Schnorr signatures, specified for Bitcoin in BIP340, became usable with the Taproot upgrade in November 2021. They use the same secp256k1 curve as Bitcoin's older ECDSA signatures.
What is different
- Fixed size: always 64 bytes, compared with about 71–72 bytes for DER-encoded ECDSA.
- x-only public keys: 32 bytes instead of 33.
- Linearity: keys and signatures can be added together. That lets several parties produce one combined key and one signature (MuSig2, BIP327), which looks like a single-signer spend on-chain.
- Batch verification: many signatures can be checked faster together.
- Simpler security proof: BIP340 Schnorr has a security proof under standard assumptions; ECDSA has no comparably clean proof.
Like any signature, it is only safe if the secret nonce is never reused or leaked.