What are Schnorr signatures and how are they used in Bitcoin?

What are Schnorr signatures?

Schnorr signatures are a digital signature scheme proposed in 1991 by German cryptographer Klaus Peter Schnorr.

In 2020, it is included in BIP-340 as an alternative to Elliptic Curves Digital Signature Algorithm (ECDSA). The proposal was implemented on the bitcoin network in November 2021.

https://forklog.com/cryptorium/chto-takoe-predlozhenie-ob-obnovlenii-bitkoina-bip

What is a digital signature?

A digital signature is a mathematical scheme for verifying two key characteristics of a digital message: authenticity (sent by a specific user) and integrity (not changed during transmission).

With the help of digital signatures, the bitcoin protocol confirms the binding of the private key to a specific public address. Satoshi Nakamoto emphasized their importance in the white paper of the first cryptocurrency:

"Let's define an electronic coin as a sequence of digital signatures. The next owner sends the coin to the next one, signing the hash of the previous transaction and the public key of the future owner and attaching this information to the coin. The recipient can verify each signature to confirm the correctness of the entire chain of ownership."https://forklog.com/cryptorium/kakie-formaty-byvayut-u-bitkoin-adresov

What digital signatures are used in Bitcoin?

Initially, the first cryptocurrency used only ECDSA, an open source algorithm that was widely used in 2008. Satoshi Nakamoto's choice is due to the fact that by the time the bitcoin white paper was published, Schnorr's signatures had not been standardized.

In 2014, the Bitcointalk forum talked about the need to implement Schnorr signatures into the bitcoin protocol, and six years later Peter Velle, Jonas Nick and Tim Ruffing standardized them in BIP-340.

The implementation of Schnorr signatures took place on November 14, 2021, as part of the Taproot update at the height of block #709,632. Since then, they have been used alongside ECDSA.

https://forklog.com/cryptorium/chto-takoe-ecdsa-v-bitkoine

What are the advantages of Schnorr signatures over ECDSA?

The authors of BIP-340 identify three main advantages of Schnorr signatures:

Provable security. Schnorr signatures cannot be forged in a selected message attack (SUF-CMA) using a random oracle model with a fairly complex ECDLP. ECDSA security is based on stronger assumptions. Inflexibility. Schnorr's signatures are provably inflexible. The flexibility of ECDSA means that an attacker can create a valid signature for the public key and message without having access to the private key. Linearity. With Schnorr signatures, several interacting parties can create a valid signature for the sum of their public keys.

The latter advantage allows you to implement a simpler multisig scheme like Musig2 by aggregating signatures.

Differences between ECDSA and Schnorr scheme. Data: ForkLog.

"When using Schnorr's signature, a multisig transaction looks like a single-signature transaction, which increases the confidentiality of senders and complicates the life of on-chain analysts. The latter cannot immediately link transactions to one person or a group of people," representatives of the bitcoin mixer Mixer.Money comment.

They note that Schnorr's signatures are not enough to ensure anonymity:

"Weak privacy remains a bitcoin problem. The community perceived Taproot as an update to improve privacy, but the only change was the inability to identify multi-signatures using blockchain analytics. The Schnorr scheme will not hide the sender and recipient of the coins. To do this, you still need to use bitcoin mixers or CoinJoin solutions."

In 2024, the developers of the latter faced unprecedented pressure from regulators. According to Mixer.Money, it can lead to a decrease in the number of users and negatively affect the technology.

https://forklog.com/news/mnenie-coinjoin-zhdet-spiral-smerti

Representatives of the service recommend paying attention to solutions that can hide the very fact of mixing coins. For example, in the "Complete anonymity" mode, Mixer.Money sends the user "clean" coins from major exchanges to eliminate the possibility of receiving their own assets or bitcoins of dubious origin.