BIP 340 (Schnorr Signatures)

BIP 340 is the specification that brought Schnorr signatures to bitcoin, activated with the Taproot upgrade in November 2021. It defines a 64-byte signature scheme over the secp256k1 curve that replaces ECDSA for Taproot spends, with cleaner mathematics, provable security, and properties ECDSA lacks.

Why it matters

Schnorr's killer feature is linearity: signatures and keys can be added together. Multiple signers can combine their keys into one aggregate key whose single signature satisfies the network, so a 3-of-3 multisig spend becomes indistinguishable on-chain from an ordinary payment. That collapses fees for complex custody and improves privacy for everyone, since observers can no longer separate corporate treasuries from coffee purchases. Linearity also enables adaptor signatures and cleaner protocols for Lightning and atomic swaps. The scheme, published by Claus Schnorr in 1989, predates ECDSA, which bitcoin originally used partly because Schnorr's design was under patent until 2008.

How it works

A BIP 340 signature commits to a nonce, the message, and the public key through a tagged SHA-256 hash, producing a fixed 64-byte result that verifies through a single elliptic curve equation. Keys are encoded as 32-byte x-only coordinates, saving space and removing ambiguity. Because verification is a linear equation, signatures can be batch-verified, letting nodes check many at once faster than one by one. Protocols like MuSig2 build on this to let mutually distrusting parties construct one aggregate signature interactively, the cryptographic machinery behind the next generation of bitcoin custody and second-layer designs.