Schnorr Signatures

In 1989, Claus-Peter Schnorr patented a signature scheme so clean it made everyone else's look cluttered. Where RSA needs large moduli and ECDSA juggles inverses that leak side-channels, Schnorr does three things: pick a random number, hash it together with the message, and add a small correction. That simplicity is not an accident — it is a design principle, and it has a consequence that turns out to matter enormously.

The consequence is linearity: Schnorr signatures can be added together. If two people each produce a Schnorr signature over the same message, the two signatures and the two public keys each sum to produce a single combined signature and a single combined key — indistinguishable from a signature by a single signer.

That one arithmetic fact is behind MuSig, behind Bitcoin Taproot, and behind most of modern threshold cryptography. The discrete logarithm problem is what makes breaking the scheme hard; linearity is what makes building with it elegant.

Each participant holds a secret key $x_i$ and a public key $X_i = x_i \cdot G$. To sign, each picks a random nonce $r_i$, publishes the commitment $R_i = r_i \cdot G$, and then — once everyone's commitments are known — computes a partial response $s_i = r_i + e \cdot x_i$ where $e$ is a shared challenge hash.

<p class="hint">{{hint}}</p>
<div class="controls">
  <button id="add-signer" type="button">{{btn_add}}</button>
  <button id="verify" type="button">{{btn_verify}}</button>
  <button id="reset" type="button" class="ghost">{{btn_reset}}</button>
</div>
<div class="panel">
  <div class="col" id="signers-col">
    <div class="col-title">{{col_signers}}</div>
    <div id="signers-list"><em class="empty">{{empty}}</em></div>
  </div>
  <div class="col agg-col">
    <div class="col-title">{{col_agg}}</div>
    <div id="agg-block">
      <div class="agg-row"><span class="lbl">{{lbl_agg_X}}</span><span class="val" id="agg-X">—</span></div>
      <div class="agg-row"><span class="lbl">{{lbl_agg_R}}</span><span class="val" id="agg-R">—</span></div>
      <div class="agg-row"><span class="lbl">{{lbl_agg_s}}</span><span class="val" id="agg-s">—</span></div>
      <div class="agg-row"><span class="lbl">{{lbl_e}}</span><span class="val" id="agg-e">—</span></div>
    </div>
    <div class="status" id="status">{{status_initial}}</div>
  </div>
</div>

* { box-sizing: border-box; }
body { font-family: system-ui, sans-serif; color: #222; margin: 0; font-size: 14px; }
.hint { font-size: .88rem; color: #444; margin: 0 0 .7rem; line-height: 1.5; }
.controls { display: flex; gap: .5rem; flex-wrap: wrap; margin-bottom: .8rem; }
button { font: 600 13px system-ui; padding: .4rem .85rem; border: 1px solid #1d3557;
         background: #1d3557; color: #fff; border-radius: 8px; cursor: pointer; }
button.ghost { background: #fff; color: #1d3557; }
button:disabled { opacity: .45; cursor: default; }
.panel { display: flex; gap: .8rem; flex-wrap: wrap; }
.col { flex: 1 1 200px; background: #f4f7fa; border-radius: 10px; padding: .7rem .9rem; }
.agg-col { flex: 1 1 220px; }
.col-title { font-weight: 700; font-size: .82rem; text-transform: uppercase; letter-spacing: .04em;
             color: #1d3557; margin-bottom: .5rem; border-bottom: 1px solid #d0dae5; padding-bottom: .3rem; }
.signer-card { background: #fff; border: 1px solid #cdd9e3; border-radius: 8px; padding: .5rem .7rem;
               margin-bottom: .5rem; font-size: .82rem; }
.signer-card .sname { font-weight: 700; color: #1d3557; margin-bottom: .25rem; }
.signer-card .row { display: flex; justify-content: space-between; gap: .5rem; }
.signer-card .lk { color: #555; }
.signer-card .vk { font-family: ui-monospace, monospace; color: #222; }
.agg-row { display: flex; flex-direction: column; margin-bottom: .45rem; }
.lbl { font-size: .78rem; color: #555; font-weight: 600; }
.val { font-family: ui-monospace, monospace; font-size: .9rem; color: #222; word-break: break-all; }
.status { margin-top: .7rem; font-weight: 700; font-size: .9rem; min-height: 1.3em; }
.status.ok { color: #0a7d33; }
.status.bad { color: #c92f3c; }
.empty { color: #888; font-style: italic; font-size: .85rem; }

