3

In this question Schnorr vs ECDSA I see in the Peter Wuille's answer the following comment about Schnorr signature batch validation: "Improving verification speed, by supporting batch validation of all signatures in a block at once (for a fraction of the speed of validating them individually)."

However, looking at the chart in the BIP here https://github.com/sipa/bips/blob/bip-schnorr/bip-schnorr.mediawiki#Batch_verification it seems that savings are actually close a factor of log(n). In other words, for about 10,000 signatures the time savings are about 2.5X. I know that technically that is a fraction, but it seemed that the implication was that the improvement was more dramatic. Is there something I am missing? Also, what is the actual time in clock cycles that was a starting point for one Schnorr signature verification? Thank you.

3

Speedup in well optimized cryptographic functions are hard to come by. In libsecp256k1 we'll usually celebrate a 4% algorithmic speedup. Figures on the order of 2x are reasonable for the usage in Bitcoin, though larger might be possible in the future during initial block download since much larger batches could be used.

A single validation on a single core of a fast desktop grade cpu takes about 50 microseconds.

Another relevant Q/A is Schnorr's batch validation

  • Thank you. Definitely not arguing that point, 2 or 2.5X is big news, just wanted to make sure I am not missing anything. – Daniel S Nov 23 '18 at 11:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.