23 votes
Accepted

What are the advantages of Schnorr vs ECDSA?

Your question seems to assume that the only goal is minimizing on-chain transaction size. Reducing size and related costs is certainly something that can be improved upon, but it's far from the only ...
Pieter Wuille's user avatar
20 votes
Accepted

Are Schnorr signatures quantum-computer resistant?

No, ECDSA and EC-Schnorr, as well as related schemes like EdDSA, all belong to the class of elliptic curve cryptography. Their security is based on the assumption that the EC discrete logarithm is ...
Pieter Wuille's user avatar
17 votes
Accepted

When Schnorr signatures are part of Bitcoin will it be possible validate each block with only one signature validation?

Yes, one validation per block, but not one signature per block. To clear up confusion, there are 3 distinct technologies involved here: (1) non-interactive aggregation is the ability for a third ...
Pieter Wuille's user avatar
16 votes
Accepted

Will a Schnorr soft-fork introduce a new address format (i.e. not bech32)

They will be distinguishable, but they will still be bech32 addresses. The introduction of Schnorr signatures requires a new type of output. Segwit was designed with such extensibility in mind, and it ...
Pieter Wuille's user avatar
15 votes
Accepted

Schnorr's batch validation

You're right that the elliptic curve multiplication is indeed the most expensive operation in the validation algorithm. And as both single signature validation and batch validation require two EC ...
Pieter Wuille's user avatar
14 votes
Accepted

Why is no security lost by using 32-byte public keys in Schnorr signatures instead of 33?

From the (very recently updated) bip-schnorr draft: Implicit Y coordinates are not a reduction in security when expressed as the number of elliptic curve operations an attacker is expected to perform ...
Pieter Wuille's user avatar
14 votes
Accepted

Musig Signature Interactivity

MuSig is interactive because each signer needs to provide a signature nonce (effectively randomness) before signing. This is not specific to MuSig, but applies to any discrete logarithm-based ...
nickler's user avatar
  • 776
13 votes
Accepted

Why was ECDSA chosen over Schnorr Signatures in the inital design?

Why was ECDSA chosen over Schnorr Signatures in the inital design? You'll need to ask Satoshi to know for sure, but my guess is simply because ECDSA was well standardized at the time, while no ...
Pieter Wuille's user avatar
13 votes
Accepted

Will Schnorr Multi-signatures completely replace ECDSA?

Schnorr signatures will not replace ECDSA. Schnorr signature verification is expected to be implemented with the Taproot soft-fork using SegWit witness version 1. This means only outputs that are ...
Ugam Kamat's user avatar
  • 7,398
11 votes
Accepted

Why was the Schnorr code removed from Bitcoin Core?

The Schnorr implementation was never in Bitcoin Core. Rather it is in the libsecp256k1 library that is a subtree in Bitcoin Core. The commit you reference is actually a commit in that library which ...
Ava Chow's user avatar
  • 70.1k
11 votes
Accepted

BLS signatures vs Schnorr

How do BLS signatures (or other pairing-based schemes) compare to Schnorr signatures in terms of cryptographic assumptions? BLS needs a pairing-compatible elliptic curve, which imposes additional ...
Pieter Wuille's user avatar
10 votes
Accepted

Replacing ECDSA (SECP256k1) with Schnorr signatures

Schnorr will replace ECDSA, the signing algorithm, but both still use the same elliptic curve and thus the same public and private keys, etc. Regardless, compatibility with ECDSA must be kept too ...
meshcollider's user avatar
  • 11.8k
10 votes
Accepted

k selection for Schnorr signatures

I'm not sure what simplified variant you're referring to, but this is a great question. There are a number of reasons. First, RFC6979 is not cheap and fairly complex. Computing a single candidate ...
Pieter Wuille's user avatar
10 votes
Accepted

2-of-3 multisig with Schnorr signatures

From what I understand, Schnorr signatures will allow n-of-n multisignature transactions, however m-of-n isn't possible using the key path alone. That's not quite accurate. Schnorr signatures, as ...
Pieter Wuille's user avatar
9 votes
Accepted

How are scriptless scripts and taproot different?

One of the most common use of script in Bitcoin is to construct logically atomic operations, such as "Tx2 happens if and only if Tx1 happens". Scriptless scripts tells us how to use the additive ...
G. Maxwell's user avatar
  • 7,727
9 votes

Why isn't `OP_CHECKMULTISIG` compatible with batch verification of schnorr signatures?