// Code not found

Notice what happens as you add signers: the aggregate public key $X = \sum X_i$ and the aggregate signature $(R, s)$ with $R = \sum R_i$ and $s = \sum s_i$ satisfy the same verification equation as a single signer. The verifier sees one key and one signature — they cannot tell how many people were involved. This is the core trick behind MuSig and Bitcoin Taproot's key-path spends.

What makes a signature scheme secure, and how hard is it to break Schnorr?

• The hard problem. Security rests on the discrete logarithm problem: given $X = x \cdot G$ on an elliptic curve, find $x$. No polynomial-time classical algorithm is known; the best attacks (baby-step giant-step, index calculus) run in roughly $\sqrt{p}$ operations — exponential in the key size. This remains an open problem as of 2025: no proof exists that discrete log is hard, but no efficient algorithm has been found either.
• Provable security. Schnorr achieves what ECDSA does not: a tight proof in the random-oracle model. Bellare and Neven (2006) formalized it — any forger can be rewound to extract the discrete log via the forking lemma. ECDSA has no comparable reduction.
• Patent delay. Schnorr's 1989 patent (expired 2008) kept the scheme out of standards for nearly two decades, forcing DSA and ECDSA into widespread deployment despite their weaker theoretical footing.
• MuSig subtlety. Naive key aggregation is vulnerable to a rogue-key attack: a malicious signer announces $X_2 = X_2' - X_1$ to cancel honest participants. MuSig (Maxwell et al., 2018) defeats this with a commitment round or key-prefixed challenges — a two-round protocol with a full security proof.
• Quantum threat. Like all discrete-log schemes, Schnorr falls to Shor's algorithm on a sufficiently large quantum computer. Migration to lattice-based or hash-based schemes is an active research area.

The punchline: Schnorr is the cleanest signature scheme with a tight security reduction, but the underlying hardness assumption is still unproven — just like P vs NP, we trust the problem is hard because decades of effort have failed to crack it.

Schnorr's linearity unlocks a family of constructions impossible or clumsy with ECDSA:

• Bitcoin Taproot (BIP 340, activated 2021): Bitcoin replaced ECDSA with Schnorr for its Taproot upgrade. Key-path spends look like ordinary single-key transactions even when they encode complex multisig or smart-contract conditions — shrinking fees and improving privacy.
• MuSig and threshold wallets: Exchanges and custody providers use MuSig to require $n$-of-$n$ or $t$-of-$n$ signers without revealing the threshold on-chain. Each signing ceremony produces one normal-looking signature.
• Adaptor signatures: A Schnorr variant where the signature encodes a hidden secret; revealing the signature leaks the secret, enabling atomic cross-chain swaps and payment channels without on-chain scripts.
• Blind signatures: Schnorr supports blinding, letting a signer sign a message without seeing it — the basis of privacy-preserving credentials (e-cash, anonymous tokens).
• EdDSA: The widely deployed Ed25519 scheme (used in SSH, TLS 1.3, Signal, Tor) is a deterministic Schnorr variant over the Edwards25519 curve, eliminating nonce-reuse vulnerabilities entirely.

Understand Schnorr and you hold the key to most of modern threshold cryptography — and to why the same signature can represent one person or a hundred, on-chain or off.

Schnorr signatures are a rare thing in cryptography: a scheme whose elegance is load-bearing. The linearity that makes the math clean is the same property that lets you aggregate signers, build atomic swaps, and shrink multi-party contracts to a single on-chain byte.

The hard core — the discrete logarithm problem — remains unproven to be hard. We believe it is because decades of the world's best mathematicians have tried and failed to crack it. That faith is the same kind of faith that sits behind P vs NP: not a theorem, but the best evidence we have. And on that foundation, Schnorr has built some of the most elegant cryptography in use today.