Possible number of signers with MuSig

Question

With multisig, up to 20 signatures may be used in a threshold signature scheme (What are the limits of m and n in m-of-n multisig addresses?).

As far as I understand, there should be no hard-coded limit with MuSig, as to the blockchain every scheme would always look like just one single signature (from one single key-pair), even if in reality those were multiple signatures that just were aggregated into one.

Is there anything else that limits the amount of signatures that can be used with MuSig, or is this number of possible signatures essentially infinite?

Answer 1

The number of signers with MuSig (and MuSig2) is practically infinite. For example, creating a MuSig signature with 1 million signers takes about 130 seconds on my laptop (see https://github.com/jonasnick/musig-benchmark).

However, MuSig(2) does not have the same functionality as OP_CHECKMULTISIG. MuSig only supports m = n which is the definition of "multisignature" outside the Bitcoin space. OP_CHECKMULTISIG supports m <= n and is therefore more accurately referred to as "threshold signature". There is a scheme called FROST that allows creating threshold signatures that look like a single Schnorr signature and ongoing work to implement it for use in Bitcoin.

Note that tapscript disables OP_CHECKMULTISIG and instead introduces OP_CHECKSIGADD, which does not have the 20 signature limitiation.