Bitcoin relies on cryptography every time someone spends BTC.

When you send Bitcoin, your wallet doesn’t simply tell the network, “I own these coins.”

Instead, your wallet uses a private key to create a digital signature that proves the transaction was authorized by the person who controls the corresponding key.

For many years, Bitcoin used ECDSA signatures for this purpose.

Then Bitcoin gained another important signature system: Schnorr signatures.

BIP-340 defines the standardized Schnorr signature scheme used by Bitcoin today.

So, what is BIP-340?

BIP-340 is the Bitcoin Improvement Proposal that specifies Schnorr signatures for the secp256k1 elliptic curve, using a compact 64-byte signature format.

The proposal is currently listed as Deployed.

But why did Bitcoin need another type of signature?

To understand that, we first need to understand what a Bitcoin digital signature actually does.

What Is a Bitcoin Digital Signature?

A digital signature is a cryptographic proof.

When you spend Bitcoin, your wallet uses your private key to sign information related to the transaction.

The network can then use the corresponding public key to verify the signature.

The basic process looks like this:

Private key → Create signature → Bitcoin network verifies signature using public key

The private key remains secret.

The public key can be shared.

Anyone can verify the signature, but only someone with the required private key can create a valid signature.

This is one of the foundations that allows Bitcoin to operate without a central authority approving every payment.

Bitcoin Used ECDSA Before Schnorr

Bitcoin originally standardized ECDSA, or the Elliptic Curve Digital Signature Algorithm.

ECDSA uses the same underlying secp256k1 elliptic curve that BIP-340 uses.

However, Schnorr signatures have several properties that make them attractive for Bitcoin.

According to BIP-340, Schnorr signatures offer advantages including non-malleability and linearity, while also allowing a compact fixed-size signature format.

That doesn’t mean ECDSA was suddenly useless.

Instead, Schnorr provided Bitcoin with a different cryptographic building block that could support new constructions more efficiently.

What Is Schnorr Signature?

A Schnorr signature is a type of digital signature originally developed from Schnorr’s cryptographic work.

At a high level, it allows someone to prove:

“I know the private key associated with this public key, and I authorized this message.”

The verifier doesn’t learn the private key.

Instead, the verifier checks whether the mathematical relationship between the public key, signature, and message is valid.

BIP-340 defines a specific Schnorr construction designed for Bitcoin’s use of the secp256k1 elliptic curve.

This is important because “Schnorr signature” is not simply one universal format.

BIP-340 precisely specifies how Bitcoin’s version works.

What Is secp256k1?

You may have seen the term secp256k1 in other Bitcoin articles.

It is the elliptic curve used by Bitcoin’s public-key cryptography.

Both Bitcoin’s traditional ECDSA signatures and BIP-340 Schnorr signatures use this curve.

You don’t need to understand the mathematics of elliptic curves to understand the basic idea.

Think of secp256k1 as the mathematical environment in which Bitcoin’s keys and signatures operate.

Your private key is a secret number.

Your public key is derived from that secret using elliptic-curve mathematics.

A signature then provides evidence that the signer controls the appropriate secret key.

Why Did Bitcoin Need Schnorr Signatures?

BIP-340 identifies several important advantages over traditional ECDSA.

The first is non-malleability.

The second is linearity.

And the third is a more compact and precisely defined signature format.

These properties become particularly interesting when multiple people or keys need to cooperate.

For example, imagine a Bitcoin wallet that requires several participants to authorize a transaction.

With suitable Schnorr-based protocols, multiple participants can cooperate to produce a single signature that verifies against a combined public key.

This creates opportunities for more efficient and private multisignature constructions.

BIP-340 specifically notes that Schnorr’s linearity is useful as a building block for multisignatures and other higher-level constructions.

This is one reason Schnorr became important for Bitcoin’s later development.

What Does “Linear” Mean Here?

The word linearity can sound intimidating.

In simple terms, it means Schnorr signatures have mathematical properties that allow multiple participants to combine their contributions in useful ways.

Imagine three people each control a separate private key.

Instead of necessarily creating a transaction that visibly contains three independent signatures, a Schnorr-based multisignature protocol can allow them to cooperate toward a single signature.

The resulting construction can look much more like an ordinary single-signature spend.

This idea became especially important with technologies such as MuSig2.

BIP-327, for example, defines MuSig2 as a multisignature scheme compatible with BIP-340 Schnorr signatures.

