A bitcoin signature has: z = hash(m)

Using a private key pk we can generate a signature for message m consisting of two numbers: r (x coordinate of the random point R = k×G) and s = (z+r⋅pk)/k. Then, using our public key P = pk×G anyone can verify our signature by checking that point (z/s)×G+(r/s)×P has x coordinate equal to r.

Aggregate Schnorr has:

Call L = H(X1,X2,…)

Each signer chooses a random nonce ri, and shares Ri = riG with the other signers

Call R the sum of the Ri points

Each signer computes si = ri + H(L,Xi,R,m)xi

The final signature is (R,s) where s is the sum of the si values

Verification requires sG = R + H(L,X1,R,m)X1 + H(L,X2,R,m)X2 + …

Why do the hash and the random value swap places in the aggregate Schnorr sig?

  • I don't understand what swapping you're talking about. Commented Jun 8, 2019 at 9:01
  • @PieterWuille The z in the first formula is a hash of the message and is added, while the random r is the slope. In the aggregate Schnorr I assume there is a reason for the Hash H to be multiplied by the private key while the random r is added. Commented Jun 8, 2019 at 9:06
  • 2
    Oh, that's just the distinction between DSA and Schnorr. They're very similar, but DSA was designed to avoid the patent on Schnorr signatures. Commented Jun 8, 2019 at 9:26

1 Answer 1


Schnorr signatures were patented by their creator, Claus Schnorr, and required permission from him in order to be used. The Digital Signature Algorithm (DSA) is similar to the Schnor signature scheme but is made available publicly for free by the US government.

DSA is largely an alternative to Schnorr and needed to be different enough from it so that it would not violate Schnorr's patent. Part of this is different signing and verification formulas.

So what you are seeing is part of the difference between DSA and Schnorr. Bitcoin currently uses DSA over an Elliptic Curve (ECDSA) and the proposed bip-schnorr uses Schnorr signatures over an Elliptic Curve. Thus the differences that you are seeing are because ECDSA and EC-Schnorr are two different algorithms designed to avoid each other's patents.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.