BIP 0327 - Revision history

934: Update BIP text with latest version from https://github.com/bitcoin/bips/blob/83a1afd985984862/bip-0327.mediawiki

2024-10-09T19:23:30Z

Update BIP text with latest version from https://github.com/bitcoin/bips/blob/83a1afd985984862/bip-0327.mediawiki

← Older revision		Revision as of 19:23, 9 October 2024
Line 193:		Line 193:
	In order to apply a tweak, the KeyAgg Context output by ''KeyAgg'' is provided to the ''ApplyTweak'' algorithm with the ''is_xonly_t'' argument set to false for plain tweaking and true for X-only tweaking.		In order to apply a tweak, the KeyAgg Context output by ''KeyAgg'' is provided to the ''ApplyTweak'' algorithm with the ''is_xonly_t'' argument set to false for plain tweaking and true for X-only tweaking.
	The resulting KeyAgg Context can be used to apply another tweak with ''ApplyTweak'' or obtain the aggregate public key with ''GetXonlyPubkey'' or ''GetPlainPubkey''.		The resulting KeyAgg Context can be used to apply another tweak with ''ApplyTweak'' or obtain the aggregate public key with ''GetXonlyPubkey'' or ''GetPlainPubkey''.

	~~In addition to individual public keys, the ''KeyAgg'' algorithm accepts tweaks, which modify the aggregate public key as defined in the [[#tweaking-definition\|Tweaking Definition]] subsection.~~
	For example, if ''KeyAgg'' is run with ''v = 2'', ''is_xonly_t<sub>1</sub> = false'', ''is_xonly_t<sub>2</sub> = true'', then the aggregate key is first plain tweaked with ''tweak<sub>1</sub>'' and then X-only tweaked with ''tweak<sub>2</sub>''.

	The purpose of supporting tweaking is to ensure compatibility with existing uses of tweaking, i.e., that the result of signing is a valid signature for the tweaked public key.		The purpose of supporting tweaking is to ensure compatibility with existing uses of tweaking, i.e., that the result of signing is a valid signature for the tweaked public key.
Line 626:		Line 623:
	* For ''i = 1 .. v'':		* For ''i = 1 .. v'':
	** Let ''keyagg_ctx<sub>i</sub> = ApplyTweak(keyagg_ctx<sub>i-1</sub>, tweak<sub>i</sub>, is_xonly_t<sub>i</sub>)''; fail if that fails		** Let ''keyagg_ctx<sub>i</sub> = ApplyTweak(keyagg_ctx<sub>i-1</sub>, tweak<sub>i</sub>, is_xonly_t<sub>i</sub>)''; fail if that fails
	* Let ''aggpk = ~~GetPubkey~~(keyagg_ctx<sub>v</sub>)''		* Let ''aggpk = GetXonlyPubkey(keyagg_ctx<sub>v</sub>)''
	* Let ''k<sub>i</sub> = int(hash<sub>MuSig/deterministic/nonce</sub>(sk' \|\| aggothernonce \|\| aggpk \|\| bytes(8, len(m)) \|\| m \|\| bytes(1, i - 1))) mod n'' for ''i = 1,2''		* Let ''k<sub>i</sub> = int(hash<sub>MuSig/deterministic/nonce</sub>(sk' \|\| aggothernonce \|\| aggpk \|\| bytes(8, len(m)) \|\| m \|\| bytes(1, i - 1))) mod n'' for ''i = 1,2''
	* Fail if ''k<sub>1</sub> = 0'' or ''k<sub>2</sub> = 0''		* Fail if ''k<sub>1</sub> = 0'' or ''k<sub>2</sub> = 0''
Line 789:		Line 786:
	The <code>PATCH</code> version is incremented for other changes that are noteworthy (bug fixes, test vectors, important clarifications, etc.).		The <code>PATCH</code> version is incremented for other changes that are noteworthy (bug fixes, test vectors, important clarifications, etc.).

			* '''1.0.2''' (2024-07-22):
			** Fix minor bug in the specification of ''DeterministicSign'' and add small improvement to a ''PartialSigAgg'' test vector.
	* '''1.0.1''' (2024-05-14):		* '''1.0.1''' (2024-05-14):
	** Fix minor issue in ''PartialSigVerify'' vectors.		** Fix minor issue in ''PartialSigVerify'' vectors.
Line 832:		Line 831:
	== Acknowledgements ==		== Acknowledgements ==

	We thank Brandon Black, Riccardo Casatta, Lloyd Fournier, Russell O'Connor, and Pieter Wuille for their contributions to this document.		We thank Brandon Black, Riccardo Casatta, Sivaram Dhakshinamoorthy, Lloyd Fournier, Russell O'Connor, and Pieter Wuille for their contributions to this document.