We’ll explore this connection in much more detail later.

Schnorr Signatures Are Not the Same as Multisig

This distinction is important.

Schnorr is a signature scheme.

Multisig is a spending arrangement that can require multiple signatures or signers.

Schnorr doesn’t automatically mean “multisig.”

Instead, Schnorr’s mathematical properties make it possible to build efficient multisignature protocols.

This is why BIP-340 and technologies such as MuSig2 are related but not identical.

Think of BIP-340 as providing a cryptographic building block.

Other protocols can build more advanced systems on top of that building block.

Why Are BIP-340 Signatures 64 Bytes?

One notable feature of BIP-340 is its fixed 64-byte signature format.

BIP-340 represents the signature using two 32-byte values.

Together:

32 bytes + 32 bytes = 64 bytes

This is smaller and simpler than the variable-size DER-encoded ECDSA signatures traditionally used by Bitcoin.

BIP-340 also uses a 32-byte public-key representation rather than the traditional 33-byte compressed public-key encoding.

These may sound like small differences.

However, Bitcoin processes enormous numbers of cryptographic operations.

Compact formats can therefore matter for storage, transmission, and verification efficiency.

Why Does Fixed Size Matter?

Imagine two systems.

One produces signatures whose encoded size can vary.

The other always produces signatures of exactly the same size.

The second system is easier to reason about at the encoding level.

BIP-340 was designed with this kind of precision in mind.

The specification defines the encoding and verification rules at the byte level.

This matters because Bitcoin is a consensus system.

Different computers around the world must agree on whether a signature is valid.

Ambiguity is dangerous.

If one implementation accepts something another implementation rejects, the network could face serious problems.

BIP-340 therefore specifies the signing and verification process very precisely.

Schnorr vs ECDSA: The Basic Difference

At a high level:

Feature	ECDSA	BIP-340 Schnorr
Used by Bitcoin	Yes	Yes
Curve	secp256k1	secp256k1
Signature format	DER-based, variable size	Fixed 64 bytes
Linearity	No comparable native property	Yes
Multisignature constructions	More complicated	Well suited
Batch verification	Limited by Bitcoin’s ECDSA formulation	Supported by BIP-340

BIP-340 specifically designed its Schnorr formulation to support batch verification, where multiple signatures can be verified together more efficiently than checking every signature independently in appropriate circumstances.

Does Schnorr Make Bitcoin More Private?

Not by itself.

This is an important misconception.

Simply using a Schnorr signature does not automatically make every Bitcoin transaction private.

The privacy benefits come from the constructions that Schnorr enables.

For example, multisignature protocols can potentially allow multiple participants to produce a single signature that looks similar to an ordinary signature.

That can reduce the amount of information visible on-chain.

However, privacy depends on the complete transaction structure and the protocol being used.

Schnorr is therefore better understood as an important cryptographic building block, rather than a standalone privacy technology.

How Does BIP-340 Relate to Taproot?

This is where BIP-340 becomes especially important for ordinary Bitcoin users.

Bitcoin’s Taproot upgrade uses Schnorr signatures.

BIP-341 specifies Taproot’s spending rules and explicitly uses BIP-340’s Schnorr verification for Taproot key-path spending.

So the relationship is roughly:

BIP-340 → Schnorr signatures

BIP-341 → Taproot spending rules

Together, these specifications enabled a major expansion of Bitcoin’s scripting and spending capabilities.

If you’ve already read our guide to Bitcoin Taproot, BIP-340 provides an important piece of the cryptographic foundation underneath it.

Why BIP-340 Matters

BIP-340 isn’t just another technical document.

It introduced a standardized Schnorr signature scheme that became an important foundation for modern Bitcoin.

It provides:

Compact 64-byte signatures.
32-byte public-key encoding.
Non-malleability.
Linearity.
Batch verification.
Precisely defined signing and verification rules.
A foundation for advanced multisignature protocols.
The signature system used by Taproot’s key path.

These properties opened the door to technologies that would have been much harder to implement efficiently with traditional ECDSA alone.

What Does a BIP-340 Signature Contain?

A BIP-340 signature is exactly 64 bytes long.

It consists of two 32-byte values:

r + s

The first 32 bytes represent the X coordinate of an elliptic-curve point called R.

The second 32 bytes contain the value s.

