View source for MuSig

'''MuSig''' is a family of interactive multi-signature protocols that aggregate several public keys into one and produce a single BIP340 Schnorr-compatible signature for that aggregate. On Bitcoin the result can look like an ordinary single-key [[Taproot]] key-path spend. The Bitcoin-relevant construction is '''MuSig2''', standardized in [https://github.com/bitcoin/bips/blob/master/bip-0327.mediawiki BIP327]. It is an n-of-n scheme: every listed key must participate. Threshold k-of-n signing is a different design family (for example FROST), not MuSig2.

Script-based n-of-n multisignature reveals the number of keys and needs one signature per key. Schnorr linearity lets keys be aggregated so one joint signature covers the set. The original MuSig scheme (often called MuSig1) needed three communication rounds. MuSig2, published by Jonas Nick, Tim Ruffing, and collaborators, reduces signing to two rounds. BIP327 standardizes encodings, nonce generation, BIP32 and Taproot tweaks, and partial-signature checks so independent wallets can cosign the same Taproot key-path spend.

Each signer contributes a fresh public nonce, then a partial signature. Partial signatures combine into one 64-byte BIP340 signature. Reusing a secret nonce across sessions can leak the key. An optional untrusted aggregator can collect nonces and partials to cut communication cost. It may abort but cannot forge a valid aggregate signature alone.

== See also ==
* [[Taproot]]
* [[Multi-signature]]
* [[Lightning Network]]

== External links ==
* [https://github.com/bitcoin/bips/blob/master/bip-0327.mediawiki BIP327: MuSig2 for BIP340-compatible multi-signatures]
* [https://eprint.iacr.org/2020/1261.pdf MuSig2 paper (IACR ePrint 2020/1261)]
* [https://eprint.iacr.org/2018/068.pdf MuSig paper (IACR ePrint 2018/068)]
* [https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki BIP340: Schnorr signatures for secp256k1]

[[Category:Technical]]