BA-02 · LESSON 06

Schnorr and BIP340

KEY DEFINITIONS

Terms used in this lesson

Schnorr signature: Bitcoin’s Taproot signature scheme, whose algebra supports compact verification and advanced multi-party signing.
BIP340: The Bitcoin Improvement Proposal specifying Schnorr signatures for the secp256k1 curve.
Taproot: A Bitcoin output and spending design that can combine a public-key path with privately committed alternative scripts.
Witness: Signatures, scripts, or other data supplied to satisfy a Bitcoin output’s spending condition.
MuSig: A multi-party Schnorr-signing protocol that combines several public keys into one aggregate key.
FROST: Flexible Round-Optimized Schnorr Threshold signing: a protocol in which a required subset produces one group signature.
BIP0340 challenge tag: The domain-separation label used by BIP340 when hashing the Schnorr signature challenge.

Schnorr signatures use simpler algebra than Bitcoin's earlier signature system. Bitcoin Improvement Proposal 340 defines the exact Schnorr format used by Taproot.

45 min Difficulty 1/5 Not started

VISUAL MODEL

See the whole mechanism before going step by step

Use the diagrams to orient yourself. Then the guided explanation below teaches every part in depth.

4 explanatory views

CONCEPT-SPECIFIC MAP · schnorr signatureA BIP340 Schnorr signature proves one linear relationSelect any state to inspect its exact role.

RELATIONSHIP MAPOrdered mechanism flow

01
MESSAGEm1
BIP340 hashes exactly 32 message bytes together with r and the x-only public key.
02
NONCE POINTR = kG, even y
Tagged hashing and parity normalization make signing deterministic and unambiguous.
03
CHALLENGEe1 = H(r || P || m1)
Changing the message changes the scalar challenge.
04
SIGNATURER || s, 64 bytes
The signer computes s = k + ed modulo the curve order.
05
VERIFYsG = R + e1P
Linearity enables safe aggregation protocols when their own nonce and key rules are followed.

Rule shown: Verification reconstructs R = sG minus eP and requires an even-y point whose x coordinate equals r.

STAGE 1 OF 5MESSAGE: m1

BIP340 hashes exactly 32 message bytes together with r and the x-only public key.

Governing relationship: Verification reconstructs R = sG minus eP and requires an even-y point whose x coordinate equals r. Complete path: 1. MESSAGE, m1. BIP340 hashes exactly 32 message bytes together with r and the x-only public key. 2. NONCE POINT, R = kG, even y. Tagged hashing and parity normalization make signing deterministic and unambiguous. 3. CHALLENGE, e1 = H(r || P || m1). Changing the message changes the scalar challenge. 4. SIGNATURE, R || s, 64 bytes. The signer computes s = k + ed modulo the curve order. 5. VERIFY, sG = R + e1P. Linearity enables safe aggregation protocols when their own nonce and key rules are followed.

1. State transitionWhat exists, what changes, and what results

BEFORE

A wallet computes the transaction’s Taproot signature hash and signs it with the tweaked private key.

MECHANISM

The signer chooses a fresh secret nonce and publishes the corresponding curve point. Reusing or leaking the nonce can expose the private key.

AFTER

The signature authorizes this transaction under the committed output key; it does not reveal alternate script paths.

Text equivalent: Starting from A wallet computes the transaction’s Taproot signature hash and signs it with the tweaked private key. The mechanism begins when The signer chooses a fresh secret nonce and publishes the corresponding curve point. Reusing or leaking the nonce can expose the private key. The resulting lesson is The signature authorizes this transaction under the committed output key; it does not reveal alternate script paths.

2. Mechanism pathSelect a stage to inspect its job

STAGE 1 OF 4

Commit with a nonce point

The signer chooses a fresh secret nonce and publishes the corresponding curve point. Reusing or leaking the nonce can expose the private key.

Complete path: 1. Commit with a nonce point: The signer chooses a fresh secret nonce and publishes the corresponding curve point. Reusing or leaking the nonce can expose the private key. 2. Bind key, message, and nonce: A tagged hash produces a challenge from the nonce point, public key, and message. Changing any of them changes the challenge. 3. Create the response scalar: The signer combines the nonce with the private key multiplied by the challenge. The verifier checks the matching elliptic-curve equation. 4. Use linearity carefully: Schnorr’s linear structure enables multisignature and threshold schemes such as MuSig and FROST, provided their multi-party nonce and key rules are followed.

3. Rule and failure boundaryWhat accepts the result and where it can stop

ACCEPTED PATH

The x-only/even-y rules, BIP0340 challenge tag, exact transaction digest, scalar ranges, and public verification equation must all pass.

CHANGED CONDITION

Changing any signed transaction field changes the challenge and invalidates the signature; reusing the nonce across messages can expose the private key. The in-app order-19 trace is explicitly bounded and intentionally insecure, not a Bitcoin signature.

Important distinction: Schnorr automatically turns several independent signers into a secure group signer. Linearity makes aggregation possible, but secure protocols still need key aggregation, nonce commitments, participant binding, and malicious-signer defenses.

Text equivalent: The accepted path is enforced by The x-only/even-y rules, BIP0340 challenge tag, exact transaction digest, scalar ranges, and public verification equation must all pass. If the required condition changes, Changing any signed transaction field changes the challenge and invalidates the signature; reusing the nonce across messages can expose the private key. The in-app order-19 trace is explicitly bounded and intentionally insecure, not a Bitcoin signature.

Loading lesson visuals...

Learn the idea

A Schnorr signature proves that the signer knows the private key corresponding to a public key and has authorized a specific message. BIP340 is Bitcoin's exact Schnorr encoding and verification specification. Taproot is Bitcoin's version-1 witness output design, whose key path can be authorized by one BIP340 signature. A tagged hash includes a protocol context in the hashed bytes. MuSig is a family of Schnorr multisignature protocols, while FROST means Flexible Round-Optimized Schnorr Threshold signatures; neither is automatic key addition.

GUIDED EXPLANATION1/4 ideas inspected

Commit with a nonce point

The signer chooses a fresh secret nonce and publishes the corresponding curve point. Reusing or leaking the nonce can expose the private key.

The worked example follows the explanation

Inspect every idea above to open it.

Important distinction“Schnorr automatically turns several independent signers into a secure group signer.”

Linearity makes aggregation possible, but secure protocols still need key aggregation, nonce commitments, participant binding, and malicious-signer defenses.

FINISH LEARNING FIRST

The questions unlock after every required learning activity

Inspect every guided idea, open the worked example, rebuild its mechanism, and complete the deterministic lesson tool. Your progress is saved automatically.