You can think of the signature as:

Signature = (r, s)

The verifier uses these values together with the public key and message to determine whether the signature is valid.

BIP-340 deliberately uses the X coordinate instead of storing the entire elliptic-curve point. This keeps the signature compact.

The Three Main Pieces

Before looking at the signing process, it’s useful to understand three important variables.

Private Key

The private key is a secret 32-byte number.

Only the owner should know it.

The private key allows the wallet to produce valid signatures.

Public Key

The public key is mathematically derived from the private key.

Bitcoin users can safely share it because it doesn’t reveal the private key.

BIP-340 represents its public keys using only the X coordinate, resulting in a 32-byte representation.

Message

The message is the data being signed.

In Bitcoin, this ultimately relates to transaction data.

BIP-340 itself can also sign arbitrary byte strings, although applications may apply their own hashing or domain-separation rules first.

What Is the Nonce?

One of the most important concepts in Schnorr signatures is the nonce.

A nonce is a temporary secret value used during the signing process.

It should be fresh for each signature.

You can think of it as a temporary secret that helps produce the signature without exposing the actual private key.

The nonce is used to create another elliptic-curve point called R.

In simplified form:

Nonce → R

The final signature then incorporates information derived from R.

Why Is Nonce Security So Important?

This is one of the most important security lessons in digital signatures.

A signing system must never accidentally reuse a dangerous nonce.

If the same nonce is reused incorrectly across signatures, an attacker may be able to recover the private key.

BIP-340 therefore puts significant attention on how the nonce is generated.

Its default signing algorithm uses auxiliary randomness, the private key, public key, and message to derive the nonce. The specification also emphasizes that the resulting nonce must not be predictable to an attacker.

This is why you should never try to implement Bitcoin cryptography yourself.

Wallet software relies on carefully tested cryptographic libraries.

BIP-340 Uses Synthetic Nonces

BIP-340’s default signing method uses what the specification calls a synthetic nonce.

The process combines the secret key with auxiliary random data.

In simplified terms:

Private key + auxiliary randomness + public key + message → nonce

The exact process uses tagged SHA-256 hashing.

This design provides additional protection against certain implementation and side-channel problems.

Importantly, the randomness is supplemental to the core security of the signing algorithm. BIP-340 recommends fresh unpredictable randomness when available, while also defining ways to operate when a source of randomness is unavailable.

What Is the Challenge Value?

After generating the nonce point R, BIP-340 calculates a cryptographic challenge.

The challenge is commonly represented by e.

The simplified idea is:

R + Public Key + Message → Hash → e

BIP-340 uses a tagged SHA-256 hash for this calculation.

The tag used for the challenge is:

BIP0340/challenge

This helps ensure that the hash is being used for its intended cryptographic purpose.

What Are Tagged Hashes?

BIP-340 uses tagged hashes in several places.

Why?

Because cryptographic systems often use hash functions for many different purposes.

Imagine the same hash construction being accidentally reused for two unrelated protocols.

That could create unexpected interactions.

Tagged hashing separates those contexts.

Conceptually:

Purpose A → Tag A → Hash

Purpose B → Tag B → Hash

Even though both use SHA-256 underneath, their inputs are separated by their specific tags.

BIP-340 uses tags such as:

BIP0340/aux
BIP0340/nonce
BIP0340/challenge

This prevents different cryptographic operations from accidentally sharing the same hash context.

The BIP-340 Signing Process

Now we can put the pieces together.

At a simplified level, the signing process works like this:

Step 1: Start With the Private Key

The wallet begins with the secret key.

Step 2: Derive the Public Key

The corresponding public key is calculated.

Step 3: Generate a Fresh Nonce

The wallet derives a temporary nonce using the BIP-340 nonce-generation process.

Step 4: Create R

The nonce is multiplied by the elliptic-curve generator point to create R.

Step 5: Calculate the Challenge

The wallet hashes:

R + Public Key + Message

to produce the challenge value e.

Step 6: Calculate s

The signing algorithm combines the nonce, challenge, and private-key-related value to calculate s.

Step 7: Output the Signature

The wallet combines:

r + s

to create the 64-byte Schnorr signature.

The resulting signature can then be given to a verifier.

What Is the Basic Schnorr Equation?

The underlying mathematics can be summarized using an equation.

