May 2019: Schnorr signatures and SegWit recovery

What changed

Activation came when the median time past reached Unix time 1557921600 (15 May 2019, 12:00 UTC). The first block under the new rules is height 582,680. From this upgrade on, BCH upgrades activate at 12:00 UTC on the 15th.

Consensus changes:

• Schnorr signatures. OP_CHECKSIG, OP_CHECKSIGVERIFY, OP_CHECKDATASIG and OP_CHECKDATASIGVERIFY now accept Schnorr signatures as well as ECDSA. A 65-byte signature (64 bytes plus a hashtype byte) is read as Schnorr for OP_CHECKSIG; a 64-byte signature is read as Schnorr for OP_CHECKDATASIG. Existing public keys work for both schemes.
• SegWit recovery. BCH never adopted SegWit. Some users sent BCH to SegWit-style P2SH addresses by mistake, and the 2018 clean-stack rule had made those coins unspendable. This upgrade exempts them, so they can be spent again.

Multisig (OP_CHECKMULTISIG) did not get Schnorr yet. It came six months later.

Why

The Schnorr spec lists four gains over ECDSA:

• A known proof of security.
• No unknown third-party malleability.
• Linearity, which allows simple multi-party signature aggregation.
• Batch validation, which can speed up checking large transactions and initial sync.

Schnorr signatures also have a fixed length. ECDSA signatures vary in size (usually 71–72 bytes), which complicates fee estimation and contract design.

SegWit recovery was about fixing user mistakes. Note the catch in the spec: once the redeem script is revealed (for example by spending from the matching BTC address), any miner can take those coins. Recovery helped, but it was not a guarantee that the original owner got them back.

What it enables

• Smaller, fixed-size signatures for wallets that choose Schnorr, with no new address type needed.
• Multi-party signing. Linearity opens the door to aggregated signatures, where several people produce one signature.
• Predictable contract sizes. Covenants that check signatures know the exact byte length ahead of time.