diff --git a/src/secp256k1/CMakeLists.txt b/src/secp256k1/CMakeLists.txt
--- a/src/secp256k1/CMakeLists.txt
+++ b/src/secp256k1/CMakeLists.txt
@@ -96,13 +96,6 @@
 	add_dependencies(bench-secp256k1 ${NAME})
 endfunction(add_secp256k1_bench)
 
-# Recovery module
-option(SECP256K1_ENABLE_MODULE_RECOVERY "Build libsecp256k1's recovery module" ON)
-if(SECP256K1_ENABLE_MODULE_RECOVERY)
-	set(ENABLE_MODULE_RECOVERY 1)
-	add_secp256k1_bench(bench_recover src/bench_recover.c)
-endif()
-
 # ECDH module
 option(SECP256K1_ENABLE_MODULE_ECDH "Build libsecp256k1's ECDH module" OFF)
 if(SECP256K1_ENABLE_MODULE_ECDH)
@@ -117,6 +110,19 @@
 	add_secp256k1_bench(bench_multiset src/bench_multiset.c)
 endif()
 
+# Recovery module
+option(SECP256K1_ENABLE_MODULE_RECOVERY "Build libsecp256k1's recovery module" ON)
+if(SECP256K1_ENABLE_MODULE_RECOVERY)
+	set(ENABLE_MODULE_RECOVERY 1)
+	add_secp256k1_bench(bench_recover src/bench_recover.c)
+endif()
+
+# Schnorr module
+option(SECP256K1_ENABLE_MODULE_SCHNORR "Build libsecp256k1's Schnorr module" ON)
+if(SECP256K1_ENABLE_MODULE_SCHNORR)
+	set(ENABLE_MODULE_SCHNORR 1)
+endif()
+
 # Static precomputation for eliptic curve mutliplication
 option(SECP256K1_ECMULT_STATIC_PRECOMPUTATION "Precompute libsecp256k1's eliptic curve mutliplication tables" ON)
 if(SECP256K1_ECMULT_STATIC_PRECOMPUTATION)
diff --git a/src/secp256k1/Makefile.am b/src/secp256k1/Makefile.am
--- a/src/secp256k1/Makefile.am
+++ b/src/secp256k1/Makefile.am
@@ -179,3 +179,7 @@
 if ENABLE_MODULE_RECOVERY
 include src/modules/recovery/Makefile.am.include
 endif
+
+if ENABLE_MODULE_SCHNORR
+include src/modules/schnorr/Makefile.am.include
+endif
diff --git a/src/secp256k1/configure.ac b/src/secp256k1/configure.ac
--- a/src/secp256k1/configure.ac
+++ b/src/secp256k1/configure.ac
@@ -139,6 +139,11 @@
     [enable_module_recovery=$enableval],
     [enable_module_recovery=no])
 
+AC_ARG_ENABLE(module_schnorr,
+    AS_HELP_STRING([--enable-module-schnorr],[enable Schnorr signatures module (default is yes)]),
+    [enable_module_schnorr=$enableval],
+    [enable_module_schnorr=yes])
+
 AC_ARG_ENABLE(jni,
     AS_HELP_STRING([--enable-jni],[enable libsecp256k1_jni (default is no)]),
     [use_jni=$enableval],
@@ -444,6 +449,10 @@
   AC_DEFINE(ENABLE_MODULE_RECOVERY, 1, [Define this symbol to enable the ECDSA pubkey recovery module])
 fi
 
+if test x"$enable_module_schnorr" = x"yes"; then
+  AC_DEFINE(ENABLE_MODULE_SCHNORR, 1, [Define this symbol to enable the Schnorr signature module])
+fi
+
 AC_C_BIGENDIAN()
 
 if test x"$use_external_asm" = x"yes"; then
@@ -460,6 +469,7 @@
 AC_MSG_NOTICE([Building for coverage analysis: $enable_coverage])
 AC_MSG_NOTICE([Building ECDH module: $enable_module_ecdh])
 AC_MSG_NOTICE([Building ECDSA pubkey recovery module: $enable_module_recovery])
+AC_MSG_NOTICE([Building Schnorr signature module: $enable_module_schnorr])
 AC_MSG_NOTICE([Using jni: $use_jni])
 
 if test x"$enable_experimental" = x"yes"; then
@@ -492,6 +502,7 @@
 AM_CONDITIONAL([ENABLE_MODULE_ECDH], [test x"$enable_module_ecdh" = x"yes"])
 AM_CONDITIONAL([ENABLE_MODULE_MULTISET], [test x"$enable_module_multiset" = x"yes"])
 AM_CONDITIONAL([ENABLE_MODULE_RECOVERY], [test x"$enable_module_recovery" = x"yes"])
+AM_CONDITIONAL([ENABLE_MODULE_SCHNORR], [test x"$enable_module_schnorr" = x"yes"])
 AM_CONDITIONAL([USE_JNI], [test x"$use_jni" == x"yes"])
 AM_CONDITIONAL([USE_EXTERNAL_ASM], [test x"$use_external_asm" = x"yes"])
 AM_CONDITIONAL([USE_ASM_ARM], [test x"$set_asm" = x"arm"])
diff --git a/src/secp256k1/include/secp256k1_schnorr.h b/src/secp256k1/include/secp256k1_schnorr.h
new file mode 100644
--- /dev/null
+++ b/src/secp256k1/include/secp256k1_schnorr.h
@@ -0,0 +1,59 @@
+#ifndef _SECP256K1_SCHNORR_
+# define _SECP256K1_SCHNORR_
+
+# include "secp256k1.h"
+
+# ifdef __cplusplus
+extern "C" {
+# endif
+
+/**
+ * Verify a signature created by secp256k1_schnorr_sign.
+ * Returns: 1: correct signature
+ *          0: incorrect signature
+ * Args:    ctx:       a secp256k1 context object, initialized for verification.
+ * In:      sig64:     the 64-byte signature being verified (cannot be NULL)
+ *          msg32:     the 32-byte message hash being verified (cannot be NULL)
+ *          pubkey:    the public key to verify with (cannot be NULL)
+ */
+SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_schnorr_verify(
+  const secp256k1_context* ctx,
+  const unsigned char *sig64,
+  const unsigned char *msg32,
+  const secp256k1_pubkey *pubkey
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4);
+
+/**
+ * Create a signature using a custom EC-Schnorr-SHA256 construction. It
+ * produces non-malleable 64-byte signatures which support batch validation,
+ * and multiparty signing.
