schnorr signature and its application in BTC

What is a Schnorr signature and how does it make digital signatures on BTC faster and more efficient?

Written by: Chainlink

In cryptography, a Schnorr signature is a digital signature generated by the Schnorr signature algorithm.

Unlike most blockchains, BTC has remained largely unchanged since its early days, with most upgrades being limited and aimed at enhancing the efficiency of the network rather than functionality. Updates to the BTC protocol are very rare and are often used for technical enhancements to ensure the stability and security of the network.

An important upgrade for BTC is Taproot, which introduces several enhancements, among them Schnorr signatures. Schnorr signatures offer several advantages over the previous mechanism for key generation and verification (ECDSA).

In this article, we explain what a Schnorr signature is and how it makes digital signatures on BTC faster and more efficient.

digital signature

Digital signatures are mathematical schemes used to verify the authenticity and integrity of digital information. They provide a way of proving that a message was sent by a specific sender (authenticity) and has not been altered in transit (integrity). In other words, a digital signature is not that different from a physical signature, with the sender verifying his identity and specific intent by his unique signature.

Digital signatures are commonly used in software distribution, financial transactions, contract management software, and many other situations where forgery or tampering needs to be detected.

The importance of digital signatures in BTC is described by Satoshi Nakamoto in the BTC white paper as follows:

• "We define an electronic coin as a chain of digital signatures. Each owner digitally signs the hash of the previous transaction and the public key of the next owner, and adds it to the end of the coin. Transfer to the next owner. The payee can verify the signature to verify ownership on one chain.”*

In the case of BTC, a digital signature is used to verify the owner of the private key associated with the address without revealing the private key to the network. When a transaction is submitted to be included in a block, nodes on the Bitcoin network check whether the signature matches the message, and if they do, accept the transaction.

What is a Schnorr signature?

Schnorr signatures are a digital signature scheme that efficiently and securely sign transactions and messages. It was first described in a 1991 paper by Claus Schnorr.

As an algorithm utilizing elliptic curve cryptography, Schnorr is proposed as part of the BTC technology roadmap to replace the Elliptic Curve Digital Signature Algorithm (ECDSA). Schnorr has been praised for its simplicity, provable security, and linearity. Since Schnorr requires less computation than ECDSA, it is considered suitable for cryptocurrency transactions.

Advantages of Schnorr signatures

Schnorr signatures have several advantages, including high efficiency, enhanced privacy, while preserving all the functionality and security assumptions of ECDSA. Schnorr signatures allow for smaller signature sizes, faster verification times, and improved resistance to certain types of attacks.

The most notable advantage of Schnorr signatures is key aggregation - the aggregation of multiple signatures into a single signature that is valid for the sum of their keys. In other words, Schnorr enables multiple collaborating parties to generate a signature valid for the sum of their public keys.

Signature aggregation enables the signatures of multiple signers to be combined into a single signature

Key aggregation reduces transaction fees and improves underlying scalability because electronic signatures from multi-signature setups take up the same space in a block as signatures from single-party transactions. This feature of Schnorr can be used to reduce the size of multisig payments and other multisig related transactions, such as Lightning channel transactions.

Another important property of Schnorr signatures is immutability. In the context of digital signatures, tampering refers to the ability for an attacker to modify a valid signature such that the modified signature is still valid and authenticates a message that differs from the original signature. This can cause serious problems for cryptocurrency applications, where a malicious attacker can modify transaction signatures to increase the amount of transferred funds or change the recipient of the funds.

Schnorr also offers many privacy advantages. It can make multi-signature schemes externally indistinguishable from traditional single public keys, and Schnorr makes it harder for observers to distinguish multi-signature spending from single-signature spending during on-chain activity. Additionally, in an n-of-m multisig setup, Schnorr makes it more difficult for an outside observer to determine which participants signed a transaction and which did not by looking at on-chain information.

Application of Schnorr in BTC

Schnorr signatures were implemented in BIP-340 as part of the Taproot soft fork upgrade and activated on November 14, 2021 at block height 709,632. Like other BTC upgrade proposals, Taproot was voted on by BTC miners. Taproot is a collection of protocol improvements that introduce several new features, change the way transactions are processed on the blockchain, and enable new scripting capabilities. Taproot is considered one of the most significant updates to BTC since the adoption of Segregated Witness in 2017.

Schnorr makes BTC's digital signatures faster, safer, and easier to process. Notably, Schnorr signatures are backwards compatible with BTC’s cryptographic algorithms, such that they can be introduced via soft fork upgrades.

Comparison of Schnorr signature and ECDSA

As mentioned earlier, Schnorr signatures have several advantages over ECDSA, including smaller signature sizes, faster verification times, and improved resistance to certain types of attacks. Schnorr signatures also allow for signature aggregation, which reduces transaction fees and improves scalability.

It is worth noting that while Schnorr signatures may be considered more suitable for BTC, ECDSA is still widely used and considered a secure signature scheme. The choice between Schnorr signatures and ECDSA may depend on specific use cases and security requirements.