3

Now we have two competing MuSig schemes which is better? Classic MuSig or MuSig-DN? Which use case(s) might choose classic MuSig over MuSig-DN and vice versa?

2

Firstly, it is worth emphasizing that both classic MuSig (referred to here as "MuSig") and MuSig-DN are relatively new cryptographic schemes and the paper for MuSig-DN is fresh off the presses at the time of writing (September 2020) with no current implementation. So use both at your own risk but even more so for MuSig-DN. The MuSig paper needed to be revised and it is certainly possible that the MuSig-DN paper will need to go through revision(s).

There are so many trade-offs with multisignature schemes that is hard to be precise and weigh them all up against each other. I will outline some of the key trade-offs that Pieter Wuille mentioned on IRC (any mistakes are my own).

Currently, MuSig-DN has a high computational cost with approximately a 1 second signing time on a modern desktop CPU. It is possible that this could be reduced but this would likely impact the existence of a security proof. On computational cost MuSig signing is clearly preferable. (Verification cost is identical.)

The motivation for MuSig-DN in the first place is that it has two communication rounds rather than MuSig's three. On communication rounds MuSig-DN is preferable.

MuSig-DN offers stateless signing which means the signer doesn't need to remember the rounds he/she has already participated in or remember nonces from one round to the next. In contrast MuSig needs randomly generated nonces at signing time and previous state must be stored securely. On stateless signing and randomness requirements MuSig-DN is preferable.

Both MuSig and MuSig-DN have a security proof under similar assumptions.

As you can tell from the above on multiple dimensions MuSig-DN is superior to MuSig. However, the computational cost of MuSig-DN arguably outweighs all the benefits for practical use cases and one would expect classic MuSig to generally be used over the current iteration of MuSig-DN.

As an aside there is a strict improvement of classic MuSig being worked on, let's call it "MuSig2", which has two communication rounds and would allow for private nesting. You could have multiple levels of MuSig aggregation and not tell your sibling participants that you have child participants.

[edit in October 2020: The paper for MuSig2 has now been published.]

For more information on MuSig-DN see this blog post from Jonas Nick and Tim Ruffing.

Thanks to Pieter Wuille for answering my questions on IRC. Any errors are my own.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.