934: Update BIP text with latest version from https://github.com/bitcoin/bips/blob/758a58ab54fddce0/bip-0327.mediawiki

2024-05-29T04:28:43Z

Update BIP text with latest version from https://github.com/bitcoin/bips/blob/758a58ab54fddce0/bip-0327.mediawiki

← Older revision		Revision as of 04:28, 29 May 2024
Line 558:		Line 558:
	(see [https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2022-October/021000.html bitcoin-dev mailing list post] and [https://github.com/jonasnick/musig2-tweaking writeup] for details).		(see [https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2022-October/021000.html bitcoin-dev mailing list post] and [https://github.com/jonasnick/musig2-tweaking writeup] for details).

	Checking ''pk'' against ''~~InvidualPubkey~~(sk)'' is a simple way to ensure		Checking ''pk'' against ''IndividualPubkey(sk)'' is a simple way to ensure
	that the secret key provided to ''Sign'' is fully determined already when ''NonceGen'' is invoked.		that the secret key provided to ''Sign'' is fully determined already when ''NonceGen'' is invoked.
	This removes the adversary's ability to influence the secret key after having seen the ''pubnonce''		This removes the adversary's ability to influence the secret key after having seen the ''pubnonce''

934: Update BIP text with latest version from https://github.com/bitcoin/bips/blob/96161aeaf5cef975/bip-0327.mediawiki

2024-05-14T09:27:08Z

Update BIP text with latest version from https://github.com/bitcoin/bips/blob/96161aeaf5cef975/bip-0327.mediawiki

← Older revision		Revision as of 09:27, 14 May 2024
Line 789:		Line 789:
	The <code>PATCH</code> version is incremented for other changes that are noteworthy (bug fixes, test vectors, important clarifications, etc.).		The <code>PATCH</code> version is incremented for other changes that are noteworthy (bug fixes, test vectors, important clarifications, etc.).

			* '''1.0.1''' (2024-05-14):
			** Fix minor issue in ''PartialSigVerify'' vectors.
	* '''1.0.0''' (2023-03-26):		* '''1.0.0''' (2023-03-26):
	** Number 327 was assigned to this BIP.		** Number 327 was assigned to this BIP.

934: Update BIP text with latest version from https://github.com/bitcoin/bips/blob/c66583158b9cde82/bip-0327.mediawiki

2024-04-22T16:57:44Z

Update BIP text with latest version from https://github.com/bitcoin/bips/blob/c66583158b9cde82/bip-0327.mediawiki

934: Update BIP text with latest version from https://github.com/bitcoin/bips/blob/b3144df7aded3c65/bip-0327.mediawiki

2023-03-29T09:46:16Z

Update BIP text with latest version from https://github.com/bitcoin/bips/blob/b3144df7aded3c65/bip-0327.mediawiki

← Older revision		Revision as of 09:46, 29 March 2023
Line 14:		Line 14:
	Post-History: 2022-04-05: https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2022-April/020198.html [bitcoin-dev] MuSig2 BIP		Post-History: 2022-04-05: https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2022-April/020198.html [bitcoin-dev] MuSig2 BIP
	2022-10-11: https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2022-October/021000.html [bitcoin-dev] MuSig2 BIP		2022-10-11: https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2022-October/021000.html [bitcoin-dev] MuSig2 BIP
			Comments-URI: https://github.com/bitcoin/bips/wiki/Comments:BIP-0327
	</pre>		</pre>

934: Update BIP text with latest version from https://github.com/bitcoin/bips/blob/67a42fe828fc4307/bip-0327.mediawiki

2023-03-27T10:59:46Z

Update BIP text with latest version from https://github.com/bitcoin/bips/blob/67a42fe828fc4307/bip-0327.mediawiki