In simplified BIP-340 form, the signature satisfies:

sG = R + eP

Where:

G = the elliptic-curve generator point
P = the public key
R = the nonce point
e = the cryptographic challenge
s = the signature value

The important thing isn’t memorizing the equation.

The important idea is that the signer creates values that satisfy a mathematical relationship involving the public key and message.

The verifier can then check that relationship without learning the private key.

How Does Verification Work?

Suppose Alice sends Bob:

A message
Her public key
A BIP-340 signature

Bob doesn’t need Alice’s private key.

Instead, he runs the verification algorithm.

At a simplified level, the verifier:

Reads the public key.
Reads the 64-byte signature.
Extracts r and s.
Calculates the same challenge from the signature’s R value, public key, and message.
Reconstructs the expected relationship.
Checks whether the resulting point is valid.
Accepts the signature only if all required conditions pass.

The verifier therefore doesn’t ask:

“Do I trust Alice?”

It asks:

“Does this signature mathematically prove control of the corresponding private key for this message?”

That is the power of digital signatures.

Why Does BIP-340 Care About Even Y Coordinates?

This is one of the more technical parts of the specification.

An elliptic-curve point has an X coordinate and a Y coordinate.

For a valid X coordinate, there can be two possible Y coordinates.

Those two points are negatives of each other on the curve.

BIP-340 solves this ambiguity by selecting the point whose Y coordinate is even.

This applies to the public key and the R point used in the signature.

As a result, BIP-340 can store only the X coordinate while still having a uniquely defined point during verification.

That’s one reason BIP-340 can use:

32-byte public keys

instead of the traditional compressed 33-byte public-key encoding.

What Is Key Prefixing?

Another important BIP-340 feature is called key prefixing.

This means the public key is included in the data used to calculate the challenge.

Instead of conceptually calculating:

Hash(R + Message)

BIP-340 uses:

Hash(R + Public Key + Message)

This protects against certain related-key attacks.

The protection becomes particularly important when public keys can be modified using additive tweaks.

That matters for Bitcoin because systems such as BIP-32 and Taproot use key tweaking techniques.

BIP-340 therefore includes the public key directly in the challenge calculation.

Why Is Key Prefixing Important for Taproot?

Taproot relies heavily on key tweaking.

A Taproot output can be constructed using a tweaked public key.

If the signature scheme did not properly account for the public key, certain related-key attacks could become possible.

BIP-340’s key-prefixing design helps prevent these problems.

The BIP specifically notes that key prefixing protects against related-key attacks involving additive tweaks and improves robustness for multiparty signing protocols such as MuSig and MuSig2.

So this isn’t just an academic detail.

It helps make Schnorr suitable for the way modern Bitcoin systems actually use keys.

What Is Batch Verification?

Another advantage of BIP-340 is batch verification.

Imagine a Bitcoin system needs to verify 100 Schnorr signatures.

The simplest approach would be:

Signature 1 → Verify

Signature 2 → Verify

Signature 3 → Verify

and so on.

Batch verification allows multiple signatures to be checked together using a combined mathematical equation.

This can reduce the computational work compared with verifying every signature completely independently.

BIP-340 specifies a batch-verification algorithm using randomly generated coefficients.

If all individual signatures are valid, the batch verification succeeds.

If one or more signatures are invalid, the batch verification can only incorrectly succeed with negligible probability under the specified construction.

Does Batch Verification Mean Every Signature Is Verified Together?

Not necessarily.

It is an optimization available to implementations.

A wallet, node, or other software can choose whether to verify signatures individually or in batches.

The important point is that BIP-340 defines a standardized method for batch verification.

This was one of the improvements made possible by moving from Bitcoin’s traditional ECDSA formulation to Schnorr.

Why Doesn’t BIP-340 Just Use Any Schnorr Signature?

Because Bitcoin needs extremely precise rules.

A general cryptographic description might leave certain implementation choices open.

That is dangerous in a consensus system.

Imagine two Bitcoin implementations interpreting the same signature differently.

One says:

Valid

Another says:

Invalid

That could create serious network problems.

BIP-340 therefore specifies things such as:

Key encoding
Signature encoding
Point handling
Y-coordinate selection
Hash construction
Nonce generation
Challenge calculation
Verification rules
Batch verification

The goal is that different implementations reach the same result.

BIP-340 Can Sign More Than 32-Byte Messages

An earlier version of the BIP restricted messages to exactly 32 bytes.

