Digital signatures: ECDSA, Schnorr and Taproot
How a wallet proves the coins are yours without ever showing the secret.
A digital signature is a piece of math that proves the holder of a private key approved one exact message, without revealing the key. Bitcoin and Ethereum both sign transactions with ECDSA on an elliptic curve called secp256k1. Since the Taproot upgrade activated in November 2021, Bitcoin also supports Schnorr signatures, which are smaller and can combine several signers into one.
How a signature works
- Your wallet builds the transaction and hashes it.
- It combines that hash with your private key and a fresh one-time random number to produce a signature: two numbers, usually called r and s.
- Anyone can check the signature with your public key. If even one character of the transaction changed, the check fails.
The signature is tied to both the key and the exact message, so it can't be copied onto a different transaction. That's what makes it more than a password: a password proves who you are; a signature proves what you approved.
Example: why a tampered payment fails
Ana signs "send 0.01 BTC to Ben's address". An attacker intercepts it and changes the address to their own. The network hashes the altered transaction, checks Ana's signature against it, and the math doesn't match, so every node rejects it. To forge a new valid signature the attacker would need Ana's private key, which never left her wallet.
ECDSA and the secp256k1 curve
ECDSA (Elliptic Curve Digital Signature Algorithm) works on points of an elliptic curve. Bitcoin and Ethereum use the same curve, secp256k1, defined in the SEC 2 standard from the Standards for Efficient Cryptography Group. Your public key is a point found by "multiplying" a fixed starting point by your private key, a 256-bit number. Going forward is easy; going backwards is the elliptic-curve discrete logarithm problem, which no known classical computer can solve for numbers this size.
Ethereum adds a small trick: its signatures include a recovery value (v), so the network can work out the sender's public key, and therefore address, from the signature alone. That's why an Ethereum transaction has no "from" field.
Schnorr signatures and Taproot (2021)
Bitcoin's Taproot upgrade, a soft fork that activated at block 709,632 on November 14, 2021, added Schnorr signatures (BIP 340) and a new output type (BIP 341).
| Compare | ECDSA | Schnorr (BIP 340) |
|---|---|---|
| Size on Bitcoin | About 71–72 bytes (DER-encoded) | Exactly 64 bytes |
| Combining signers | A 3-of-5 multisig shows several keys and signatures | Keys can be aggregated (for example with MuSig2) so a group signs as one |
| Checking many at once | One by one | Batch verification is faster |
| Malleability | A third party could tweak a signature into another valid one (SegWit stopped this from changing transaction IDs) | Not malleable by design |
| Security proof | Widely trusted, weaker formal proof | Simpler, well-studied proof |
Taproot's big practical change is privacy and cost: a shared wallet or a complex spending condition can look on chain exactly like a single person paying, as long as everyone cooperates (the "key path"). Only if they don't is the fallback script revealed (the "script path").
Signatures on Ethereum's consensus layer
Ethereum's validators don't use ECDSA for voting. They sign with BLS signatures on the BLS12-381 curve, because BLS signatures from thousands of validators can be aggregated into one, which lets the network check hundreds of thousands of votes every few minutes. User accounts still use ECDSA on secp256k1.
What signatures can't protect against
- Stolen keys sign perfectly. A signature proves possession of the key, not identity. If malware or a scammer gets your key or seed phrase, their signatures are just as valid as yours.
- Signing the wrong thing. Many crypto thefts happen when people sign a message or "permit" they don't understand, which can authorize a contract to move their tokens. Read what your wallet shows before signing; see crypto scams.
- Bad randomness is fatal. ECDSA needs a fresh secret random number for every signature. Reuse one and the private key can be calculated. In August 2013 a flaw in Android's random number generator caused exactly this, and Bitcoin was stolen from affected Android wallets.
- Quantum computers. A large enough quantum computer running Shor's algorithm could break ECDSA and Schnorr alike. None exists today. Coins whose public key is already visible on chain would be most exposed, and Bitcoin developers have discussed quantum-resistant address proposals, but as of November 2026 none has been activated.
Frequently asked questions
Is a digital signature the same as encryption?
No. Encryption hides data; a signature proves who approved data that may be completely public. Blockchain transactions are signed, not encrypted.
What curve does Bitcoin use?
secp256k1, a curve defined in the SEC 2 standard. Ethereum uses the same curve for user accounts.
When did Taproot activate?
At Bitcoin block 709,632 on November 14, 2021. It was a soft fork, so older nodes kept working.
Do I need to do anything to use Schnorr signatures?
Only use a wallet that supports Taproot addresses, which start with bc1p. Older addresses keep using ECDSA, and both work.
Can someone fake my signature?
Not without your private key. With today's computers, forging an ECDSA or Schnorr signature on secp256k1 is considered infeasible.
Where to next
Sources
- BIP 340: Schnorr signatures for secp256k1
- BIP 341: Taproot
- Taproot topic, Bitcoin Optech (activation at block 709,632)
- SEC 2: Recommended elliptic curve domain parameters
- Transactions, Bitcoin developer guide
- Transactions (ethereum.org)
- Bitcoin wallets upgraded after Android cryptography problem (PCWorld, August 2013)
Written for beginners and checked against the sources listed. Last reviewed November 4, 2026. This page is educational and is not financial, tax or legal advice. How we write and check pages.