+ * Returns: 1: signature created
+ *          0: the nonce generation function failed, or the private key was
+ *             invalid.
+ * Args:    ctx:    pointer to a context object, initialized for signing
+ *                  (cannot be NULL)
+ * Out:     sig64:  pointer to a 64-byte array where the signature will be
+ *                  placed (cannot be NULL)
+ * In:      msg32:  the 32-byte message hash being signed (cannot be NULL)
+ *          seckey: pointer to a 32-byte secret key (cannot be NULL)
+ *          pubkey: the public key to sign with (cannot be NULL)
+ *          noncefp:pointer to a nonce generation function. If NULL,
+ *                  secp256k1_nonce_function_default is used
+ *          ndata:  pointer to arbitrary data used by the nonce generation
+ *                  function (can be NULL)
+ */
+SECP256K1_API int secp256k1_schnorr_sign(
+  const secp256k1_context *ctx,
+  unsigned char *sig64,
+  const unsigned char *msg32,
+  const unsigned char *seckey,
+  const secp256k1_pubkey *pubkey,
+  secp256k1_nonce_function noncefp,
+  const void *ndata
+) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3) SECP256K1_ARG_NONNULL(4) SECP256K1_ARG_NONNULL(5);
+
+# ifdef __cplusplus
+}
+# endif
+
+#endif
diff --git a/src/secp256k1/src/libsecp256k1-config.h.cmake.in b/src/secp256k1/src/libsecp256k1-config.h.cmake.in
--- a/src/secp256k1/src/libsecp256k1-config.h.cmake.in
+++ b/src/secp256k1/src/libsecp256k1-config.h.cmake.in
@@ -23,8 +23,9 @@
 
 #cmakedefine USE_ECMULT_STATIC_PRECOMPUTATION
 
-#cmakedefine ENABLE_MODULE_RECOVERY
 #cmakedefine ENABLE_MODULE_ECDH
 #cmakedefine ENABLE_MODULE_MULTISET
+#cmakedefine ENABLE_MODULE_RECOVERY
+#cmakedefine ENABLE_MODULE_SCHNORR
 
 #endif /* LIBSECP256K1_CONFIG_H */
diff --git a/src/secp256k1/src/modules/schnorr/Makefile.am.include b/src/secp256k1/src/modules/schnorr/Makefile.am.include
new file mode 100644
--- /dev/null
+++ b/src/secp256k1/src/modules/schnorr/Makefile.am.include
@@ -0,0 +1,5 @@
+include_HEADERS += include/secp256k1_schnorr.h
+noinst_HEADERS += src/modules/schnorr/main_impl.h
+noinst_HEADERS += src/modules/schnorr/schnorr.h
+noinst_HEADERS += src/modules/schnorr/schnorr_impl.h
+noinst_HEADERS += src/modules/schnorr/tests_impl.h
diff --git a/src/secp256k1/src/modules/schnorr/main_impl.h b/src/secp256k1/src/modules/schnorr/main_impl.h
new file mode 100755
--- /dev/null
+++ b/src/secp256k1/src/modules/schnorr/main_impl.h
@@ -0,0 +1,60 @@
+/**********************************************************************
+ * Copyright (c) 2017 Amaury Séchet                                   *
+ * Distributed under the MIT software license, see the accompanying   *
+ * file COPYING or http://www.opensource.org/licenses/mit-license.php.*
+ **********************************************************************/
+
+#ifndef SECP256K1_MODULE_SCHNORR_MAIN
+#define SECP256K1_MODULE_SCHNORR_MAIN
+
+#include "include/secp256k1_schnorr.h"
+#include "modules/schnorr/schnorr_impl.h"
+
+int secp256k1_schnorr_verify(const secp256k1_context* ctx, const unsigned char *sig64, const unsigned char *msg32, const secp256k1_pubkey *pubkey) {
+    secp256k1_ge q;
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(secp256k1_ecmult_context_is_built(&ctx->ecmult_ctx));
+    ARG_CHECK(msg32 != NULL);
+    ARG_CHECK(sig64 != NULL);
+    ARG_CHECK(pubkey != NULL);
+
+    secp256k1_pubkey_load(ctx, &q, pubkey);
+    return secp256k1_schnorr_sig_verify(&ctx->ecmult_ctx, sig64, &q, msg32);
+}
+
+int secp256k1_schnorr_sign(
+    const secp256k1_context *ctx,
+    unsigned char *sig64,
+    const unsigned char *msg32,
+    const unsigned char *seckey,
+    const secp256k1_pubkey *pubkey,
+    secp256k1_nonce_function noncefp,
+    const void *ndata
+) {
+    secp256k1_scalar sec, non;
+    secp256k1_ge p;
+    int ret = 0;
+    VERIFY_CHECK(ctx != NULL);
+    ARG_CHECK(secp256k1_ecmult_gen_context_is_built(&ctx->ecmult_gen_ctx));
+    ARG_CHECK(msg32 != NULL);
+    ARG_CHECK(sig64 != NULL);
+    ARG_CHECK(seckey != NULL);
+    ARG_CHECK(pubkey != NULL);
+
+    if (!secp256k1_schnorr_sig_generate_k(&non, msg32, seckey, noncefp, ndata)) {
+        return 0;
+    }
+
+    secp256k1_pubkey_load(ctx, &p, pubkey);
+    secp256k1_scalar_set_b32(&sec, seckey, NULL);
+    ret = secp256k1_schnorr_sig_sign(&ctx->ecmult_gen_ctx, sig64, &sec, &p, &non, msg32);
+    if (!ret) {
+        memset(sig64, 0, 64);
+    }
+
+    secp256k1_scalar_clear(&non);
+    secp256k1_scalar_clear(&sec);
+    return ret;
+}
+
+#endif
diff --git a/src/secp256k1/src/modules/schnorr/schnorr.h b/src/secp256k1/src/modules/schnorr/schnorr.h
new file mode 100644
--- /dev/null
+++ b/src/secp256k1/src/modules/schnorr/schnorr.h
@@ -0,0 +1,44 @@
+/***********************************************************************
+ * Copyright (c) 2017 Amaury SÉCHET                                    *
+ * Distributed under the MIT software license, see the accompanying    *
+ * file COPYING or http://www.opensource.org/licenses/mit-license.php. *
+ ***********************************************************************/
+
+#ifndef _SECP256K1_MODULE_SCHNORR_H_
+#define _SECP256K1_MODULE_SCHNORR_H_
+
+#include "scalar.h"
+#include "group.h"
+
+static int secp256k1_schnorr_sig_verify(
+    const secp256k1_ecmult_context* ctx,
+    const unsigned char *sig64,
