Skip to main content

Questions tagged [musig]

MuSig is a family of protocols for aggregating public keys and signatures. It includes MuSig (also called MuSig1), MuSig2 and MuSig-DN. Key and signature aggregation makes multisignature transactions cheaper and more private.

Filter by
Sorted by
Tagged with
0 votes
0 answers
13 views

Why does the musig() descriptor accept the pk descriptor as an argument?

In the following test vector described in BIP390, the musig() descriptor takes a pk() descriptor as an argument: tr(musig(...
Shigeyuki Azuchi's user avatar
0 votes
0 answers
33 views

P2tr transaction with musig2 rust

I'm trying to build a p2tr that spends a 2-2 musig aggregated address. My process is as follow: Create SecretKey, PublicKey pair from each party Aggregate those 2 public keys Create and publish a ...
Trí Lương's user avatar
0 votes
0 answers
66 views

Got non-mandatory-script-verify-flag (Invalid Schnorr signature) error message when spend a taproot transation

I'm trying to spend an Taproot address via a key spend path with musig2 lib in Rust. This address is aggregated with 2 owners. But I still got this message when I broadcast the hex transaction to ...
Trí Lương's user avatar
1 vote
1 answer
53 views

BTC multisig wallet with rekeying

I'm trying to create a Bitcoin multisig wallet. At this point, the wallet must meet the following conditions must be capable of k-of-n threshold signatures (schnorr, musig, etc.) it should be ...
dohyeon.eth's user avatar
0 votes
1 answer
116 views

Do we need a taproot commit for multisignatures if there is no script path, but we are using the MuSig2 protocol?

I read in some article for Taproot that if there is no need for a script path spending and a number of participant (multisignature with key aggregation) create together a taproot output key (key for a ...
LeaBit's user avatar
  • 980
3 votes
1 answer
545 views

How can I tell if a Taproot input is a key path spend or a script path spend?

In some analyses of chain activity, I sometimes see Taproot spends divided into key path and script path. Why are they called that? Which BIPs should I read to learn more? When I look at a P2TR tx in ...
Hunter Beast's user avatar
1 vote
2 answers
302 views

What's cheaper, musig or multisig?

Taproot transactions aren't always cheaper onchain compared to their segwit native counterparts. How does the current MuSig spec fare compared to multisig onchain? Is one always cheaper than the other ...
arshbot's user avatar
  • 1,798
0 votes
1 answer
169 views

To what extent does BIP32 key derivation impact the design of secure key aggregation multisig and threshold schemes like MuSig and FROST?

I have seen it discussed in various places (e.g. 1, 2) that using BIP32 key derivation impacts the design of secure key aggregation multisig and threshold schemes like MuSig(2) and FROST. What are the ...
Michael Folkson's user avatar
2 votes
0 answers
34 views

What is the argument for not using proofs of possession in Bitcoin multisig and threshold key aggregation schemes?

A number of multisig and threshold sig key aggregation schemes developed outside of the Bitcoin ecosystem (e.g. SpeedyMuSig, FROST) use proofs of possession yet those developed in the Bitcoin ...
Michael Folkson's user avatar
1 vote
1 answer
58 views

What's not standard in these descriptors?

In here, about these (indentation is mine): sh(wsh(multi(2, abcdef01/1'/1'/0/*, 23456789/1'/1'/0/*)))#abcdefgh sh(wsh(multi(2, abcdef01/1'/1'/1/*, 23456789/1'/1'/1/*)))#ijklmnop wsh(multi(2, ...
Mercedes's user avatar
  • 844
3 votes
1 answer
190 views

musig2 with BIP-32 style nonce chain

I am interested in the case where a fixed pool of signers will sign a series of many messages. As I understand it, musig2 would allow pre-processing, whereby a signature aggregator could collect a ...
user1055568's user avatar
0 votes
1 answer
79 views

Why does only one of the two nonce points in MuSig2 have the exponent b?

In MuSig2 R''_i is added to itself b times (in multiplicative notation, it has the exponent b) but R'_i is not (it does not have the exponent b). Why does only one of the nonce points have the ...
Michael Folkson's user avatar
0 votes
1 answer
94 views

In MuSig2 how is multiplication of coordinates defined?

In the MuSig2 paper each signer multiplies all the nonces together (in the naive version): R_1 * R_2 * R_3 * .... R_n where R_i = r_i * G. r_i is a scalar and G is the generator point (coordinate) ...
Michael Folkson's user avatar
0 votes
2 answers
186 views

How does SpeedyMuSig compare to MuSig2?

This paper (Crites, Komlo, Maller) on the security of Schnorr multisig and threshold signature schemes introduces a new variant of MuSig2 called SpeedyMuSig that includes proofs of possession and ...
Michael Folkson's user avatar
2 votes
1 answer
858 views

How do MuSig2 and FROST compare for multisig key aggregation schemes?

Although FROST is primarily for threshold (k-of-n, k<n) key aggregation schemes (and MuSig2 doesn't support threshold) FROST can support multisig (n-of-n) key aggregation. So what are the upsides ...
Michael Folkson's user avatar
3 votes
1 answer
66 views

How do the various Lightning implementations treat latency? How long do they wait for a peer to provide a signature before using unhappy path?

Rene Pickhardt brought up the problem of latency on the Lightning Network in this answer on using nested (or "recursive") MuSig2 or FROST when providing a signature within an existing ...
Michael Folkson's user avatar
2 votes
2 answers
247 views

Can you do P2WSH / P2SH on Lightning Network (LN)?