The current specification allows messages of arbitrary size.

However, applications may still choose to pre-hash large messages for performance reasons.

This change makes BIP-340 more flexible for applications outside ordinary Bitcoin transaction signing.

BIP-340 and Domain Separation

Another important concept is domain separation.

Suppose the same private key is used to sign different types of information.

You don’t want a signature created for one application to accidentally be interpreted as a valid signature in another application.

Domain separation helps keep these contexts distinct.

Applications can achieve this by using unique tagged hashes or other context-specific prefixes.

This is especially important when cryptographic keys are reused across different protocols.

BIP-340 recommends that applications clearly separate different signing contexts.

The Bigger Picture

At this point, we can see why BIP-340 is more than simply “another signature algorithm.”

It provides a carefully designed cryptographic foundation.

The process can be simplified to:

Private key

↓

Fresh nonce

↓

Nonce point R

↓

Hash(R + Public Key + Message)

↓

Challenge e

↓

Signature value s

↓

64-byte Schnorr signature

↓

Verification

This foundation can then support more advanced Bitcoin technologies.

BIP-340 Schnorr vs ECDSA

Bitcoin has used both ECDSA and Schnorr signatures, but they have different properties.

Feature	ECDSA	BIP-340 Schnorr
Bitcoin uses it	Yes	Yes
Curve	secp256k1	secp256k1
Signature size	Variable DER encoding	64 bytes
Public-key encoding	Traditionally 33 bytes	32 bytes
Linear	No	Yes
Batch verification	Not part of BIP-340	Supported
Multisignature building blocks	More complicated	Particularly suitable

Schnorr doesn’t simply replace every ECDSA use in Bitcoin.

Instead, Bitcoin uses the two systems for different purposes.

For example, Taproot uses BIP-340 Schnorr signatures for its key-path spending conditions.

Why Is Schnorr More Useful for Multisignatures?

One of Schnorr’s most important properties is linearity.

In simplified terms, this allows multiple participants to combine public-key and signature contributions in ways that are mathematically compatible.

That creates an important possibility.

Suppose Alice, Bob, and Carol want to control Bitcoin together.

A traditional multisig arrangement can require multiple signatures to appear in the spending transaction.

A Schnorr-based protocol can instead allow participants to cooperate to create a single aggregate signature.

The important distinction is that Schnorr itself isn’t a multisignature protocol.

It provides the mathematical foundation that protocols such as MuSig2 can use.

What Is MuSig2?

MuSig2 is a multisignature scheme designed around Schnorr signatures.

BIP-327 specifies MuSig2 and uses BIP-340-compatible Schnorr signatures.

The basic idea is that multiple participants can jointly control a public key and cooperate to produce a signature.

To an outside observer, the resulting key-path spend can resemble an ordinary single-key Schnorr spend.

This can improve efficiency and, depending on the construction and spending conditions, reduce information revealed on-chain.

However, MuSig2 is a separate protocol from BIP-340.

Think of the relationship like this:

BIP-340 = Schnorr signature foundation

MuSig2 = multisignature protocol built using Schnorr

Schnorr and Taproot

This is probably the most important connection for Bitcoin users.

Taproot introduced a new way to construct Bitcoin outputs and spending conditions.

Its key-path spending uses Schnorr signatures defined by BIP-340.

This combination allows a Taproot output to use a public key that represents the spending condition.

If the key path is used, the spender can provide a Schnorr signature rather than revealing a more complicated script path.

That can make certain transactions more compact and reveal less information about the possible spending conditions.

Our existing Bitcoin Taproot article goes deeper into the Taproot upgrade itself.

BIP-340 provides one of the cryptographic foundations underneath it.

Does Schnorr Make Every Bitcoin Transaction Smaller?

No.

This is an important misconception.

Using Schnorr does not automatically make every Bitcoin transaction smaller.

The actual size depends on the transaction type, script, inputs, outputs, witness data, and spending method.

However, Schnorr’s fixed-size signatures and its compatibility with efficient constructions can improve efficiency in certain situations.

The biggest advantages become more obvious when advanced protocols use Schnorr’s mathematical properties.

Does Schnorr Make Bitcoin Private?

Not automatically.

A Schnorr signature doesn’t hide:

The transaction amount.
The inputs.
The outputs.
The blockchain history.
The addresses or scripts that remain publicly observable.