+    secp256k1_ge *pubkey,
+    const unsigned char *msg32
+);
+
+static int secp256k1_schnorr_compute_e(
+    secp256k1_scalar* res,
+    const unsigned char *r,
+    secp256k1_ge *pubkey,
+    const unsigned char *msg32
+);
+
+static int secp256k1_schnorr_sig_sign(
+    const secp256k1_ecmult_gen_context* ctx,
+    unsigned char *sig64,
+    const secp256k1_scalar *privkey,
+    secp256k1_ge *pubkey,
+    const secp256k1_scalar *nonce,
+    const unsigned char *msg32
+);
+
+static int secp256k1_schnorr_sig_generate_k(
+    secp256k1_scalar *k,
+    const unsigned char *msg32,
+    const unsigned char *seckey,
+    secp256k1_nonce_function noncefp,
+    const void *ndata
+);
+
+#endif
diff --git a/src/secp256k1/src/modules/schnorr/schnorr_impl.h b/src/secp256k1/src/modules/schnorr/schnorr_impl.h
new file mode 100644
--- /dev/null
+++ b/src/secp256k1/src/modules/schnorr/schnorr_impl.h
@@ -0,0 +1,210 @@
+/***********************************************************************
+ * Copyright (c) 2017 Amaury SÉCHET                                    *
+ * Distributed under the MIT software license, see the accompanying    *
+ * file COPYING or http://www.opensource.org/licenses/mit-license.php. *
+ ***********************************************************************/
+
+#ifndef _SECP256K1_SCHNORR_IMPL_H_
+#define _SECP256K1_SCHNORR_IMPL_H_
+
+#include <string.h>
+
+#include "schnorr.h"
+#include "field.h"
+#include "group.h"
+#include "hash.h"
+#include "ecmult.h"
+#include "ecmult_gen.h"
+
+/**
+ * Custom Schnorr-based signature scheme.
+ *
+ * Signing:
+ *   Inputs:
+ *     32-byte message m,
+ *     32-byte scalar key x (!=0)
+ *     public key point P,
+ *     32-byte scalar nonce k (!=0)
+ *
+ *   Compute point R = k * G. Negate nonce if R.y is not a quadratic residue.
+ *   Compute scalar e = Hash(R.x || compressed(P) || m). Reject nonce if e == 0 or e >= order.
+ *   Compute scalar s = k + e * x.
+ *   The signature is (R.x, s).
+ *
+ * Verification:
+ *   Inputs:
+ *     32-byte message m,
+ *     public key point P,
+ *     signature: (32-byte r, scalar s)
+ *
+ *   Signature is invalid if s >= order or r >= p.
+ *   Compute scalar e = Hash(r || compressed(P) || m). Reject e == 0 or e >= order.
+ *   Option 1 (faster for single verification):
+ *     Compute point R = s * G - e * P.
+ *       Reject if R is infinity or R.y is not a quadratic residue.
+ *       Signature is valid if the serialization of R.x equals r.
+ *   Option 2 (allows batch validation):
+ *     Decompress x coordinate r into point R, with R.y a quadratic residue.
+ *       Reject if R is not on the curve.
+ *       Signature is valid if R + e * P - s * G == 0.
+ */
+static int secp256k1_schnorr_sig_verify(
+    const secp256k1_ecmult_context* ctx,
+    const unsigned char *sig64,
+    secp256k1_ge *pubkey,
+    const unsigned char *msg32
+) {
+    secp256k1_gej Pj, Rj;
+    secp256k1_fe Rx;
+    secp256k1_scalar e, s;
+    int overflow;
+
+    if (secp256k1_ge_is_infinity(pubkey)) {
+        return 0;
+    }
+
+    /* Extract s */
+    overflow = 0;
+    secp256k1_scalar_set_b32(&s, sig64 + 32, &overflow);
+    if (overflow) {
+        return 0;
+    }
+
+    /* Extract R.x */
+    if (!secp256k1_fe_set_b32(&Rx, sig64)) {
+        return 0;
+    }
+
+    /* Compute e */
+    if (!secp256k1_schnorr_compute_e(&e, sig64, pubkey, msg32)) {
+        return 0;
+    }
+
+    /* Verify the signature */
+    secp256k1_scalar_negate(&e, &e);
+    secp256k1_gej_set_ge(&Pj, pubkey);
+    secp256k1_ecmult(ctx, &Rj, &Pj, &e, &s);
+    if (secp256k1_gej_is_infinity(&Rj)) {
+        return 0;
+    }
+
+    /* Check that R.x is what we expect */
+    if (!secp256k1_gej_eq_x_var(&Rx, &Rj)) {
+        return 0;
+    }
+
+    /* Check that jacobi(R.y) is 1 */
+    if (!secp256k1_gej_has_quad_y_var(&Rj)) {
+        return 0;
+    }
+
+    /* All good, we have a valid signature. */
+    return 1;
+}
+
+static int secp256k1_schnorr_compute_e(
+    secp256k1_scalar* e,
+    const unsigned char *r,
+    secp256k1_ge *p,
+    const unsigned char *msg32
+) {
+    int overflow = 0;
+    size_t size;
+    secp256k1_sha256 sha;
+    unsigned char buf[33];
+    secp256k1_sha256_initialize(&sha);
+
+    /* R.x */
+    secp256k1_sha256_write(&sha, r, 32);
+
+    /* compressed P */
+    secp256k1_eckey_pubkey_serialize(p, buf, &size, 1);
+    VERIFY_CHECK(size == 33);
+    secp256k1_sha256_write(&sha, buf, 33);
+
+    /* msg */
+    secp256k1_sha256_write(&sha, msg32, 32);
+
+    /* compute e */
+    secp256k1_sha256_finalize(&sha, buf);
+    secp256k1_scalar_set_b32(e, buf, &overflow);
+    return !overflow & !secp256k1_scalar_is_zero(e);
+}
+
+static int secp256k1_schnorr_sig_sign(
+    const secp256k1_ecmult_gen_context* ctx,
+    unsigned char *sig64,
+    const secp256k1_scalar *privkey,
+    secp256k1_ge *pubkey,
+    const secp256k1_scalar *nonce,
+    const unsigned char *msg32
+) {
+    secp256k1_gej Rj;
+    secp256k1_ge Ra;
+    secp256k1_scalar e, s, k;
+
+    if (secp256k1_scalar_is_zero(privkey) || secp256k1_scalar_is_zero(nonce)) {
+        return 0;
+    }
+    k = *nonce;
+
+    secp256k1_ecmult_gen(ctx, &Rj, &k);
+    secp256k1_ge_set_gej(&Ra, &Rj);
+    if (!secp256k1_fe_is_quad_var(&Ra.y)) {
+        /**
+         * R's y coordinate is not a quadratic residue, which is not allowed.