I understand that a channel is a 2 of 2 multisig: 1 && 1 Is it possible that one side of this channel is a multisig wallet? So in essence one of the 2 main, is actually a 2 of 3 multisig. ...
miketery's user avatar
1 vote
1 answer
131 views

With MuSig2 can we now avoid any privacy leak of a Lightning channel's onchain UTXO?

Now we have access to Schnorr and MuSig(2) onchain can we avoid any privacy leak of a Lightning channel's associated onchain UTXO?
Michael Folkson's user avatar
2 votes
1 answer
140 views

Where can I get some MuSig2 test vectors?

I am writing a MuSig2 library and need some test vectors. This should include the hash functions used.
Jimmy Song's user avatar
  • 7,759
2 votes
1 answer
239 views

How to spend a taproot output using key path with a threshold signature scheme when the secret key is never computed?

In taproot, in order to spend the keypath, the transaction must be signed using the tweaked private key instead of the normal private key (as defined in BIP 341). However when computing a signature ...
sa8's user avatar
  • 75
8 votes
1 answer
308 views

Possible number of signers with MuSig

With multisig, up to 20 signatures may be used in a threshold signature scheme (What are the limits of m and n in m-of-n multisig addresses?). As far as I understand, there should be no hard-coded ...
Dalit Sairio's user avatar
1 vote
1 answer
395 views

Taproot, potential quantum bug, and general clarification

Here seeking information. I have 2 questions marked with parens Would like some clarification pertaining to the Mark Friedenbach article: Why I'm Against Taproot The point of contention with Mark ...
Michael Tidwell's user avatar
7 votes
1 answer
635 views

What is the difference between key aggregation and signature aggregation?

What is the difference between key aggregation (e.g. MuSig) and signature aggregation? Many people (including myself) have in the past used these terms interchangeably. Why is it important to be ...
Michael Folkson's user avatar
2 votes
1 answer
210 views

Using key aggregation (multsig) in P2TR script path spends

I know that it is possible to create a 2-2 multsig using Taproot by combining both private keys into one public key and defining that as the key path spend. I also know that it is possible to use ...
Hellwerker's user avatar
2 votes
1 answer
191 views

Why is Public Key aggregation in MuSig described as a product of the public keys?

In the the MuSig2 paper, it is described that: Each signer randomly generates and communicates to others a nonce Ri=g^ri; then, each of them computes R=∏ni=1Ri,c=H( ̃X,R,m)where ̃X=∏ni=1Xiis the ...
JordanPedersenCommitments's user avatar
2 votes
1 answer
96 views

In MuSig-DN why not use a truly random number for the nonce instead of a pseudorandom function?

In MuSig-DN why not use a truly random number for the nonce instead of a pseudorandom function (PRF)? If the nonce space is big enough it would never be reused. This question was asked by emzy on ...
Michael Folkson's user avatar
3 votes
1 answer
126 views

Who will the first adopters of Taproot be (assuming it is activated at some stage)? What incentives are there to start using it straight away?

Adoption of SegWit by users and companies after it was activated was slow. Should we expect adoption of Taproot to be slow also (assuming it is activated at some stage)? Who will the first adopters of ...
Michael Folkson's user avatar
3 votes
1 answer
185 views

Which MuSig scheme is optimal? Classic MuSig or this new MuSig-DN scheme?

Now we have two competing MuSig schemes which is better? Classic MuSig or MuSig-DN? Which use case(s) might choose classic MuSig over MuSig-DN and vice versa?
Michael Folkson's user avatar
0 votes
1 answer
101 views

Schnorr without R in the challenge

I read the Schnorr and MuSig papers and stumbled over the problem that the use of deterministic nonces in multisignatures is not safe. The adversary would be able to extract the private key from the ...
rage-proof's user avatar
3 votes
1 answer
128 views

Is Z-man's PTLC construction implementable using libsecp256k1-zkp?

In a mailing list post Z-man details a PTLC construction which he claims is "is almost entirely a MuSig ritual". My question is whether this MusigTweak is what is called the adaptor (last argument of ...
Janus Troelsen's user avatar
14 votes
1 answer
714 views

Musig Signature Interactivity

2 Questions: Why is Musig signing always interactive? Let's say I have a Musig wallet where keys are stored in secure locations with no internet access. What are some methods to sign from these ...
justinmoon's user avatar
12 votes
2 answers
2k views

How could Schnorr signatures be aggregated across the whole transaction?

I am studying the MuSig protocol and am having trouble grasping certain segments. This is my understanding thus far: In current Bitcoin CHECKMULTISIG format, the size of the signature grows linearly ...
Jayyy777's user avatar
  • 141
6 votes
1 answer
310 views

Does MuSig have the same security as 2-2 multisig?

Disclaimer: This question is of theoretical importance to me trying to educate myself better on cryptographic principles and signature schemes. I don't intend to imply that in practice schnorr ...
Rene Pickhardt's user avatar
1 vote
1 answer
194 views

Can R/r in Musig be derived from only seeds and message hashes?

I am wondering if the first two roundtrips of pre-committing and then revealing R/r in MuSig signing can be moved to the keygen phase and made deterministic. That reduces the amount of messages that ...
Janus Troelsen's user avatar
0 votes
2 answers
98 views

Can i compose a multisig address where one of the signatories is a multisig address?

Can i compose a multisig address where one of the signatories is a multisig address? In order to create a multisig address we need the pubkey of the signatories. bitcoin­cli addmultisigaddress 2 '["...
Albert S's user avatar
  • 1,640
4 votes
0 answers
228 views

How does schnorr signature construct multisig functionality?

How does the multiparty schnorr signature work and enable multisig functionality in Bitcoin? What are its limitations? Can we construct any m of n signature? Is there anyway to hide the signers among ...
abeikverdi's user avatar