However, Schnorr can enable protocols that improve privacy.

For example, a multisignature protocol can potentially combine several participants into one aggregate signature.

An observer may therefore have less information about how many participants were involved.

Taproot can also allow certain spending conditions to remain hidden when the key path is used.

So the more accurate statement is:

Schnorr enables privacy-enhancing constructions, but Schnorr itself is not an anonymity system.

Schnorr and Threshold Signing

Schnorr signatures can also serve as a foundation for threshold-signing systems.

A threshold arrangement might require several participants to cooperate before a valid signature can be produced.

For example:

2-of-3 participants

could be required to authorize a transaction.

Instead of revealing the entire internal signing arrangement on-chain, an appropriate threshold-signature protocol can produce a single valid Schnorr signature.

This can provide a useful combination of:

Shared control
Efficient transactions
Less on-chain information

However, the security depends on the complete threshold protocol, not merely on BIP-340.

What Are Adaptor Signatures?

Another advanced application of Schnorr signatures is the adaptor signature concept.

An adaptor signature can be thought of as a signature that is tied to an additional secret.

When the hidden secret is revealed, it can allow another party to complete or extract information from the signing process.

This property has attracted attention for advanced Bitcoin protocols, including certain payment and contract constructions.

Adaptor signatures are not themselves defined as a basic feature of BIP-340.

Instead, they are an example of what Schnorr’s mathematical structure can enable when combined with additional protocols.

Why Does Schnorr’s Linearity Matter So Much?

Let’s return to the key idea from Part 1.

Schnorr signatures have useful linearity properties.

That means cryptographic operations involving multiple keys or signatures can sometimes be combined mathematically.

This opens the door to constructions such as:

Multisignatures
Threshold signatures
Signature aggregation techniques
Adaptor signatures
More advanced contract protocols

These systems can improve efficiency or privacy depending on how they are designed.

This is why Schnorr is often described as a building block rather than simply a replacement for ECDSA.

What Are the Advantages of BIP-340?

BIP-340 provides several important benefits.

Compact Signatures

Each BIP-340 signature is 64 bytes.

That gives Bitcoin a predictable signature representation.

Efficient Verification

BIP-340 defines batch verification, which can allow implementations to verify multiple signatures together.

Non-Malleability

BIP-340 was designed to provide a non-malleable signature scheme.

This helps prevent certain forms of signature manipulation.

Linearity

Schnorr’s linearity enables advanced multisignature and threshold constructions.

Strong Foundation for Taproot

BIP-340 provides the Schnorr signature system used by Taproot’s key-path spending.

Better Building Blocks

Developers can construct more advanced protocols from the underlying Schnorr properties.

What Are the Limitations?

Schnorr isn’t magic.

It has limitations and shouldn’t be misunderstood.

It Doesn’t Protect Your Private Key

If someone obtains your private key, Schnorr cannot protect your Bitcoin.

It Doesn’t Hide the Blockchain

Bitcoin transactions remain publicly observable.

It Doesn’t Automatically Provide Anonymity

Privacy depends on the complete protocol and transaction structure.

Advanced Protocols Can Be Complex

MuSig2, threshold schemes, adaptor signatures, and related constructions require careful cryptographic design.

Implementation Still Matters

A mathematically secure signature scheme can still be undermined by a faulty wallet or cryptographic implementation.

This is why Bitcoin wallets rely on well-tested cryptographic libraries rather than home-built signing code.

Why Can’t You Just Convert Every ECDSA Signature to Schnorr?

Because they are different signature schemes with different rules.

A wallet cannot simply take an existing ECDSA signature and “convert” it into a Schnorr signature.

The signer must create a Schnorr signature using the appropriate private key, message, nonce-generation procedure, and BIP-340 rules.

Likewise, Bitcoin’s transaction rules determine which signature system applies to a particular spending condition.

This is why Bitcoin can support both ECDSA and Schnorr without treating them as interchangeable formats.

Is Schnorr Better Than ECDSA?

There isn’t one simple answer.

For many modern Bitcoin applications, Schnorr offers useful properties that ECDSA does not.

Its linearity is particularly valuable for multisignature protocols, while its fixed-size encoding and batch-verification support provide other benefits.

However, ECDSA remains an important part of Bitcoin because older output types and existing transactions still use it.

