Questions tagged [musig]
The musig tag has no usage guidance.
16
questions
2
votes
1answer
41 views
Where can I get some MuSig2 test vectors?
I am writing a MuSig2 library and need some test vectors. This should include the hash functions used.
1
vote
1answer
71 views
How to spend a taproot output using key path with a threshold signature scheme when the secret key is never computed?
In taproot, in order to spend the keypath, the transaction must be signed using the tweaked private key instead of the normal private key (as defined in BIP 341).
However when computing a signature ...
7
votes
1answer
173 views
Possible number of signers with MuSig
With multisig, up to 20 signatures may be used in a threshold signature scheme (What are the limits of m and n in m-of-n multisig addresses?).
As far as I understand, there should be no hard-coded ...
1
vote
1answer
182 views
Taproot, potential quantum bug, and general clarification
Here seeking information. I have 2 questions marked with parens
Would like some clarification pertaining to the Mark Friedenbach article:
Why I'm Against Taproot
The point of contention with Mark ...
5
votes
1answer
238 views
What is the difference between key aggregation and signature aggregation?
What is the difference between key aggregation (e.g. MuSig) and signature aggregation?
Many people (including myself) have in the past used these terms interchangeably. Why is it important to be ...
2
votes
1answer
69 views
Using key aggregation (multsig) in P2TR script path spends
I know that it is possible to create a 2-2 multsig using Taproot by combining both private keys into one public key and defining that as the key path spend. I also know that it is possible to use ...
2
votes
1answer
102 views
Why is Public Key aggregation in MuSig described as a product of the public keys?
In the the MuSig2 paper, it is described that:
Each signer randomly generates and communicates to others a nonce
Ri=g^ri; then, each of them computes R=∏ni=1Ri,c=H( ̃X,R,m)where
̃X=∏ni=1Xiis the ...
2
votes
1answer
52 views
In MuSig-DN why not use a truly random number for the nonce instead of a pseudorandom function?
In MuSig-DN why not use a truly random number for the nonce instead of a pseudorandom function (PRF)? If the nonce space is big enough it would never be reused.
This question was asked by emzy on ...
2
votes
1answer
84 views
Who will the first adopters of Taproot be (assuming it is activated at some stage)? What incentives are there to start using it straight away?
Adoption of SegWit by users and companies after it was activated was slow. Should we expect adoption of Taproot to be slow also (assuming it is activated at some stage)?
Who will the first adopters of ...
3
votes
1answer
98 views
Which MuSig scheme is optimal? Classic MuSig or this new MuSig-DN scheme?
Now we have two competing MuSig schemes which is better? Classic MuSig or MuSig-DN? Which use case(s) might choose classic MuSig over MuSig-DN and vice versa?
0
votes
1answer
61 views
Schnorr without R in the challenge
I read the Schnorr and MuSig papers and stumbled over the problem that the use of deterministic nonces in multisignatures is not safe. The adversary would be able to extract the private key from the ...
3
votes
1answer
75 views
Is Z-man's PTLC construction implementable using libsecp256k1-zkp?
In a mailing list post Z-man details a PTLC construction which he claims is "is almost entirely a MuSig ritual". My question is whether this MusigTweak is what is called the adaptor (last argument of ...
13
votes
1answer
629 views
Musig Signature Interactivity
2 Questions:
Why is Musig signing always interactive?
Let's say I have a Musig wallet where keys are stored in secure locations with no internet access. What are some methods to sign from these ...
9
votes
2answers
753 views
How could Schnorr signatures be aggregated across the whole transaction?
I am studying the MuSig protocol and am having trouble grasping certain segments. This is my understanding thus far:
In current Bitcoin CHECKMULTISIG format, the size of the signature grows linearly ...
6
votes
1answer
233 views
Does MuSig have the same security as 2-2 multisig?
Disclaimer: This question is of theoretical importance to me trying to educate myself better on cryptographic principles and signature schemes. I don't intend to imply that in practice schnorr ...
1
vote
1answer
160 views
Can R/r in Musig be derived from only seeds and message hashes?
I am wondering if the first two roundtrips of pre-committing and then revealing R/r in MuSig signing can be moved to the keygen phase and made deterministic. That reduces the amount of messages that ...