+         * Negate the nonce to ensure it is.
+         */
+        secp256k1_scalar_negate(&k, &k);
+    }
+
+    secp256k1_fe_normalize(&Ra.x);
+    secp256k1_fe_get_b32(sig64, &Ra.x);
+    if (!secp256k1_schnorr_compute_e(&e, sig64, pubkey, msg32)) {
+        secp256k1_scalar_clear(&k);
+        return 0;
+    }
+
+    secp256k1_scalar_mul(&s, &e, privkey);
+    secp256k1_scalar_add(&s, &s, &k);
+    secp256k1_scalar_clear(&k);
+    secp256k1_scalar_get_b32(sig64 + 32, &s);
+    return 1;
+}
+
+static int secp256k1_schnorr_sig_generate_k(
+    secp256k1_scalar *k,
+    const unsigned char *msg32,
+    const unsigned char *seckey,
+    secp256k1_nonce_function noncefp,
+    const void *ndata
+) {
+    int overflow = 0;
+    int ret = 0;
+    unsigned int count = 0;
+    unsigned char nonce32[32];
+
+    /* Seed used to make sure we generate different values of k for schnorr */
+    const unsigned char secp256k1_schnorr_algo16[17] = "Schnorr+SHA256  ";
+
+    if (noncefp == NULL) {
+        noncefp = secp256k1_nonce_function_default;
+    }
+
+    while (1) {
+        ret = noncefp(nonce32, msg32, seckey, secp256k1_schnorr_algo16, (void*)ndata, count++);
+        if (!ret) {
+            break;
+        }
+
+        secp256k1_scalar_set_b32(k, nonce32, &overflow);
+        if (!overflow && !secp256k1_scalar_is_zero(k)) {
+            break;
+        }
+    }
+
+    memset(nonce32, 0, 32);
+    return ret;
+}
+
+#endif
diff --git a/src/secp256k1/src/modules/schnorr/tests_impl.h b/src/secp256k1/src/modules/schnorr/tests_impl.h
new file mode 100644
--- /dev/null
+++ b/src/secp256k1/src/modules/schnorr/tests_impl.h
@@ -0,0 +1,521 @@
+/**********************************************************************
+ * Copyright (c) 2017 Amaury SÉCHET                                   *
+ * Distributed under the MIT software license, see the accompanying   *
+ * file COPYING or http://www.opensource.org/licenses/mit-license.php.*
+ **********************************************************************/
+
+#ifndef SECP256K1_MODULE_SCHNORR_TESTS
+#define SECP256K1_MODULE_SCHNORR_TESTS
+
+#include "include/secp256k1_schnorr.h"
+
+void test_schnorr_end_to_end(void) {
+    unsigned char privkey[32];
+    unsigned char message[32];
+    unsigned char schnorr_signature[64];
+    secp256k1_pubkey pubkey;
+
+    /* Generate a random key and message. */
+    {
+        secp256k1_scalar key;
+        random_scalar_order_test(&key);
+        secp256k1_scalar_get_b32(privkey, &key);
+        secp256k1_rand256_test(message);
+    }
+
+    /* Construct and verify corresponding public key. */
+    CHECK(secp256k1_ec_seckey_verify(ctx, privkey) == 1);
+    CHECK(secp256k1_ec_pubkey_create(ctx, &pubkey, privkey) == 1);
+
+    /* Schnorr sign. */
+    CHECK(secp256k1_schnorr_sign(ctx, schnorr_signature, message, privkey, &pubkey, NULL, NULL) == 1);
+    CHECK(secp256k1_schnorr_verify(ctx, schnorr_signature, message, &pubkey) == 1);
+    /* Destroy signature and verify again. */
+    schnorr_signature[secp256k1_rand_bits(6)] += 1 + secp256k1_rand_int(255);
+    CHECK(secp256k1_schnorr_verify(ctx, schnorr_signature, message, &pubkey) == 0);
+}
+
+#define SIG_COUNT 32
+
+void test_schnorr_sign_verify(void) {
+    unsigned char msg32[32];
+    unsigned char sig64[SIG_COUNT][64];
+    secp256k1_gej pubkeyj[SIG_COUNT];
+    secp256k1_ge pubkey[SIG_COUNT];
+    secp256k1_scalar nonce[SIG_COUNT], key[SIG_COUNT];
+    int i, j;
+
+    secp256k1_rand256_test(msg32);
+
+    for (i = 0; i < SIG_COUNT; i++) {
+        random_scalar_order_test(&key[i]);
+        secp256k1_ecmult_gen(&ctx->ecmult_gen_ctx, &pubkeyj[i], &key[i]);
+        secp256k1_ge_set_gej_var(&pubkey[i], &pubkeyj[i]);
+        secp256k1_fe_normalize(&pubkey[i].x);
+        secp256k1_fe_normalize(&pubkey[i].y);
+
+        do {
+            random_scalar_order_test(&nonce[i]);
+            if (secp256k1_schnorr_sig_sign(&ctx->ecmult_gen_ctx, sig64[i], &key[i], &pubkey[i], &nonce[i], msg32)) {
+                break;
+            }
+        } while(1);
+
+        CHECK(secp256k1_schnorr_sig_verify(&ctx->ecmult_ctx, sig64[i], &pubkey[i], msg32));
+
+        /* Apply several random modifications to the sig and check that it
+         * doesn't verify anymore. */
+        for (j = 0; j < count; j++) {
+            int pos = secp256k1_rand_bits(6);
+            int mod = 1 + secp256k1_rand_int(255);
+            sig64[i][pos] ^= mod;
+            CHECK(secp256k1_schnorr_sig_verify(&ctx->ecmult_ctx, sig64[i], &pubkey[i], msg32) == 0);
+            sig64[i][pos] ^= mod;
+        }
+    }
+}
+
+#undef SIG_COUNT
+
+void run_schnorr_compact_test(void) {
+    {
+        /* Test vector 1 */
+        static const unsigned char pkbuf[33] = {
+            0x02,
+            0x79, 0xBE, 0x66, 0x7E, 0xF9, 0xDC, 0xBB, 0xAC,
