Skip to main content
Share Your Experience: Take the 2024 Developer Survey
14 votes
Accepted

Musig Signature Interactivity

MuSig is interactive because each signer needs to provide a signature nonce (effectively randomness) before signing. This is not specific to MuSig, but applies to any discrete logarithm-based ...
nickler's user avatar
  • 776
8 votes
Accepted

Possible number of signers with MuSig

The number of signers with MuSig (and MuSig2) is practically infinite. For example, creating a MuSig signature with 1 million signers takes about 130 seconds on my laptop (see https://github.com/...
nickler's user avatar
  • 776
7 votes
Accepted

musig2 with BIP-32 style nonce chain

I wonder, could the public nonce list be generated from a chain code in the same manner that BIP-32 allows a list of public keys to be generated? Absolutely not. (private) nonces need to be entirely ...
Pieter Wuille's user avatar
6 votes
Accepted

Where can I get some MuSig2 test vectors?

As far as I know, there is not even a published specification for MuSig2. One is being worked on at https://github.com/jonasnick/bips/blob/musig2/bip-musig2.mediawiki, but it is incomplete. There are ...
Pieter Wuille's user avatar
5 votes
Accepted

How can I tell if a Taproot input is a key path spend or a script path spend?

Taproot is specified in BIP341 which also includes much relevant information such as motivation and rationale. My answer will essentially just rephrase some of its highlights. Key path spends and ...
Vojtěch Strnad's user avatar
5 votes
Accepted

What's cheaper, musig or multisig?

I assume that you are asking about MuSig being used to aggregate the participants' public keys and an input that spends directly using the aggregate pubkey in a keypath spend. In that case, the on-...
Murch's user avatar
  • 75.7k
5 votes
Accepted

Does MuSig have the same security as 2-2 multisig?

Yes or no, depending on your definition. You are right that the expected time to forge a 2-of-2 multisignature is twice that of a single signature, because you obviously need to use your forger ...
Pieter Wuille's user avatar
5 votes
Accepted

Can R/r in Musig be derived from only seeds and message hashes?

The construction you're suggesting will likely work as long as you don't sign more than one message. By effectively choosing the R points ahead of time, you've constructed a single-show signature. ...
Pieter Wuille's user avatar
4 votes
Accepted

Why is Public Key aggregation in MuSig described as a product of the public keys?

This is purely a matter of notation. The points on the elliptic curve form a cyclic group. A group is a set with an associated identity element and a group operation. People need a symbol for that ...
Pieter Wuille's user avatar
4 votes
Accepted

What is the difference between key aggregation and signature aggregation?

As Pieter Wuille states here key aggregation is completed at address creation time not at signing time or post signing time. Of course, key aggregation has an impact on the signing algorithm, and ...
Michael Folkson's user avatar
3 votes
Accepted

With MuSig2 can we now avoid any privacy leak of a Lightning channel's onchain UTXO?

Assuming MuSig(2) is implemented on the Lightning Network protocol a 2-of-2 multisignature spend will look like a single signature spend on the blockchain. Hence the Lightning channel footprint on the ...
Michael Folkson's user avatar
3 votes

How to spend a taproot output using key path with a threshold signature scheme when the secret key is never computed?

This is exactly what a threshold signature scheme is: the ability to jointly (by interacting with a quorum of signers) produce a valid signature for a single public key that represents the threshold. ...
Pieter Wuille's user avatar
3 votes

Schnorr without R in the challenge

So the scheme you suggest is that signatures are pairs (R, s) such that sG = R + H(P,m)P, where P is the public key, and m is the message. Pick a random s. Set R = sG - H(P,m)P. (R,s) is now a valid ...
Pieter Wuille's user avatar
3 votes
Accepted

Who will the first adopters of Taproot be (assuming it is activated at some stage)? What incentives are there to start using it straight away?

(A 2-of-2, 3-of-3, n-of-n will be referred to as a multisig scheme and a 1-of-2, 2-of-3, k-of-n where k < n will be referred to as a threshold scheme) The most significant incentives for using ...
Michael Folkson's user avatar
2 votes
Accepted

Which MuSig scheme is optimal? Classic MuSig or this new MuSig-DN scheme?

Firstly, it is worth emphasizing that both classic MuSig (referred to here as "MuSig") and MuSig-DN are relatively new cryptographic schemes and the paper for MuSig-DN is fresh off the ...
Michael Folkson's user avatar
2 votes
Accepted

Is Z-man's PTLC construction implementable using libsecp256k1-zkp?