So rather than saying:

“ECDSA is obsolete.”

it’s more accurate to say:

“Schnorr gives Bitcoin a powerful additional cryptographic building block.”

Why BIP-340 Matters to Ordinary Bitcoin Users

You might never manually create a Schnorr signature.

Your wallet handles that automatically.

Still, BIP-340 matters because it sits underneath several technologies that Bitcoin users may encounter.

For example:

Taproot

MuSig2

Modern multisignature systems

Threshold-signing protocols

Adaptor-signature constructions

Understanding BIP-340 therefore makes it easier to understand how modern Bitcoin wallets and protocols work.

Frequently Asked Questions

What is BIP-340?

BIP-340 is the Bitcoin Improvement Proposal that specifies Schnorr signatures over the secp256k1 elliptic curve for Bitcoin.

Is BIP-340 deployed?

Yes. The official BIP lists BIP-340 as Deployed.

What is a Schnorr signature?

A Schnorr signature is a digital signature that allows someone to prove control of a private key without revealing the private key.

How large is a BIP-340 signature?

A BIP-340 signature is exactly 64 bytes, consisting of two 32-byte values.

Does BIP-340 replace ECDSA?

No. Bitcoin continues to support ECDSA for existing and applicable spending conditions.

Does Taproot use BIP-340?

Yes. Taproot’s key-path signature verification uses the BIP-340 Schnorr signature scheme.

Is Schnorr the same as multisig?

No. Schnorr is a signature scheme. Multisignature protocols can use Schnorr as their cryptographic foundation.

What is MuSig2?

MuSig2 is a multisignature scheme that allows multiple participants to jointly produce Schnorr signatures using a combined public key.

Does Schnorr improve Bitcoin privacy?

It can enable privacy-enhancing constructions, but a Schnorr signature by itself does not make a Bitcoin transaction anonymous.

What is key prefixing?

Key prefixing means the public key is included when calculating the BIP-340 challenge. This helps protect against related-key attacks.

Why does BIP-340 use 32-byte public keys?

BIP-340 uses the X coordinate of a public-key point and selects the point with an even Y coordinate, allowing a 32-byte representation.

Can Schnorr signatures be verified in batches?

Yes. BIP-340 specifies a batch-verification algorithm.

What is a nonce?

A nonce is a temporary secret value used during the signing process. Secure nonce generation is critical because incorrect nonce reuse can expose a private key.

Can Schnorr signatures be used for smart contracts?

Schnorr signatures can serve as building blocks for advanced Bitcoin contract and signing protocols, although BIP-340 itself defines the signature scheme rather than a complete smart-contract system.

BIP-340 in Simple Terms

If the technical details feel overwhelming, remember this:

ECDSA gave Bitcoin its original digital-signature system.

BIP-340 introduced a standardized Schnorr signature system.

Schnorr provides useful properties such as linearity and compact fixed-size signatures.

Those properties make advanced protocols easier to build.

And that leads to technologies such as Taproot and MuSig2.

So BIP-340 isn’t just about creating a different type of signature.

It helped give modern Bitcoin developers a more flexible cryptographic foundation.

Final Thoughts

BIP-340 is one of the most important cryptographic improvements in modern Bitcoin.

At first glance, it may look like a technical specification for a 64-byte signature.

But its importance goes much further.

Schnorr signatures provide Bitcoin with properties that are particularly useful for building advanced signing protocols.

Their linearity supports multisignature constructions.

Their fixed-size format simplifies signature handling.

Their verification rules support batch verification.

And their integration with Taproot helps Bitcoin hide certain spending conditions when the appropriate spending path is used.

Most importantly, BIP-340 works as a building block.

It doesn’t attempt to solve every Bitcoin problem itself.

Instead, it gives developers a strong cryptographic foundation on which more sophisticated protocols can be built.

For everyday users, the biggest takeaway is simple:

When you use modern Bitcoin features such as Taproot, you’re benefiting from cryptographic technology that includes BIP-340 Schnorr signatures underneath the hood.

5 Key Takeaways

BIP-340 defines Bitcoin’s standardized Schnorr signature scheme over secp256k1.
Its signatures are fixed at 64 bytes.
Schnorr’s linearity enables advanced multisignature and threshold constructions.
Taproot uses BIP-340 Schnorr signatures for key-path spending.
Schnorr improves Bitcoin’s cryptographic building blocks but does not automatically provide anonymity or complete privacy.