Show changes

← Older revision		Revision as of 16:57, 22 April 2024
Line 127:		Line 127:
	In fact, applications are recommended to omit checks for duplicate individual public keys in order to simplify error handling.		In fact, applications are recommended to omit checks for duplicate individual public keys in order to simplify error handling.
	Moreover, it is often impossible to tell at key aggregation which signer is to blame for the duplicate, i.e., which signer came up with an individual public key honestly and which disruptive signer copied it.		Moreover, it is often impossible to tell at key aggregation which signer is to blame for the duplicate, i.e., which signer came up with an individual public key honestly and which disruptive signer copied it.
	In contrast, MuSig2 is designed to identify disruptive signers at signing time (see [[#~~identifiying~~-disruptive-signers\|~~Identifiying~~ Disruptive Signers]]).		In contrast, MuSig2 is designed to identify disruptive signers at signing time (see [[#identifying-disruptive-signers\|Identifying Disruptive Signers]]).

	While the algorithms in this proposal are able to handle duplicate individual public keys, there are scenarios where applications may choose to abort when encountering duplicates.		While the algorithms in this proposal are able to handle duplicate individual public keys, there are scenarios where applications may choose to abort when encountering duplicates.
Line 215:		Line 215:
	The following specification of the algorithms has been written with a focus on clarity.		The following specification of the algorithms has been written with a focus on clarity.
	As a result, the specified algorithms are not always optimal in terms of computation and space.		As a result, the specified algorithms are not always optimal in terms of computation and space.
	In particular, some values are recomputed but can be cached in actual implementations (see [[#signing-flow\|Signing Flow]]).		In particular, some values are recomputed but can be cached in actual implementations (see [[#general-signing-flow\|General Signing Flow]]).

	=== Notation ===		=== Notation ===
Line 371:		Line 371:
	* Inputs:		* Inputs:
	** The secret signing key ''sk'': a 32-byte array (optional argument)		** The secret signing key ''sk'': a 32-byte array (optional argument)
	** The individual public key ''pk'': a 33-byte array (see [[#~~modifications~~-to-~~nonce~~-~~generation~~\|~~Modifications to Nonce Generation~~]] for the reason that this argument is mandatory)		** The individual public key ''pk'': a 33-byte array (see [[#signing-with-tweaked-individual-keys\|Signing with Tweaked Individual Keys]] for the reason that this argument is mandatory)
	** The x-only aggregate public key ''aggpk'': a 32-byte array (optional argument)		** The x-only aggregate public key ''aggpk'': a 32-byte array (optional argument)
	** The message ''m'': a byte array (optional argument)<ref name="mlen">In theory, the allowed message size is restricted because SHA256 accepts byte strings only up to size of 2^61-1 bytes (and because of the 8-byte length encoding).</ref>		** The message ''m'': a byte array (optional argument)<ref name="mlen">In theory, the allowed message size is restricted because SHA256 accepts byte strings only up to size of 2^61-1 bytes (and because of the 8-byte length encoding).</ref>
Line 469:		Line 469:
	* Let ''a = GetSessionKeyAggCoeff(session_ctx, P)''; fail if that fails<ref>Failing ''Sign'' when ''GetSessionKeyAggCoeff(session_ctx, P)'' fails is not necessary for unforgeability. It merely indicates to the caller that the scheme is not being used correctly.</ref>		* Let ''a = GetSessionKeyAggCoeff(session_ctx, P)''; fail if that fails<ref>Failing ''Sign'' when ''GetSessionKeyAggCoeff(session_ctx, P)'' fails is not necessary for unforgeability. It merely indicates to the caller that the scheme is not being used correctly.</ref>
	* Let ''g = 1'' if ''has_even_y(Q)'', otherwise let ''g = -1 mod n''		* Let ''g = 1'' if ''has_even_y(Q)'', otherwise let ''g = -1 mod n''
	* <div id="Sign negation"></div>Let ''d = g⋅gacc⋅d' mod n'' (See [[negation-of-the-secret-key-when-signing\|Negation Of The Secret Key When Signing]])		* <div id="Sign negation"></div>Let ''d = g⋅gacc⋅d' mod n'' (See [[#negation-of-the-secret-key-when-signing\|Negation Of The Secret Key When Signing]])
	* Let ''s = (k<sub>1</sub> + b⋅k<sub>2</sub> + e⋅a⋅d) mod n''		* Let ''s = (k<sub>1</sub> + b⋅k<sub>2</sub> + e⋅a⋅d) mod n''
	* Let ''psig = bytes(32, s)''		* Let ''psig = bytes(32, s)''