Hot answers tagged

13

MuSig is interactive because each signer needs to provide a signature nonce (effectively randomness) before signing. This is not specific to MuSig, but applies to any discrete logarithm-based multisignature scheme as far as I know. Now to understand why multiple communication rounds are necessary let's look at what happens at each of them, starting from the ...


6

As far as I know, there is not even a published specification for MuSig2. One is being worked on at https://github.com/ElementsProject/secp256k1-zkp/blob/master/src/modules/musig/musig-spec.mediawiki, but it is incomplete and has no test vectors.


6

The number of signers with MuSig (and MuSig2) is practically infinite. For example, creating a MuSig signature with 1 million signers takes about 130 seconds on my laptop (see https://github.com/jonasnick/musig-benchmark). However, MuSig(2) does not have the same functionality as OP_CHECKMULTISIG. MuSig only supports m = n which is the definition of "...


5

Yes or no, depending on your definition. You are right that the expected time to forge a 2-of-2 multisignature is twice that of a single signature, because you obviously need to use your forger algorithm twice. However, in practice such constant factors are ignored when describing security levels. For example, typically ed25519 and secp256k1 are placed in ...


5

The construction you're suggesting will likely work as long as you don't sign more than one message. By effectively choosing the R points ahead of time, you've constructed a single-show signature. However, the derivation you're using for the different R values is pointless. It's not enough that you don't reuse R values; you can't use multiple related R ...


3

As Pieter Wuille states here key aggregation is completed at address creation time not at signing time or post signing time. Of course, key aggregation has an impact on the signing algorithm, and that's probably one of the main reasons why it's useful to do it before CISA: the work needed to support MuSig signing in wallet will take a while, but it's pretty ...


3

(A 2-of-2, 3-of-3, n-of-n will be referred to as a multisig scheme and a 1-of-2, 2-of-3, k-of-n where k < n will be referred to as a threshold scheme) The most significant incentives for using Taproot (in terms of reducing transaction fees) exist for those who are using either multisignature/threshold schemes (the larger the multisig the larger the ...


3

This is purely a matter of notation. The points on the elliptic curve form a cyclic group. A group is a set with an associated identity element and a group operation. People need a symbol for that group operation. In some contexts it is more common to use an addition symbol (and multiplication representing repeated application of the group operation), and in ...


2

This question was answered by Tim Ruffing on Twitter. The answer is simply that it's not easy to get truly random numbers right in practice. For example, you need to collect entropy in your system, and it's hard to write a "test" that checks if your numbers are really random. Broken random number generators have led to numerous real-world failures ...


2

Firstly, it is worth emphasizing that both classic MuSig (referred to here as "MuSig") and MuSig-DN are relatively new cryptographic schemes and the paper for MuSig-DN is fresh off the presses at the time of writing (September 2020) with no current implementation. So use both at your own risk but even more so for MuSig-DN. The MuSig paper needed to ...


2

So the scheme you suggest is that signatures are pairs (R, s) such that sG = R + H(P,m)P, where P is the public key, and m is the message. Pick a random s. Set R = sG - H(P,m)P. (R,s) is now a valid signature for P, without knowing the corresponding private key. So this is a trivially forgeable signature scheme. In ECDSA, the extraction of R's x coordinate, ...


2

My question is whether this MusigTweak is what is called the adaptor (last argument of secp256k1_musig_session_combine_nonces) in secp256k1-zkp? No, what "Z-man" refers to as MusigTweak is not called the adaptor in secp256k1-zkp. The difference between the normal MuSig ritual and the "almost entirely MuSig" ritual is not the MuSigTweak. The MuSigTweak just ...


2

You are right. You could either use a leaf with a single aggregated key or a leaf with a more traditional multisig construction using OP_CHECKSIGADD. The advantage of the aggregated key is its smaller input saving fees. The disadvantage is that MuSig2 is an interactive protocol with multiple rounds which can be inconvenient if some of the signers are ...


1

This is exactly what a threshold signature scheme is: the ability to jointly (by interacting with a quorum of signers) produce a valid signature for a single public key that represents the threshold. The private key to that public key will not be constructed anywhere at any point in time. The details of how to construct that signature depend on the scheme ...


Only top voted, non community-wiki answers of a minimum length are eligible