Bitcoin launched with ECDSA. Schnorr's cleaner scheme had spent so long under patent that in 2009 it had no standard and no library support. The 2021 Taproot upgrade finally brought it home (BIP-340). Same curve, same keys, but the equation is linear, so signatures and keys can add; and every output hides behind one tweaked key, so a plain payment, a multisig vault and a secret script tree all look identical on-chain: bc1p…
No modular inverse anywhere: e is a tagged hash of R.x ‖ P.x ‖ m, and the nonce is derived deterministically from the key and message, so the PS3 nonce-reuse bug (demo 3) is gone by construction.
Because signing is linear, two cosigners can sum their keys and produce one ordinary signature for the sum. The verifier (and the blockchain) sees a single key, a single 64-byte signature.
This is the door to MuSig2: an n-of-n vault that costs and looks exactly like a single-sig payment, against the ~250-byte witness a 2-of-3 script spend like demo 9's carries. (Real MuSig adds hashing so a cosigner can't craft a malicious "rogue" key; the algebra shown here is the heart of it.)
An x-only pubkey: 32 bytes, no 02/03 prefix. Of the two curve points with this x, the even-Y one is implied.
The tweak can also commit to a whole tree of scripts, but a key-path spend never reveals whether one exists. Your wallet's bc1p… addresses are built exactly like this (BIP-86).
ECDSA's k⁻¹ was a patent workaround with a folklore security argument. Schnorr's linear s = k + e·d has a clean proof, and it's why signatures can be batch-verified and aggregated.
Single sig, 2-of-2 MuSig vault or a key hiding a script tree: every key-path spend is the same 34-byte output and one 64-byte signature. Privacy for the vault, cheaper fees for everyone.
Edit one character after signing and verification fails, exactly as with ECDSA. The challenge e binds the signature to the message and to both points. Different scheme, same guarantee.