+            0x55, 0xA0, 0x62, 0x95, 0xCE, 0x87, 0x0B, 0x07,
+            0x02, 0x9B, 0xFC, 0xDB, 0x2D, 0xCE, 0x28, 0xD9,
+            0x59, 0xF2, 0x81, 0x5B, 0x16, 0xF8, 0x17, 0x98,
+        };
+
+        static const unsigned char msg[32] = {
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        };
+
+        static const unsigned char sig[64] = {
+            0x78, 0x7A, 0x84, 0x8E, 0x71, 0x04, 0x3D, 0x28,
+            0x0C, 0x50, 0x47, 0x0E, 0x8E, 0x15, 0x32, 0xB2,
+            0xDD, 0x5D, 0x20, 0xEE, 0x91, 0x2A, 0x45, 0xDB,
+            0xDD, 0x2B, 0xD1, 0xDF, 0xBF, 0x18, 0x7E, 0xF6,
+            0x70, 0x31, 0xA9, 0x88, 0x31, 0x85, 0x9D, 0xC3,
+            0x4D, 0xFF, 0xEE, 0xDD, 0xA8, 0x68, 0x31, 0x84,
+            0x2C, 0xCD, 0x00, 0x79, 0xE1, 0xF9, 0x2A, 0xF1,
+            0x77, 0xF7, 0xF2, 0x2C, 0xC1, 0xDC, 0xED, 0x05,
+        };
+
+        secp256k1_pubkey pubkey;
+        CHECK(secp256k1_ec_pubkey_parse(ctx, &pubkey, pkbuf, 33));
+        CHECK(secp256k1_schnorr_verify(ctx, sig, msg, &pubkey));
+    }
+
+    {
+        /* Test vector 2 */
+        static const unsigned char pkbuf[33] = {
+            0x02,
+            0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
+            0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
+            0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
+            0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59,
+        };
+
+        static const unsigned char msg[32] = {
+            0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
+            0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
+            0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
+            0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89,
+        };
+
+        static const unsigned char sig[64] = {
+            0x2A, 0x29, 0x8D, 0xAC, 0xAE, 0x57, 0x39, 0x5A,
+            0x15, 0xD0, 0x79, 0x5D, 0xDB, 0xFD, 0x1D, 0xCB,
+            0x56, 0x4D, 0xA8, 0x2B, 0x0F, 0x26, 0x9B, 0xC7,
+            0x0A, 0x74, 0xF8, 0x22, 0x04, 0x29, 0xBA, 0x1D,
+            0x1E, 0x51, 0xA2, 0x2C, 0xCE, 0xC3, 0x55, 0x99,
+            0xB8, 0xF2, 0x66, 0x91, 0x22, 0x81, 0xF8, 0x36,
+            0x5F, 0xFC, 0x2D, 0x03, 0x5A, 0x23, 0x04, 0x34,
+            0xA1, 0xA6, 0x4D, 0xC5, 0x9F, 0x70, 0x13, 0xFD,
+        };
+
+        secp256k1_pubkey pubkey;
+        CHECK(secp256k1_ec_pubkey_parse(ctx, &pubkey, pkbuf, 33));
+        CHECK(secp256k1_schnorr_verify(ctx, sig, msg, &pubkey));
+    }
+
+    {
+        /* Test vector 3 */
+        static const unsigned char pkbuf[33] = {
+            0x03,
+            0xFA, 0xC2, 0x11, 0x4C, 0x2F, 0xBB, 0x09, 0x15,
+            0x27, 0xEB, 0x7C, 0x64, 0xEC, 0xB1, 0x1F, 0x80,
+            0x21, 0xCB, 0x45, 0xE8, 0xE7, 0x80, 0x9D, 0x3C,
+            0x09, 0x38, 0xE4, 0xB8, 0xC0, 0xE5, 0xF8, 0x4B,
+        };
+
+        static const unsigned char msg[32] = {
+            0x5E, 0x2D, 0x58, 0xD8, 0xB3, 0xBC, 0xDF, 0x1A,
+            0xBA, 0xDE, 0xC7, 0x82, 0x90, 0x54, 0xF9, 0x0D,
+            0xDA, 0x98, 0x05, 0xAA, 0xB5, 0x6C, 0x77, 0x33,
+            0x30, 0x24, 0xB9, 0xD0, 0xA5, 0x08, 0xB7, 0x5C,
+        };
+
+        static const unsigned char sig[64] = {
+            0x00, 0xDA, 0x9B, 0x08, 0x17, 0x2A, 0x9B, 0x6F,
+            0x04, 0x66, 0xA2, 0xDE, 0xFD, 0x81, 0x7F, 0x2D,
+            0x7A, 0xB4, 0x37, 0xE0, 0xD2, 0x53, 0xCB, 0x53,
+            0x95, 0xA9, 0x63, 0x86, 0x6B, 0x35, 0x74, 0xBE,
+            0x00, 0x88, 0x03, 0x71, 0xD0, 0x17, 0x66, 0x93,
+            0x5B, 0x92, 0xD2, 0xAB, 0x4C, 0xD5, 0xC8, 0xA2,
+            0xA5, 0x83, 0x7E, 0xC5, 0x7F, 0xED, 0x76, 0x60,
+            0x77, 0x3A, 0x05, 0xF0, 0xDE, 0x14, 0x23, 0x80,
+        };
+
+        secp256k1_pubkey pubkey;
+        CHECK(secp256k1_ec_pubkey_parse(ctx, &pubkey, pkbuf, 33));
+        CHECK(secp256k1_schnorr_verify(ctx, sig, msg, &pubkey));
+    }
+
+    {
+        /* Test vector 4 */
+        static const unsigned char pkbuf[33] = {
+            0x03,
+            0xDE, 0xFD, 0xEA, 0x4C, 0xDB, 0x67, 0x77, 0x50,
+            0xA4, 0x20, 0xFE, 0xE8, 0x07, 0xEA, 0xCF, 0x21,
+            0xEB, 0x98, 0x98, 0xAE, 0x79, 0xB9, 0x76, 0x87,
+            0x66, 0xE4, 0xFA, 0xA0, 0x4A, 0x2D, 0x4A, 0x34,
+        };
+
+        static const unsigned char msg[32] = {
+            0x4D, 0xF3, 0xC3, 0xF6, 0x8F, 0xCC, 0x83, 0xB2,
+            0x7E, 0x9D, 0x42, 0xC9, 0x04, 0x31, 0xA7, 0x24,
+            0x99, 0xF1, 0x78, 0x75, 0xC8, 0x1A, 0x59, 0x9B,
+            0x56, 0x6C, 0x98, 0x89, 0xB9, 0x69, 0x67, 0x03,
+        };
+
+        static const unsigned char sig[64] = {
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x3B, 0x78, 0xCE, 0x56, 0x3F,
+            0x89, 0xA0, 0xED, 0x94, 0x14, 0xF5, 0xAA, 0x28,
