public final class Schnorr

BIP-340 Schnorr signatures over secp256k1: the signatures of Bitcoin’s Taproot (key-path spends, P2TR) and of Nostr events.

Keys are the 32-byte x coordinate alone (“x-only”); the point with the even y is meant. A private key is the same 32 bytes as for Secp256k1.

byte[] privateKey = SecureRandom.bytes(32);
byte[] messageHash = Hash.sha256("hello".getBytes());
byte[] pub = Schnorr.publicKey(privateKey);
byte[] sig = Schnorr.sign(messageHash, privateKey, SecureRandom.bytes(32));
boolean ok = Schnorr.verify(messageHash, sig, pub);

Signing is deterministic given the auxiliary randomness; passing fresh random bytes there, as BIP-340 recommends, protects against fault and side-channel attacks that a purely deterministic nonce does not.

[#sign(byte[], byte[], byte[])] derives the public key on every call, which BIP-340 signing needs, and that is half the work of a signature. A KeyPair derives it once:

byte[] privateKey = SecureRandom.bytes(32);
Schnorr.KeyPair keys = new Schnorr.KeyPair(privateKey);
byte[] first = keys.sign(Hash.sha256("first".getBytes()), SecureRandom.bytes(32));
byte[] second = keys.sign(Hash.sha256("second".getBytes()), SecureRandom.bytes(32));
keys.destroy();