MuSig: Three-Round Multiparty Schnorr Signature

By the end of this article, you will learn how Alice, Bob, and Carol can collaboratively sign a transaction using MuSig.

We’ll guide you through the process step by step, combining theory with practical code examples. Your ultimate goal will be to write

By the end, you’ll be able to write the code for generating this signature

1. Theory

To make this article simple to follow, we will answer three important questions that will help you understand the concept: What? Why? How?

MuSig is simply a protocol for aggregating public keys and signatures.

The reasons we use MuSig are:

Transaction Size/Fees: MuSig makes multi-sig look like single-sig. This means you pay the same fees whether one person or ten people sign.
Privacy: Nobody can tell if a transaction used multiple signers or just one. Your multi-sig setup stays private, as it looks identical to a regular transaction.

Now we need your focus here, please. Grab a coffee, and let's dive in.

Alice, Bob, and Carol want to create an aggregated signature such as:

s_agg = s_a + s_b + s_c

To create this signature, we need to go through three main steps:

Some of these steps require rounds of communication between participants:

Aggregating public keys does not require communication.
Aggregating nonces and signatures requires three rounds of communication (MuSig2 optimizes this to two rounds).

A naive way to do public key aggregation is by summing up each participant's public key:

P_agg = P_a + P_b + P_c

However, this approach is vulnerable to a key cancellation attack.