Why did Bitcoin add a decades-old signature scheme in 2021?
For years Bitcoin signed everything with ECDSA. In 2021 it added a scheme from a 1991 paper, because it has a trick ECDSA lacks: signatures that add up.
▶ Start the storyA Schnorr signature is a digital signature: a way to prove that a message came from the holder of a private key. It was invented by the German mathematician Claus Schnorr, and it is known for its simplicity. It is efficient, produces short signatures, and was among the first schemes whose security rests on the hardness of certain problems. Until November 2021, Bitcoin used only a different scheme, ECDSA. That month its upgrade added support for Schnorr signatures.
Why add it? The proposal that defines Bitcoin's version, BIP 340, lists what Schnorr offers on the same elliptic curve. The signatures are provably secure. They are non-, whereas ECDSA signatures are inherently malleable: a third party without the secret key can alter a valid signature into another valid signature for the same key and message. And they have a property called linearity, which is the one that matters most for this path: several collaborating parties can produce a signature valid for the sum of their public keys. That is the building block for multisignatures and other constructions that improve efficiency and privacy.
ECDSA
- The only one in Bitcoin before November 2021
- Inherently
- No faster batch checking unless extra data is added
Schnorr
- Added by the upgrade
- Provably secure and non-
- Signatures add up across parties
There is a speed bonus too. ECDSA as standardized cannot be checked in batch faster than one signature at a time, unless extra data is added. The Schnorr formulation Bitcoin chose can be.
The history is partly a story about patents. Schnorr's original paper dates from 1991, and it suggested that shorter hash functions may be just as secure. The scheme was covered by a U.S. patent that expired only in February 2010. Schnorr even claimed that his patent covered DSA, the U.S. standard signature algorithm, though that claim is disputed. He died in June 2025, a few years after his name went onto Bitcoin's signatures.
Quiz me
0/3
Recap
Schnorr signatures are linear, so several parties can produce a signature valid for the sum of their public keys.
💡 A trick to remember it · Schnorr signatures sing in chorus: several signers join their voices, and what comes out is one signature that answers to the sum of their keys.
Surprising fact · Schnorr's patent expired in February 2010, and he claimed (disputed) that it covered the U.S. standard DSA.
Connects to
- 🔏 How can three of five devices sign a transaction without the key ever existing in one place?
- 🪙 How did an anonymous white paper turn into money nobody controls?
- ✍️ How can a message prove who really sent it?
- 🔑 How do computers tell a file hasn't been changed?
- 📐 How can a key twelve times shorter be just as secure?
Sources (6)
No source, no claim. Every fact in this lesson (16 claims) cites at least one of these.