Why is Public Key aggregation in MuSig described as a product of the public keys?

Question

In the the MuSig2 paper, it is described that:

Each signer randomly generates and communicates to others a nonce Ri=g^ri; then, each of them computes R=∏ni=1Ri,c=H( ̃X,R,m)where ̃X=∏ni=1Xiis the product of individual public keys

I would expect that an operation of two or more points on an elliptic curve would be described as an addition operation, such as the sum of individual public keys {X1...Xn} (not the product of individual public keys). The paper describes the aggregation of public keys and public nonce values as a product. Am I misunderstanding the actual operation occurring here? Why is this the product of curve points?

In other words: my understanding is that adding points on the curve involves the geometric operation of drawing a line between two points and finding the third point that intersects the curve (with flip across x-axis). When it comes to doing things like combining public keys and public nonces, is the same geometric operation still occurring? Isn't this still described as 'adding' points on the curve?

Answer 1

This is purely a matter of notation.

The points on the elliptic curve form a cyclic group. A group is a set with an associated identity element and a group operation. People need a symbol for that group operation. In some contexts it is more common to use an addition symbol (and multiplication representing repeated application of the group operation), and in other contexts it is more common to use a multiplication symbol (and exponentiation representing repeated application of the group operation).

Both notations are commonly used, and it has no effect on the actual operations. It's just a question of how to write what. There are even somewhat heated debates on this topic. You may even notice one of the MuSig2 paper's authors commenting in that thread.

One thing to point out that may explain this, is that the MuSig2 paper not ever mentions elliptic curves. It needs prime-ordered groups in which certain assumptions hold, but beyond that it could be any group - and the paper states, in Section 3.1, "The group G is denoted multiplicatively". This is the case for most cryptography based on the discrete logarithm problem: it works for any group. And historically, the first type of groups used for this purpose were integers modulo a prime numbers (with certain other restrictions) - where multiplication is the obvious choice for the symbol. You may also notice it is called the "discrete logarithm" problem, and not the "discrete division" problem.

At the same time, in the context of elliptic curves, you're right of course that the operation is called point addition - and repeated application of it is called point multiplication. I personally prefer it as well, as means you get a more obvious correspondence between scalar and group operations (e.g. s = k + H(R,P,m)x for computing a Schnorr signature vs s·G = k·G + H(R,P,M)·x·G = R + H(R,P,m)·P for verifying it, as opposed to G^s = R·P^H(R,P,m) in multiplicative notation), and avoids sometimes nested layers of superscripts in typesetting.

EDIT: Tim Ruffing pointed out to me that the real reason for using multiplicative notation in MuSig2 is because the paper started as a revision of the MuSig paper, which also used multiplicative notation. The MuSig-DN paper uses additive notation, however.