BIP 340
Schnorr Signatures for secp256k1
Original title: Schnorr Signatures for secp256k1
- Status
- Deployed
- Type / Layer
- Specification
- Author
- Pieter Wuille, Jonas Nick, Tim Ruffing
- Assigned
- Status verified
- Source
- github.com/bitcoin/bips/blob/master/bip-0340.mediawiki
Summary
Specifies a standard for 64-byte Schnorr signatures over the secp256k1 curve. Bitcoin has traditionally used ECDSA over the same curve, and the BIP lists the advantages of Schnorr instead. First, provable security: Schnorr signatures are strongly unforgeable under chosen message attack in the random oracle model assuming the hardness of the elliptic curve discrete logarithm problem, whereas the best known results for ECDSA rely on stronger assumptions. Second, linearity: keys and signatures can be added together mathematically, which is the foundation for multisignature and signature aggregation schemes. Third, the signatures are a fixed 64 bytes, with none of the variable-length DER encoding or malleability surface of ECDSA. The BIP also specifies x-only public keys, deterministic nonce derivation from the secret key and message (removing a class of catastrophic RNG failures), and tagged hashes for domain separation.
Why it matters
Linearity opens the path to collapsing multiple signers into a single 64-byte signature, improving verification cost, fees, and privacy at once. It activated in November 2021 as a set with BIP341 (Taproot) and BIP342 (Tapscript), and subsequent multisignature and aggregation designs build on it.
Related BIPs
Related articles
This page carries a summary, not a translation. The original document is authoritative, and the metadata above — including Status — was transcribed from the bips repository on the verification date shown. Always consult the original when implementing or verifying.