3

I am interested in the case where a fixed pool of signers will sign a series of many messages. As I understand it, musig2 would allow pre-processing, whereby a signature aggregator could collect a list of public nonce pairs from each signer in advance, and then consume one pair from each signer for each message to sign. Signers would need to save the private key associated with each public nonce, and the aggregator would need to signal which one to use for each signature.

I wonder, could the public nonce list be generated from a chain code in the same manner that BIP-32 allows a list of public keys to be generated? So, signers would commit to "extended public nonces" (R,c),(S,d), and then the signature aggregator would include a sequence number with each message, to define the nonce key pair in the manner of BIP-32? Or, better, could the BIP-32 sequence number be replaced with some deterministic function of the message being signed?

1

1 Answer 1

7

I wonder, could the public nonce list be generated from a chain code in the same manner that BIP-32 allows a list of public keys to be generated?

Absolutely not. (private) nonces need to be entirely unpredictable to other participants. If your (public) nonces are generated according to a publicly (to other participants) known xpub, that implies a known relation between the corresponding private nonces. This completely breaks the security of MuSig and related schemes. The other participants will be able to compute your private key after seeing a few partial signatures.

There does exist a scheme that combines MuSig with deterministic nonces, called MuSig-DN (disclaimer: I'm a co-author). It is significantly more complex than just a publicly derivable set of nonces however, and involves zero-knowledge proofs where participants prove to each other their nonces were generated honestly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.