Here (see the comments) Pieter Wuille described digital scheme as a collection of three algorithms:

(key generation, signing, verification)

Since Bitcoin uses ECDSA (pre-Taproot outputs) and Schnorr (Taproot outputs) digital schemes, my question is what does some digital scheme must to have, that is what is the requirement, to be used indirectly in Bitcoin? When I say indirectly, I mean that it does not replace existing schemes (that would require a hard fork or a new segwit version), but is used to create signatures and keys (in order to multi-party signature or something more advanced). Is the requirement just to have the same verification algorithm, i.e. to ensure that the signature and public key match when the network would use normal ECDSA/Schnorr to verify the validity of the transaction and that's it, or something more?

1 Answer 1


At a technical level, all that matters is the verification equation. If your scheme ends up with keys and signatures on-chain that verify using ECDSA (or BIP340 for Taproot outputs), the transaction is valid. The consensus rules don't know or care how you ended up with that signature.

And perhaps more generally, Bitcoin Script supports more things than just signatures. You can create a transaction output that can be spent without signature at all. Of course, this would be insecure, but nothing prevents you from using this.

So just because any scheme that results in scripts that execute successfully is in theory usable, doesn't mean any of those should be used. What should be used is a much harder question, because it involves concerns like security, practicality (e.g. 2P-ECDSA for ECDSA multisignatures exist, but is fairly complicated), features (e.g. thresholds and multisignatures, ...), standardization/implementation status (just because someone wrote a paper about a particular scheme doesn't mean there is a usable implementation with sufficient review, ...).

  • So, Bitcoin and its consensus only involve the verification algorithm from the (key generation, sing, verification) digital signature scheme (specifically the verification algorithm for ECDSA and Schnorr)? Algorithms for key generation and signature generation are not important and are not even part of the consensus rules, that is, part of Bitcoin?
    – LeaBit
    Commented Nov 10, 2023 at 18:14
  • I disagree that key generation and signing are unimportant - they're standardized, and individual wallet security very much depends on doing it right. They're just aspects of the wallet side of things, and not part of the consensus rules. Commented Nov 10, 2023 at 18:18
  • 1
    I wanted to say that they are not important to Bitcoin in the context of the consensus because they are not part of it. However, they are important from the security aspect, as you said, for wallets, creating the transaction in a secure way, etc.
    – LeaBit
    Commented Nov 10, 2023 at 18:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.