3

Schnorr signatures are often compared as superior to the Elliptic Curve ones. Then why developers added Schnorr into libsecp256k1 library which is, as the name suggests, an Elliptic Curve library?

Why not create a separate C library? Or is Schnorr signature part of Elliptic Curve signature group?

Thanks

Improve this question

1 Answer 1

Reset to default
7

Yes, the BIP340 signature scheme that was added to libsecp256k1 is an Elliptic Curve based variant of Schnorr signatures. Traditionally Schnorr signatures use a group of integer multiplication modulo a large prime, but that's not what is used here. It's integrated into libsecp256k1, because it is a Schnorr scheme over the secp256k1 group, so lots of code is shared between ECDSA and Schnorr.

Improve this answer
4
  • 1
    Do all the advantages of Schnorr still hold even if it uses a non-traditional Elliptic Curve implementation?
    – yerzhan7
    Commented Jul 1, 2021 at 7:14
  • 2
    "Schnorr signatures" isn't a fully specified scheme; it's a general class of digital signature algorithms with many possible variations. All the advantages of the BIP340 scheme over ECDSA obviously apply - the scheme was specifically designed to have those!
    – Pieter Wuille
    Commented Jul 1, 2021 at 16:07
  • @PieterWuille whats the advantages of doing that over secp256k1 instead of the regular large prime"?
    – Ron
    Commented Aug 24, 2022 at 22:33
  • 1
    @Ron You mean using Schnorr over an integer multiplication group? That has all the disadvantages such groups have: you need around 3000-bit keys and signatures for a similar security level, they're much slower, and they need a very different security assuption than the one Bitcoin already relies on (secp256k1's DL hardness).
    – Pieter Wuille
    Commented Aug 24, 2022 at 23:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.