Hot answers tagged

7

The number of signers with MuSig (and MuSig2) is practically infinite. For example, creating a MuSig signature with 1 million signers takes about 130 seconds on my laptop (see https://github.com/jonasnick/musig-benchmark). However, MuSig(2) does not have the same functionality as OP_CHECKMULTISIG. MuSig only supports m = n which is the definition of "...


6

As far as I know, there is not even a published specification for MuSig2. One is being worked on at https://github.com/ElementsProject/secp256k1-zkp/blob/master/src/modules/musig/musig-spec.mediawiki, but it is incomplete and has no test vectors.


3

As Pieter Wuille states here key aggregation is completed at address creation time not at signing time or post signing time. Of course, key aggregation has an impact on the signing algorithm, and that's probably one of the main reasons why it's useful to do it before CISA: the work needed to support MuSig signing in wallet will take a while, but it's pretty ...


2

You are right. You could either use a leaf with a single aggregated key or a leaf with a more traditional multisig construction using OP_CHECKSIGADD. The advantage of the aggregated key is its smaller input saving fees. The disadvantage is that MuSig2 is an interactive protocol with multiple rounds which can be inconvenient if some of the signers are ...


1

This is exactly what a threshold signature scheme is: the ability to jointly (by interacting with a quorum of signers) produce a valid signature for a single public key that represents the threshold. The private key to that public key will not be constructed anywhere at any point in time. The details of how to construct that signature depend on the scheme ...


Only top voted, non community-wiki answers of a minimum length are eligible