My question is whether this MusigTweak is what is called the adaptor (last argument of secp256k1_musig_session_combine_nonces) in secp256k1-zkp? No, what "Z-man" refers to as MusigTweak is not called ...
nickler's user avatar
  • 776
2 votes
Accepted

Using key aggregation (multsig) in P2TR script path spends

You are right. You could either use a leaf with a single aggregated key or a leaf with a more traditional multisig construction using OP_CHECKSIGADD. The advantage of the aggregated key is its smaller ...
Murch's user avatar
  • 75.7k
2 votes
Accepted

In MuSig-DN why not use a truly random number for the nonce instead of a pseudorandom function?

This question was answered by Tim Ruffing on Twitter. The answer is simply that it's not easy to get truly random numbers right in practice. For example, you need to collect entropy in your system, ...
Michael Folkson's user avatar
2 votes
Accepted

What's not standard in these descriptors?

The "musig" descriptor function has not been standardized. These descriptors also don't seem to contain valid key expressions (which need to be hex pubkeys, hex x-only pubkeys, xpubs, xprvs, ...
Pieter Wuille's user avatar
2 votes

Can you do P2WSH / P2SH on Lightning Network (LN)?

As you realized the point of Lightning is to reduce latency. At the same time coordinating signatures from various parties in order to move forward the state seems rather impractical. Thus as far as I ...
Rene Pickhardt's user avatar
2 votes
Accepted

Why does only one of the two nonce points in MuSig2 have the exponent b?

A slight variant of MuSig2, named MuSig2*, sets one of the coefficients to 1 to make the key aggregation function slightly more efficient. This is described in a draft specification of MuSig2 : ↩ ...
Kalle Rosenbaum's user avatar
2 votes
Accepted

In MuSig2 how is multiplication of coordinates defined?

TL;DR: the multiplication operation you're asking about is actually what you're used to seeing referred to as point adition (when talking about elliptic curves). The MuSig2 paper does not assume you'...
Pieter Wuille's user avatar
2 votes
Accepted

How does SpeedyMuSig compare to MuSig2?

SpeedyMusig requires each signer to collect all n nonce pairs (Ri,Si) as input to the hash which determines how they are combined for the final nonce. Musig2 allows a single untrusted aggregator to ...
user1055568's user avatar
2 votes

What's cheaper, musig or multisig?

The MuSig(2) protocol produces one aggregate signature that goes onchain. Multisig requires multiple signatures to go onchain. So if you are just talking transaction size MuSig(2) will always be ...
Michael Folkson's user avatar
2 votes
Accepted

Do we need a taproot commit for multisignatures if there is no script path, but we are using the MuSig2 protocol?

Is there any need for addition key tweaking if we use MuSig2 protocol for multisignature? Citing BIP341: Why should the output key always have a taproot commitment, even if there is no script path? ...
Pieter Wuille's user avatar
1 vote

To what extent does BIP32 key derivation impact the design of secure key aggregation multisig and threshold schemes like MuSig and FROST?

Alternative answers as always are welcome. BIP340 does actually (at least partially) answer this. Key prefixes were included in the design of BIP340 Schnorr signatures as without them "related ...
Michael Folkson's user avatar
1 vote
Accepted

How do MuSig2 and FROST compare for multisig key aggregation schemes?

You would generally use MuSig2 for multisig key aggregation as it has fewer communication rounds (2) and less complexity than FROST. The additional complexity is illustrated in this graphic (shared by ...
Michael Folkson's user avatar
1 vote
Accepted

How do the various Lightning implementations treat latency? How long do they wait for a peer to provide a signature before using unhappy path?

This was discussed on the lightning-dev mailing list. Christian Decker stated: It is worth mentioning here that the LN protocol is generally not very latency sensitive, and from my experience can ...
Michael Folkson's user avatar
1 vote
Accepted

Can you do P2WSH / P2SH on Lightning Network (LN)?

I understand that a channel is a 2 of 2 multisig. Right, a channel according to the current Lightning protocol must be a 2-of-2 multisig. As far as the blockchain is concerned any funds moved from ...
Michael Folkson's user avatar
1 vote
Accepted

Taproot, potential quantum bug, and general clarification

See Pieter's responses. (1) seems ok (2) Mark's concern is real, but worry about exposing the tweaked pubkey doesn't seem to be of a high concern to people supporting Taproot. In ref to Taproot ...
Michael Tidwell's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible