A precisely specified signature scheme
Schnorr signatures are a family of cryptographic constructions, and BIP-340 defines the exact version used in Bitcoin. It specifies encoding, signing, verification, and related requirements over the secp256k1 curve. These details matter: two systems can both advertise Schnorr signatures without producing interchangeable signatures. BIP-341 connects the scheme to Taproot's transaction-output spending rules, so the signature specification and the rules governing what it authorizes are separate but related layers.
2 sources for this section
Why aggregation attracts attention
Schnorr's algebraic structure supports carefully designed protocols in which several participants cooperate to produce an aggregate signature. This can make a cooperative spend look simpler on-chain than revealing every participant's individual authorization. It does not mean users can safely add arbitrary signatures together or invent their own multisignature protocol. Secure participant setup, nonce handling, and resistance to malicious collaborators require additional protocol design beyond the base signature equation.
2 sources for this section
Boundaries of the privacy improvement
Taproot can reduce the information exposed when a transaction follows its cooperative key path, but it does not automatically hide amounts, recipients, or the entire transaction graph. Script-path spending can reveal different information. Signature size and verification properties are engineering features, not assurances that a wallet is anonymous or immune to key theft. When reading a wallet's feature list, distinguish BIP-340 support, Taproot address support, and support for a specific collaborative signing scheme.
2 sources for this section
The source notesEvidence & further reading2 sources
- BIP-340: Schnorr signatures for secp256k1 Bitcoin BIPs contributors · Primary source · accessed 2026-09-21
- BIP-341: Taproot spending rules Bitcoin BIPs contributors · Primary source · accessed 2026-09-21