After this lesson you can: explain what Schnorr changed.
A digital signature proves that the holder of a private key approved a specific message, here the transaction (or the parts of it the signature commits to), without revealing the key. Anyone with the public key can verify it.
ECDSA, in outline
To sign, pick a fresh random number, multiply G by it and take the x-coordinate (that is r); then combine r, the private key, and the message hash into s. The signature is (r, s). Verification recombines the public key, r, s and the hash and checks that the x-coordinate matches r. Two warnings from history: reusing the random number across two signatures leaks the private key (it happened to Sony and to several wallets), and ECDSA signatures could be re-encoded without invalidating them, which caused transaction malleability until SegWit moved signatures out of the txid.
Sighash flags
A signature commits to parts of the transaction chosen by a flag. SIGHASH_ALL (the default) commits to all inputs and outputs. Others (SINGLE, NONE, ANYONECANPAY) allow partially open transactions used in some protocols.
Schnorr
Added in 2021 with Taproot (BIP 340). Same curve, simpler math: the signature is a point and a scalar, 64 bytes. The key property is linearity: signatures from several keys can be added into one that verifies against the sum of the keys. That gives:
- MuSig: a multisig that appears on-chain as a single key and a single signature. Smaller, cheaper, private.
- Batch verification: nodes can verify many signatures at once, faster.
- Adaptor signatures: signatures deliberately missing a secret, used in advanced Lightning and swap protocols.
What you need to know as a user
Nothing changes in practice: your wallet signs. But Taproot wallets get smaller transactions, and multisig users get privacy they did not have before.
A Schnorr signature is 64 bytes. A DER-encoded ECDSA signature is typically how many bytes, give or take one?