4

I’m trying to understand the current state of descriptor support for taproot, with a specific focus on multisig wallets (When I say “multisig” I mean k-of-n threshold signing, rather than a schnorr multisignature). I found this PR that introduced taproot descriptors into Core: https://github.com/bitcoin/bitcoin/pull/22051 and it said that support for more interesting scripts had not yet been implemented. Is that still the case, or does anyone know of any docs or examples to do a multisig wallet descriptor?

Thanks!

Improve this question
1
  • There are two docs in core repository related to multisig that use descriptors in examples
    – user103136
    Jan 8, 2022 at 5:30

1 Answer 1

Reset to default
2

At the time of writing (January 2022) there hasn't been a descriptor specified for Schnorr/Taproot multisig (using the new OP_CHECKSIGADD opcode specified in BIP 342) or using the key aggregation scheme MuSig.

(When I say “multisig” I mean k-of-n threshold signing, rather than a schnorr multisignature)

A clarification on terminology. In Bitcoin we generally use "multisig" to refer to n-of-n (n=n) and "threshold" to refer to k-of-n (k<n). MuSig(2) refers to a key aggregation scheme where only one key and one signature go onchain despite there being multiple keys involved offchain. Threshold equivalents of MuSig(2) are being worked on e.g. FROST but are not finalized or as mature as MuSig(2). Neither MuSig(2) or FROST have descriptors specified at the time or writing.

Hence if you want to use a multisig or threshold signature descriptor you would use an existing one e.g. multi or sortedmulti that doesn't support a Schnorr/Taproot multisig. A bit confusingly the multi descriptor does support both multisignature and threshold signatures according to the above definitions but not for Schnorr/Taproot.

April 2023 Update

There are now multi_a and sortedmulti_a descriptors supported in the Bitcoin Core wallet for k-of-n policies using the CHECKSIGADD opcode inside the tr() Taproot descriptor. A MuSig(2) descriptor has been discussed and there is an open pull request in rust-miniscript implementing it but it hasn't yet been finalized.

Improve this answer
7
  • Not related to the question so putting in the comments but Miniscript does differentiate between multisig and threshold sig (multi and thresh) but descriptors allow you to do both multisig and threshold sig using the multi descriptor. That will be confusing when MIniscript gets integrated with descriptors :)
    – Michael Folkson
    Jan 8, 2022 at 7:32
  • 1
    I think traditionally in Bitcoin "multisig" refers to k-of-n using OP_CHECKMULTISIG (so using multiple signatures and multiple keys). In cryptography at large, "multisignature" refers to a single signature with multiple keys (which musig/musig2/musig-dn and other schemes achieve), and "threshold signature" refers to a single signature corresponding to a k-of-n combination of multiple keys (like FROST accomplishes).
    – Pieter Wuille
    Jan 8, 2022 at 18:20
  • @PieterWuille: Ok you may have changed your definitions since btctranscripts.com/lets-talk-bitcoin-podcast/… :) "k-of-n is say 2 out of 3 where k is different from n" and "When we talk about k-of-n or thresholds"
    – Michael Folkson
    Jan 8, 2022 at 19:31
  • that's saying the same thing?
    – Pieter Wuille
    Jan 9, 2022 at 16:12
  • Thanks for the answer. I thought within bitcoin, “multisig” traditionally referred to threshold signing, for example: github.com/bitcoin/bitcoin/blob/master/doc/… . In any case, the clarification is helpful :)
    – Alex
    Jan 9, 2022 at 21:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.