# Examples of applications that use the Schnorr digital signature?

I have made a study on digital signatures, especially on the Schnorr digital signature, and I was just wondering if there is some way I can find names of actual (known) applications that have applied and used this kind of digital signature.

Haven't been able to find anything by myself, so any help is appreciated. I also posted the question on MathOverflow and I was advised to ask here.

Thanks, and best regards !

-
I don't know anybody who uses it yet, but some are planning to use Ed25519, which is based on Schnorr. –  CodesInChaos Jan 9 '13 at 13:53
Do you, by any chance, know a name or two of those ”some” you are talking about? –  Raul Rene Jan 9 '13 at 16:02
Tahoe-LAFS, Cryptosphere and me plan to use Ed25519. Bitcoin discussed it, but they probably won't. –  CodesInChaos Jan 9 '13 at 16:55
Thank you very much, sir. You can put your last comment down as an answer if you like. –  Raul Rene Jan 9 '13 at 19:12

Despite their theoretical security advantages, Schnorr signatures aren't very popular. Probably because they were patented. Since the patents expired in 2008 they might rise a bit in popularity. But probably only in the elliptic curve form, and not in finite fields.

I don't know of any application actually using Schnorr signatures, but I know several that plan to or at least considered it. Either in the form of EC-Schnorr or Ed25519.
Both of these are essentially Schnorr signatures, but on elliptic curves. Ed25519 adds a few modifications, such as making signing deterministic and a message hash that hashes R before the message, but it's still very similar to Schnorr.

-

Yes, there are some examples of Schnorr signature in real world applications, although I can not provide you the names of the products. (Edit: OpenSSH contains a reference implementation in schnorr.c).

The good feature of Schnorr signature is that by design it does not require lot of computations on the signer side. Therefore, you can use it even on a computationally weak platform (think of a smart card or RFID), or on a platform with no hardware support for multiple precision arithmetic.

Although Schnorr signature scheme does not provide too much speedup over other signature schemes like DSA, it requires only one multiple precision arithmetic operation with non-trivial implementation, which is modular exponentiation. That makes it probably the simplest method to implement without hardware support on the side of the signer.

-
Is signing with (EC)Schnorr faster than signing with (EC)DSA? Do those applications you mentioned use elliptic curves or finite fields? –  CodesInChaos Jan 10 '13 at 20:24
Regarding the speed of computation, Schnorr does not have much advantage over DSA even when implemented using finite fields. But DSA requires a couple more multiple precision operations and therefore is more difficult to implement without proper hw support. That was missing in my comment. –  Ilya Volkovets Jan 11 '13 at 15:59