+            0xAD, 0x0D, 0x96, 0xD6, 0x79, 0x5F, 0x9C, 0x63,
+            0x02, 0xA8, 0xDC, 0x32, 0xE6, 0x4E, 0x86, 0xA3,
+            0x33, 0xF2, 0x0E, 0xF5, 0x6E, 0xAC, 0x9B, 0xA3,
+            0x0B, 0x72, 0x46, 0xD6, 0xD2, 0x5E, 0x22, 0xAD,
+            0xB8, 0xC6, 0xBE, 0x1A, 0xEB, 0x08, 0xD4, 0x9D,
+        };
+
+        secp256k1_pubkey pubkey;
+        CHECK(secp256k1_ec_pubkey_parse(ctx, &pubkey, pkbuf, 33));
+        CHECK(secp256k1_schnorr_verify(ctx, sig, msg, &pubkey));
+    }
+
+    {
+        /* Test vector 4b */
+        static const unsigned char pkbuf[33] = {
+            0x03,
+            0x1B, 0x84, 0xC5, 0x56, 0x7B, 0x12, 0x64, 0x40,
+            0x99, 0x5D, 0x3E, 0xD5, 0xAA, 0xBA, 0x05, 0x65,
+            0xD7, 0x1E, 0x18, 0x34, 0x60, 0x48, 0x19, 0xFF,
+            0x9C, 0x17, 0xF5, 0xE9, 0xD5, 0xDD, 0x07, 0x8F,
+        };
+
+        static const unsigned char msg[32] = {
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        };
+
+        static const unsigned char sig[64] = {
+            0x52, 0x81, 0x85, 0x79, 0xAC, 0xA5, 0x97, 0x67,
+            0xE3, 0x29, 0x1D, 0x91, 0xB7, 0x6B, 0x63, 0x7B,
+            0xEF, 0x06, 0x20, 0x83, 0x28, 0x49, 0x92, 0xF2,
+            0xD9, 0x5F, 0x56, 0x4C, 0xA6, 0xCB, 0x4E, 0x35,
+            0x30, 0xB1, 0xDA, 0x84, 0x9C, 0x8E, 0x83, 0x04,
+            0xAD, 0xC0, 0xCF, 0xE8, 0x70, 0x66, 0x03, 0x34,
+            0xB3, 0xCF, 0xC1, 0x8E, 0x82, 0x5E, 0xF1, 0xDB,
+            0x34, 0xCF, 0xAE, 0x3D, 0xFC, 0x5D, 0x81, 0x87,
+        };
+
+        secp256k1_pubkey pubkey;
+        CHECK(secp256k1_ec_pubkey_parse(ctx, &pubkey, pkbuf, 33));
+        CHECK(secp256k1_schnorr_verify(ctx, sig, msg, &pubkey));
+    }
+
+    {
+        /* Test vector 6: R.y is not a quadratic residue */
+        static const unsigned char pkbuf[33] = {
+            0x02,
+            0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
+            0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
+            0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
+            0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59,
+        };
+
+        static const unsigned char msg[32] = {
+            0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
+            0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
+            0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
+            0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89,
+        };
+
+        static const unsigned char sig[64] = {
+            0x2A, 0x29, 0x8D, 0xAC, 0xAE, 0x57, 0x39, 0x5A,
+            0x15, 0xD0, 0x79, 0x5D, 0xDB, 0xFD, 0x1D, 0xCB,
+            0x56, 0x4D, 0xA8, 0x2B, 0x0F, 0x26, 0x9B, 0xC7,
+            0x0A, 0x74, 0xF8, 0x22, 0x04, 0x29, 0xBA, 0x1D,
+            0xFA, 0x16, 0xAE, 0xE0, 0x66, 0x09, 0x28, 0x0A,
+            0x19, 0xB6, 0x7A, 0x24, 0xE1, 0x97, 0x7E, 0x46,
+            0x97, 0x71, 0x2B, 0x5F, 0xD2, 0x94, 0x39, 0x14,
+            0xEC, 0xD5, 0xF7, 0x30, 0x90, 0x1B, 0x4A, 0xB7,
+        };
+
+        secp256k1_pubkey pubkey;
+        CHECK(secp256k1_ec_pubkey_parse(ctx, &pubkey, pkbuf, 33));
+        CHECK(secp256k1_schnorr_verify(ctx, sig, msg, &pubkey) == 0);
+    }
+
+    {
+        /* Test vector 7: Negated message hash, R.x mismatch */
+        static const unsigned char pkbuf[33] = {
+            0x03,
+            0xFA, 0xC2, 0x11, 0x4C, 0x2F, 0xBB, 0x09, 0x15,
+            0x27, 0xEB, 0x7C, 0x64, 0xEC, 0xB1, 0x1F, 0x80,
+            0x21, 0xCB, 0x45, 0xE8, 0xE7, 0x80, 0x9D, 0x3C,
+            0x09, 0x38, 0xE4, 0xB8, 0xC0, 0xE5, 0xF8, 0x4B,
+        };
+
+        static const unsigned char msg[32] = {
+            0x5E, 0x2D, 0x58, 0xD8, 0xB3, 0xBC, 0xDF, 0x1A,
+            0xBA, 0xDE, 0xC7, 0x82, 0x90, 0x54, 0xF9, 0x0D,
+            0xDA, 0x98, 0x05, 0xAA, 0xB5, 0x6C, 0x77, 0x33,
+            0x30, 0x24, 0xB9, 0xD0, 0xA5, 0x08, 0xB7, 0x5C,
+        };
+
+        static const unsigned char sig[64] = {
+            0x00, 0xDA, 0x9B, 0x08, 0x17, 0x2A, 0x9B, 0x6F,
+            0x04, 0x66, 0xA2, 0xDE, 0xFD, 0x81, 0x7F, 0x2D,
+            0x7A, 0xB4, 0x37, 0xE0, 0xD2, 0x53, 0xCB, 0x53,
+            0x95, 0xA9, 0x63, 0x86, 0x6B, 0x35, 0x74, 0xBE,
+            0xD0, 0x92, 0xF9, 0xD8, 0x60, 0xF1, 0x77, 0x6A,
+            0x1F, 0x74, 0x12, 0xAD, 0x8A, 0x1E, 0xB5, 0x0D,
+            0xAC, 0xCC, 0x22, 0x2B, 0xC8, 0xC0, 0xE2, 0x6B,
+            0x20, 0x56, 0xDF, 0x2F, 0x27, 0x3E, 0xFD, 0xEC,
+        };
+
+        secp256k1_pubkey pubkey;
+        CHECK(secp256k1_ec_pubkey_parse(ctx, &pubkey, pkbuf, 33));
+        CHECK(secp256k1_schnorr_verify(ctx, sig, msg, &pubkey) == 0);
+    }
+
+    {
+        /* Test vector 8: Negated s, R.x mismatch */
+        static const unsigned char pkbuf[33] = {
+            0x02,
+            0x79, 0xBE, 0x66, 0x7E, 0xF9, 0xDC, 0xBB, 0xAC,
