Schnorr → Signatures

A signature scheme is a sigma protocol with the message bound into the challenge:

Prover (signer, knows x; pubkey y = g^x)
  k ← random
  r = g^k
  c = hash(r || message || y)     # binds m
  z = k + c*x mod n

  Signature = (r, z) — or compactly (c, z).

Verifier:

c = hash(r || message || y)
g^z == r * y^c

This is essentially Schnorr signature. Properties:

• Short (~64 bytes).
• Linear: signatures aggregate (multi-signatures).
• Provably secure under DLP + ROM.

Compare to ECDSA:

• ECDSA: r = (kG).x, s = k^(-1)(hash + r*x). More complex algebra; nonce reuse fatal; doesn't aggregate.
• Schnorr: cleaner, more aggregable, deterministic via RFC 6979-style derivation.

MuSig (multi-signature):

• N signers each have x_i, y_i.
• Aggregate pubkey Y = ∏ y_i^a_i (where a_i = hash of all pubkeys).
• Joint signature on message: each signer contributes; result is a single Schnorr signature on Y.
• Verifier sees: regular Schnorr signature on Y. Cannot tell it was joint.

This unlocks privacy + scalability for multisig wallets.

Schnorr in Bitcoin (BIP 340, 2021): Taproot upgrade. Schnorr signatures replace ECDSA as the recommended signature scheme. Aggregation reduces multisig overhead massively.

Ed25519: a Schnorr-like signature on Edwards curve 25519. Deterministic by spec, faster than ECDSA, no nonce concerns. Default for SSH (RSA replaced), Signal, libsodium.