<p>Speedup in well optimized cryptographic functions are hard to come by. In libsecp256k1 we'll usually celebrate a 4% algorithmic speedup. Figures on the order of 2x are reasonable for the usage in Bitcoin, though larger might be possible in the future during initial block download since much larger batches could be used.</p>

<p>A single validation on a single core of a fast desktop grade cpu takes about 50 microseconds. </p>

<p>Another relevant Q/A is <a href="https://bitcoin.stackexchange.com/questions/80698/schnorrs-batch-validation">Schnorr&#39;s batch validation</a></p>

CC BY-SA 4.0
2018-11-23T11:27:40.107Z
Thank you. Definitely not arguing that point, 2 or 2.5X is big news, just wanted to make sure I am not missing anything.
Daniel S
CC BY-SA 4.0
2018-11-23T07:09:02.703Z
2018-11-23T07:17:51.260Z
2018-11-23T07:17:51.260Z
G. Maxwell
<p>In this question <a href="https://bitcoin.stackexchange.com/questions/77234/schnorr-vs-ecdsa">What are the advantages of Schnorr vs ECDSA?</a> I see in the Pieter Wuille's answer the following comment about Schnorr signature batch validation: &quot;Improving verification speed, by supporting batch validation of all signatures in a block at once (for a fraction of the speed of validating them individually).&quot;</p>
<p>However, looking at this <a href="https://github.com/jonasnick/secp256k1/blob/schnorrsig-batch-verify/doc/speedup-batch.md" rel="nofollow noreferrer">chart</a> (initially in BIP 340 but <a href="https://github.com/bitcoin/bips/pull/1122" rel="nofollow noreferrer">since removed</a>) it seems that savings are actually closer to a factor of log(n). In other words, for about 10,000 signatures the time savings are about 2.5X. I know that technically that is a fraction, but it seemed that the implication was that the improvement was more dramatic.
Is there something I am missing? Also, what is the actual time in clock cycles that was a starting point for one Schnorr signature verification?
Thank you.</p>

<validation><secp256k1><schnorr-signatures>
Schnorr batch validation speed statistics
Daniel S
# Schnorr batch validation speed statistics

(Asked by: username_0 on 2018-11-22)

In this question [What are the advantages of Schnorr vs ECDSA?](https://bitcoin.stackexchange.com/questions/77234/schnorr-vs-ecdsa) I see in the Pieter Wuille's answer the following comment about Schnorr signature batch validation: "Improving verification speed, by supporting batch validation of all signatures in a block at once (for a fraction of the speed of validating them individually)."

However, looking at this [chart](https://github.com/jonasnick/secp256k1/blob/schnorrsig-batch-verify/doc/speedup-batch.md) (initially in BIP 340 but [since removed](https://github.com/bitcoin/bips/pull/1122)) it seems that savings are actually closer to a factor of log(n). In other words, for about 10,000 signatures the time savings are about 2.5X. I know that technically that is a fraction, but it seemed that the implication was that the improvement was more dramatic.
Is there something I am missing? Also, what is the actual time in clock cycles that was a starting point for one Schnorr signature verification?
Thank you.

**Tags:** validation, secp256k1, schnorr-signatures


---

## 1 answers

### Answer by username_1 on 2018-11-23. Score: 6

Speedup in well optimized cryptographic functions are hard to come by. In libsecp256k1 we'll usually celebrate a 4% algorithmic speedup. Figures on the order of 2x are reasonable for the usage in Bitcoin, though larger might be possible in the future during initial block download since much larger batches could be used.

A single validation on a single core of a fast desktop grade cpu takes about 50 microseconds.

Another relevant Q/A is [Schnorr's batch validation](https://bitcoin.stackexchange.com/questions/80698/schnorrs-batch-validation)

> **Comments:**
> **username_0**: Thank you. Definitely not arguing that point, 2 or 2.5X is big news, just wanted to make sure I am not missing anything.  

---