+            0x55, 0xA0, 0x62, 0x95, 0xCE, 0x87, 0x0B, 0x07,
+            0x02, 0x9B, 0xFC, 0xDB, 0x2D, 0xCE, 0x28, 0xD9,
+            0x59, 0xF2, 0x81, 0x5B, 0x16, 0xF8, 0x17, 0x98,
+        };
+
+        static const unsigned char msg[32] = {
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        };
+
+        static const unsigned char sig[64] = {
+            0x78, 0x7A, 0x84, 0x8E, 0x71, 0x04, 0x3D, 0x28,
+            0x0C, 0x50, 0x47, 0x0E, 0x8E, 0x15, 0x32, 0xB2,
+            0xDD, 0x5D, 0x20, 0xEE, 0x91, 0x2A, 0x45, 0xDB,
+            0xDD, 0x2B, 0xD1, 0xDF, 0xBF, 0x18, 0x7E, 0xF6,
+            0x8F, 0xCE, 0x56, 0x77, 0xCE, 0x7A, 0x62, 0x3C,
+            0xB2, 0x00, 0x11, 0x22, 0x57, 0x97, 0xCE, 0x7A,
+            0x8D, 0xE1, 0xDC, 0x6C, 0xCD, 0x4F, 0x75, 0x4A,
+            0x47, 0xDA, 0x6C, 0x60, 0x0E, 0x59, 0x54, 0x3C,
+        };
+
+        secp256k1_pubkey pubkey;
+        CHECK(secp256k1_ec_pubkey_parse(ctx, &pubkey, pkbuf, 33));
+        CHECK(secp256k1_schnorr_verify(ctx, sig, msg, &pubkey) == 0);
+    }
+
+    {
+        /* Test vector 9: Negated P, R.x mismatch */
+        static const unsigned char pkbuf[33] = {
+            0x03,
+            0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
+            0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
+            0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
+            0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59,
+        };
+
+        static const unsigned char msg[32] = {
+            0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
+            0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
+            0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
+            0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89,
+        };
+
+        static const unsigned char sig[64] = {
+            0x2A, 0x29, 0x8D, 0xAC, 0xAE, 0x57, 0x39, 0x5A,
+            0x15, 0xD0, 0x79, 0x5D, 0xDB, 0xFD, 0x1D, 0xCB,
+            0x56, 0x4D, 0xA8, 0x2B, 0x0F, 0x26, 0x9B, 0xC7,
+            0x0A, 0x74, 0xF8, 0x22, 0x04, 0x29, 0xBA, 0x1D,
+            0x1E, 0x51, 0xA2, 0x2C, 0xCE, 0xC3, 0x55, 0x99,
+            0xB8, 0xF2, 0x66, 0x91, 0x22, 0x81, 0xF8, 0x36,
+            0x5F, 0xFC, 0x2D, 0x03, 0x5A, 0x23, 0x04, 0x34,
+            0xA1, 0xA6, 0x4D, 0xC5, 0x9F, 0x70, 0x13, 0xFD,
+        };
+
+        secp256k1_pubkey pubkey;
+        CHECK(secp256k1_ec_pubkey_parse(ctx, &pubkey, pkbuf, 33));
+        CHECK(secp256k1_schnorr_verify(ctx, sig, msg, &pubkey) == 0);
+    }
+
+    {
+        /* Test vector 10: s * G = e * P, R = 0 */
+        static const unsigned char pkbuf[33] = {
+            0x02,
+            0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
+            0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
+            0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
+            0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59,
+        };
+
+        static const unsigned char msg[32] = {
+            0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
+            0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
+            0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
+            0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89,
+        };
+
+        static const unsigned char sig[64] = {
+            0x2A, 0x29, 0x8D, 0xAC, 0xAE, 0x57, 0x39, 0x5A,
+            0x15, 0xD0, 0x79, 0x5D, 0xDB, 0xFD, 0x1D, 0xCB,
+            0x56, 0x4D, 0xA8, 0x2B, 0x0F, 0x26, 0x9B, 0xC7,
+            0x0A, 0x74, 0xF8, 0x22, 0x04, 0x29, 0xBA, 0x1D,
+            0x8C, 0x34, 0x28, 0x86, 0x9A, 0x66, 0x3E, 0xD1,
+            0xE9, 0x54, 0x70, 0x5B, 0x02, 0x0C, 0xBB, 0x3E,
+            0x7B, 0xB6, 0xAC, 0x31, 0x96, 0x5B, 0x9E, 0xA4,
+            0xC7, 0x3E, 0x22, 0x7B, 0x17, 0xC5, 0xAF, 0x5A,
+        };
+
+        secp256k1_pubkey pubkey;
+        CHECK(secp256k1_ec_pubkey_parse(ctx, &pubkey, pkbuf, 33));
+        CHECK(secp256k1_schnorr_verify(ctx, sig, msg, &pubkey) == 0);
+    }
+
+    {
+        /* Test vector 11: R.x not on the curve, R.x mismatch */
+        static const unsigned char pkbuf[33] = {
+            0x02,
+            0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
+            0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
+            0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
+            0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59,
+        };
+
+        static const unsigned char msg[32] = {
+            0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
+            0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
+            0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
+            0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89,
+        };
+
+        static const unsigned char sig[64] = {
+            0x4A, 0x29, 0x8D, 0xAC, 0xAE, 0x57, 0x39, 0x5A,
+            0x15, 0xD0, 0x79, 0x5D, 0xDB, 0xFD, 0x1D, 0xCB,
+            0x56, 0x4D, 0xA8, 0x2B, 0x0F, 0x26, 0x9B, 0xC7,
+            0x0A, 0x74, 0xF8, 0x22, 0x04, 0x29, 0xBA, 0x1D,
+            0x1E, 0x51, 0xA2, 0x2C, 0xCE, 0xC3, 0x55, 0x99,
+            0xB8, 0xF2, 0x66, 0x91, 0x22, 0x81, 0xF8, 0x36,
+            0x5F, 0xFC, 0x2D, 0x03, 0x5A, 0x23, 0x04, 0x34,
+            0xA1, 0xA6, 0x4D, 0xC5, 0x9F, 0x70, 0x13, 0xFD,
+        };
+
+        secp256k1_pubkey pubkey;
+        CHECK(secp256k1_ec_pubkey_parse(ctx, &pubkey, pkbuf, 33));
+        CHECK(secp256k1_schnorr_verify(ctx, sig, msg, &pubkey) == 0);
+    }
+
+    {
+        /* Test vector 12: r = p */
+        static const unsigned char pkbuf[33] = {
+            0x02,
+            0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
+            0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
+            0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
+            0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59,
+        };
+
+        static const unsigned char msg[32] = {
+            0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
+            0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
+            0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
+            0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89,
+        };
+
+        static const unsigned char sig[64] = {
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFC, 0x2F,
+            0x1E, 0x51, 0xA2, 0x2C, 0xCE, 0xC3, 0x55, 0x99,
+            0xB8, 0xF2, 0x66, 0x91, 0x22, 0x81, 0xF8, 0x36,
+            0x5F, 0xFC, 0x2D, 0x03, 0x5A, 0x23, 0x04, 0x34,
+            0xA1, 0xA6, 0x4D, 0xC5, 0x9F, 0x70, 0x13, 0xFD,
+        };
+
+        secp256k1_pubkey pubkey;
+        CHECK(secp256k1_ec_pubkey_parse(ctx, &pubkey, pkbuf, 33));
+        CHECK(secp256k1_schnorr_verify(ctx, sig, msg, &pubkey) == 0);
+    }
+
+    {
+        /* Test vector 13: s = n */
+        static const unsigned char pkbuf[33] = {
+            0x02,
+            0xDF, 0xF1, 0xD7, 0x7F, 0x2A, 0x67, 0x1C, 0x5F,
+            0x36, 0x18, 0x37, 0x26, 0xDB, 0x23, 0x41, 0xBE,
+            0x58, 0xFE, 0xAE, 0x1D, 0xA2, 0xDE, 0xCE, 0xD8,
+            0x43, 0x24, 0x0F, 0x7B, 0x50, 0x2B, 0xA6, 0x59,
+        };
+
+        static const unsigned char msg[32] = {
+            0x24, 0x3F, 0x6A, 0x88, 0x85, 0xA3, 0x08, 0xD3,
+            0x13, 0x19, 0x8A, 0x2E, 0x03, 0x70, 0x73, 0x44,
+            0xA4, 0x09, 0x38, 0x22, 0x29, 0x9F, 0x31, 0xD0,
+            0x08, 0x2E, 0xFA, 0x98, 0xEC, 0x4E, 0x6C, 0x89,
+        };
+
+        static const unsigned char sig[64] = {
+            0x2A, 0x29, 0x8D, 0xAC, 0xAE, 0x57, 0x39, 0x5A,
+            0x15, 0xD0, 0x79, 0x5D, 0xDB, 0xFD, 0x1D, 0xCB,
+            0x56, 0x4D, 0xA8, 0x2B, 0x0F, 0x26, 0x9B, 0xC7,
+            0x0A, 0x74, 0xF8, 0x22, 0x04, 0x29, 0xBA, 0x1D,
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+            0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE,
+            0xBA, 0xAE, 0xDC, 0xE6, 0xAF, 0x48, 0xA0, 0x3B,
+            0xBF, 0xD2, 0x5E, 0x8C, 0xD0, 0x36, 0x41, 0x41,
+        };
+
+        secp256k1_pubkey pubkey;
+        CHECK(secp256k1_ec_pubkey_parse(ctx, &pubkey, pkbuf, 33));
+        CHECK(secp256k1_schnorr_verify(ctx, sig, msg, &pubkey) == 0);
+    }
+}
+
+void run_schnorr_tests(void) {
+    int i;
+    for (i = 0; i < 32 * count; i++) {
+        test_schnorr_end_to_end();
+    }
+
+    test_schnorr_sign_verify();
+    run_schnorr_compact_test();
+}
+
+#endif
diff --git a/src/secp256k1/src/secp256k1.c b/src/secp256k1/src/secp256k1.c
--- a/src/secp256k1/src/secp256k1.c
+++ b/src/secp256k1/src/secp256k1.c
@@ -590,3 +590,7 @@
 #ifdef ENABLE_MODULE_RECOVERY
 # include "modules/recovery/main_impl.h"
 #endif
+
+#ifdef ENABLE_MODULE_SCHNORR
+# include "modules/schnorr/main_impl.h"
+#endif
diff --git a/src/secp256k1/src/tests.c b/src/secp256k1/src/tests.c
--- a/src/secp256k1/src/tests.c
+++ b/src/secp256k1/src/tests.c
@@ -4416,6 +4416,10 @@
 # include "modules/recovery/tests_impl.h"
 #endif
 
+#ifdef ENABLE_MODULE_SCHNORR
+# include "modules/schnorr/tests_impl.h"
+#endif
+
 int main(int argc, char **argv) {
     unsigned char seed16[16] = {0};
     unsigned char run32[32] = {0};
@@ -4540,6 +4544,11 @@
     run_recovery_tests();
 #endif
 
+#ifdef ENABLE_MODULE_SCHNORR
+    /* Schnorr signature tests */
+    run_schnorr_tests();
+#endif
+
     secp256k1_rand256(run32);
     printf("random run = %02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\n", run32[0], run32[1], run32[2], run32[3], run32[4], run32[5], run32[6], run32[7], run32[8], run32[9], run32[10], run32[11], run32[12], run32[13], run32[14], run32[15]);