<blockquote>
  <p>Why was ECDSA chosen over Schnorr Signatures in the inital design?</p>
</blockquote>

<p>You'll need to ask Satoshi to know for sure, but my guess is simply because ECDSA was well standardized at the time, while no Elliptic Curve Schnorr based schemes were.</p>

<p>One of the reasons why an ECDSA standard existed but no EC-Schnorr ones may be patents. DSA was designed as a variant of Schnorr specifically to avoid Schnorr's patent on his signature scheme. By the time Bitcoin was created that patent had expired, but it was already too late - it was already much more appealing to use a well-known standardized scheme over designing your own cryptography (which would have been necessary to design a Schnorr based scheme).</p>

CC BY-SA 3.0
2018-03-27T03:06:26.643Z
2018-03-27T03:06:26.643Z
Pieter Wuille
<p>Schnorr Signatures and Signature aggregation is in the bitcoin technology roadmap. Schnorr Signatures was around the same time ECDSA is around. </p>

<p>Why wasnt Schnorr Signature Scheme implemented at the get-go instead? Why was ECDSA chosen over Schnorr Signatures in the inital design?</p>

<ecdsa><schnorr-signatures>
Why was ECDSA chosen over Schnorr Signatures in the inital design?
Nathan Aw
# Why was ECDSA chosen over Schnorr Signatures in the inital design?

(Asked by: username_0 on 2018-03-27)

Schnorr Signatures and Signature aggregation is in the bitcoin technology roadmap. Schnorr Signatures was around the same time ECDSA is around.

Why wasnt Schnorr Signature Scheme implemented at the get-go instead? Why was ECDSA chosen over Schnorr Signatures in the inital design?

**Tags:** ecdsa, schnorr-signatures


---

## 1 answers

### Answer by username_1 on 2018-03-27. Score: 13 | Accepted answer

> Why was ECDSA chosen over Schnorr Signatures in the inital design?

You'll need to ask Satoshi to know for sure, but my guess is simply because ECDSA was well standardized at the time, while no Elliptic Curve Schnorr based schemes were.

One of the reasons why an ECDSA standard existed but no EC-Schnorr ones may be patents. DSA was designed as a variant of Schnorr specifically to avoid Schnorr's patent on his signature scheme. By the time Bitcoin was created that patent had expired, but it was already too late - it was already much more appealing to use a well-known standardized scheme over designing your own cryptography (which would have been necessary to design a Schnorr based scheme).


---

