<p>Yes, the BIP340 signature scheme that was added to libsecp256k1 is an Elliptic Curve based variant of Schnorr signatures. Traditionally Schnorr signatures use a group of integer multiplication modulo a large prime, but that's not what is used here. It's integrated into libsecp256k1, because it is a Schnorr scheme over the secp256k1 group, so lots of code is shared between ECDSA and Schnorr.</p>

CC BY-SA 4.0
2021-07-01T07:14:04.400Z
Do all the advantages of Schnorr still hold even if it uses a non-traditional Elliptic Curve implementation?
yerzhan7
CC BY-SA 4.0
2021-07-01T16:07:11.107Z
"Schnorr signatures" isn't a fully specified scheme; it's a general class of digital signature algorithms with many possible variations. All the advantages of the BIP340 scheme over ECDSA obviously apply - the scheme was specifically designed to have those!
Pieter Wuille
CC BY-SA 4.0
2022-08-24T22:33:55.713Z
@PieterWuille whats the advantages of doing that over secp256k1 instead of the regular large prime"?
Ron
CC BY-SA 4.0
2022-08-24T23:02:21.927Z
@Ron You mean using Schnorr over an integer multiplication group? That has all the disadvantages such groups have: you need around 3000-bit keys and signatures for a similar security level, they're much slower, and they need a very different security assuption than the one Bitcoin already relies on (secp256k1's DL hardness).
Pieter Wuille
CC BY-SA 4.0
2021-07-01T06:58:36.607Z
2021-07-01T06:58:36.607Z
Pieter Wuille
<p><a href="https://en.wikipedia.org/wiki/Schnorr_signature" rel="nofollow noreferrer">Schnorr signatures</a> are often compared as superior to the Elliptic Curve ones. Then why developers <a href="https://github.com/bitcoin-core/secp256k1/commit/4e43520026f5bcd182d21f0759bac159ef47bb62" rel="nofollow noreferrer">added</a> Schnorr  into <code>libsecp256k1</code> library which is, as the name suggests, an <em>Elliptic Curve</em> library?</p>
<p>Why not create a separate C library? Or is Schnorr signature part of Elliptic Curve signature group?</p>
<p>Thanks</p>

<taproot><secp256k1><schnorr-signatures>
Why Schnorr was added to secp256k1 library instead of a separate library?
yerzhan7
# Why Schnorr was added to secp256k1 library instead of a separate library?

(Asked by: username_0 on 2021-07-01)

[Schnorr signatures](https://en.wikipedia.org/wiki/Schnorr_signature) are often compared as superior to the Elliptic Curve ones. Then why developers [added](https://github.com/bitcoin-core/secp256k1/commit/4e43520026f5bcd182d21f0759bac159ef47bb62) Schnorr into `libsecp256k1` library which is, as the name suggests, an *Elliptic Curve* library?

Why not create a separate C library? Or is Schnorr signature part of Elliptic Curve signature group?

Thanks

**Tags:** taproot, secp256k1, schnorr-signatures


---

## 1 answers

### Answer by username_1 on 2021-07-01. Score: 7 | Accepted answer

Yes, the BIP340 signature scheme that was added to libsecp256k1 is an Elliptic Curve based variant of Schnorr signatures. Traditionally Schnorr signatures use a group of integer multiplication modulo a large prime, but that's not what is used here. It's integrated into libsecp256k1, because it is a Schnorr scheme over the secp256k1 group, so lots of code is shared between ECDSA and Schnorr.

> **Comments:**
> **username_0**: Do all the advantages of Schnorr still hold even if it uses a non-traditional Elliptic Curve implementation?  
> **username_1**: "Schnorr signatures" isn't a fully specified scheme; it's a general class of digital signature algorithms with many possible variations. All the advantages of the BIP340 scheme over ECDSA obviously apply - the scheme was specifically designed to have those!  
> **username_2**: @PieterWuille whats the advantages of doing that over secp256k1 instead of the regular large prime"?  
> **username_1**: @username_2 You mean using Schnorr over an integer multiplication group? That has all the disadvantages such groups have: you need around 3000-bit keys and signatures for a similar security level, they're much slower, and they need a very different security assuption than the one Bitcoin already relies on (secp256k1's DL hardness).  

---

