Hot answers tagged

13 votes
Accepted

Musig Signature Interactivity

MuSig is interactive because each signer needs to provide a signature nonce (effectively randomness) before signing. This is not specific to MuSig, but applies to any discrete logarithm-based ...
user avatar
  • 726
7 votes
Accepted

Possible number of signers with MuSig

The number of signers with MuSig (and MuSig2) is practically infinite. For example, creating a MuSig signature with 1 million signers takes about 130 seconds on my laptop (see https://github.com/...
user avatar
  • 726
6 votes
Accepted

Where can I get some MuSig2 test vectors?

As far as I know, there is not even a published specification for MuSig2. One is being worked on at https://github.com/ElementsProject/secp256k1-zkp/blob/master/doc/musig-spec.mediawiki, but it is ...
user avatar
5 votes
Accepted

Does MuSig have the same security as 2-2 multisig?

Yes or no, depending on your definition. You are right that the expected time to forge a 2-of-2 multisignature is twice that of a single signature, because you obviously need to use your forger ...
user avatar
5 votes
Accepted

Can R/r in Musig be derived from only seeds and message hashes?

The construction you're suggesting will likely work as long as you don't sign more than one message. By effectively choosing the R points ahead of time, you've constructed a single-show signature. ...
user avatar
4 votes
Accepted

Why is Public Key aggregation in MuSig described as a product of the public keys?

This is purely a matter of notation. The points on the elliptic curve form a cyclic group. A group is a set with an associated identity element and a group operation. People need a symbol for that ...
user avatar
3 votes
Accepted

What is the difference between key aggregation and signature aggregation?

As Pieter Wuille states here key aggregation is completed at address creation time not at signing time or post signing time. Of course, key aggregation has an impact on the signing algorithm, and ...
user avatar
3 votes
Accepted

With MuSig2 can we now avoid any privacy leak of a Lightning channel's onchain UTXO?

Assuming MuSig(2) is implemented on the Lightning Network protocol a 2-of-2 multisignature spend will look like a single signature spend on the blockchain. Hence the Lightning channel footprint on the ...
user avatar
3 votes
Accepted

Who will the first adopters of Taproot be (assuming it is activated at some stage)? What incentives are there to start using it straight away?

(A 2-of-2, 3-of-3, n-of-n will be referred to as a multisig scheme and a 1-of-2, 2-of-3, k-of-n where k < n will be referred to as a threshold scheme) The most significant incentives for using ...
user avatar
2 votes
Accepted

In MuSig-DN why not use a truly random number for the nonce instead of a pseudorandom function?

This question was answered by Tim Ruffing on Twitter. The answer is simply that it's not easy to get truly random numbers right in practice. For example, you need to collect entropy in your system, ...
user avatar
2 votes
Accepted

Which MuSig scheme is optimal? Classic MuSig or this new MuSig-DN scheme?

Firstly, it is worth emphasizing that both classic MuSig (referred to here as "MuSig") and MuSig-DN are relatively new cryptographic schemes and the paper for MuSig-DN is fresh off the ...
user avatar
2 votes

Schnorr without R in the challenge

So the scheme you suggest is that signatures are pairs (R, s) such that sG = R + H(P,m)P, where P is the public key, and m is the message. Pick a random s. Set R = sG - H(P,m)P. (R,s) is now a valid ...
user avatar
2 votes
Accepted

Is Z-man's PTLC construction implementable using libsecp256k1-zkp?

My question is whether this MusigTweak is what is called the adaptor (last argument of secp256k1_musig_session_combine_nonces) in secp256k1-zkp? No, what "Z-man" refers to as MusigTweak is not called ...
user avatar
  • 726
2 votes

How to spend a taproot output using key path with a threshold signature scheme when the secret key is never computed?

This is exactly what a threshold signature scheme is: the ability to jointly (by interacting with a quorum of signers) produce a valid signature for a single public key that represents the threshold. ...
user avatar
2 votes
Accepted

Using key aggregation (multsig) in P2TR script path spends

You are right. You could either use a leaf with a single aggregated key or a leaf with a more traditional multisig construction using OP_CHECKSIGADD. The advantage of the aggregated key is its smaller ...
user avatar
  • 62.3k
1 vote
Accepted

Taproot, potential quantum bug, and general clarification

See Pieter's responses. (1) seems ok (2) Mark's concern is real, but worry about exposing the tweaked pubkey doesn't seem to be of a high concern to people supporting Taproot. In ref to Taproot ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible