BIP 340 — Schnorr Signatures for secp256k1

BIP 340 (Schnorr Signatures for secp256k1) specifies the Schnorr signature scheme used by Taproot: 64-byte signatures, x-only 32-byte public keys, provable security under standard assumptions, batch verifiability, and linearity that enables protocols like MuSig2 key aggregation. Repository status: Deployed.

Debate relevance: The technical basis for most 'Taproot makes multisig private/cheaper' claims; also cited in cryptography-history tangents (patent expiry, why ECDSA was chosen originally). Common misstatements: "Schnorr replaced ECDSA" — ECDSA remains valid for pre-Taproot output types; Schnorr applies to SegWit v1. "Schnorr signatures shrink every transaction" — benefits accrue to Taproot spends, especially multiparty ones, not to legacy transactions.