Batch verification is effectively the following. Whenever a signature check is encountered during script execution, simply remember the (pubkey, message, signature) tuple, but continue immediately ...
Pieter Wuille's user avatar
8 votes
Accepted

What are the limitations for amortizing the interactive session setup of MuSig?

Nonces must not be reused! In particular, in MuSig, nonces can not be reused for other combinations of public keys or messages (also if everyone uses the same public nonces all the time). This would ...
nickler's user avatar
  • 776
8 votes

What are "leaf versions" in Taproot?

To add to Michael Folkson's answer, a question one may have is what the differences are between witness versions and leaf versions. Why do we need both? Leaf versions are not revealed until an output ...
Pieter Wuille's user avatar
8 votes
Accepted

Possible number of signers with MuSig

The number of signers with MuSig (and MuSig2) is practically infinite. For example, creating a MuSig signature with 1 million signers takes about 130 seconds on my laptop (see https://github.com/...
nickler's user avatar
  • 776
8 votes
Accepted

Can Schnorr aggregate signatures be nested inside other Schnorr aggregate signatures?

TL;DR: depending on what you mean, there is probably no published scheme with a security proof, but there is hope for such a scheme. First, a few clarifications Aggregation is just a concept, not an ...
Pieter Wuille's user avatar
7 votes
Accepted

Would a Schnorr PubKey be a different length than a Taproot PubKey like P2WPKH and P2WSH?

A P2WPKH PubKey is shorter than a P2WSH PubKey. No, not quite. A P2WPKH address is shorter than a P2WSH address. The addresses are both based on a hash of the underlying witness program (i.e. the ...
Murch's user avatar
  • 74.6k
7 votes
Accepted

Are the witnesses segregated with Schnorr signatures?

Schnorr (bip-340) signatures have been introduced as part of v1 Segwit outputs with the CHECKSIGADD opcode. Therefore bip-340 signatures are part of the witness and are not part of the hash forming ...
Antoine Poinsot's user avatar
7 votes
Accepted

Is the Schnorr digital signature scheme a multisignature interactive scheme, and also not an aggregated non-interactive scheme?

I want to start by addressing a few misconceptions in your question: "Schnorr signatures" aren't really a well-defined signature scheme. They're a class of digital signature schemes (with ...
Pieter Wuille's user avatar
6 votes

How are scriptless scripts and taproot different?

Scriptless scripts are more like the constructs used in HTLCs and Taproot is more like P2SH. The common example used for scriptless scripts is adaptor signatures. With adaptor signatures, what one ...
Ava Chow's user avatar
  • 70.1k
6 votes

Does a blockchain become opaque if it enable's schnorr-signatures, and require trust in the code?

When you sign a transaction with schnorr-signatures, it does not include the pubkey in the transaction data. What? Schnorr signature validation still need public keys. 1)Does this mean the input ...
Pieter Wuille's user avatar
6 votes
Accepted

Would signature aggregation reduce the largest feasible blocksize

SegWit blocks aren't limited in bytes anymore but rather in weight. The maximum weight for a block is 4M. The weight of non-witness data is 4x its number of bytes. So, yes, decreasing the amount of ...
Jannes's user avatar
  • 6,334
6 votes

Schnorr batch validation speed statistics

Speedup in well optimized cryptographic functions are hard to come by. In libsecp256k1 we'll usually celebrate a 4% algorithmic speedup. Figures on the order of 2x are reasonable for the usage in ...
G. Maxwell's user avatar
  • 7,727
6 votes
Accepted

What are some interesting applications of Taproot "smart contracts"?

I think it's important to note first that BIP341-BIP342 are improvements to the Bitcoin script "framework" more than they are improvements to the smart contracting "functionality". ...
Pieter Wuille's user avatar
6 votes
Accepted

What are "leaf versions" in Taproot?

SegWit introduced versioned witness programs. When satisfying a script to spend coins you need to provide a redeem script consisting of a version byte and a witness program. The version introduced ...
Michael Folkson's user avatar
6 votes
Accepted

Why Schnorr was added to secp256k1 library instead of a separate library?

Yes, the BIP340 signature scheme that was added to libsecp256k1 is an Elliptic Curve based variant of Schnorr signatures. Traditionally Schnorr signatures use a group of integer multiplication modulo ...
Pieter Wuille's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible