<!DOCTYPE html><htmllang="en"><head><metacharSet="utf-8"/><metahttp-equiv="X-UA-Compatible"content="IE=edge"/><title>MuSig · bitcoin-s</title><metaname="viewport"content="width=device-width, initial-scale=1.0"/><metaname="generator"content="Docusaurus"/><metaname="description"content="Bitcoin-S now has support for [MuSig](https://github.com/jonasnick/bips/blob/musig2/bip-musig2.mediawiki)."/><metaname="docsearch:version"content="next"/><metaname="docsearch:language"content="en"/><metaproperty="og:title"content="MuSig · bitcoin-s"/><metaproperty="og:type"content="website"/><metaproperty="og:url"content="https://bitcoin-s.org/"/><metaproperty="og:description"content="Bitcoin-S now has support for [MuSig](https://github.com/jonasnick/bips/blob/musig2/bip-musig2.mediawiki)."/><metaproperty="og:image"content="https://bitcoin-s.org/img/undraw_online.svg"/><metaname="twitter:card"content="summary"/><metaname="twitter:image"content="https://bitcoin-s.org/img/undraw_tweetstorm.svg"/><linkrel="shortcut icon"href="/img/favicon.ico"/><linkrel="stylesheet"href="https://cdn.jsdelivr.net/docsearch.js/1/docsearch.min.css"/><linkrel="stylesheet"href="//cdnjs.cloudflare.com/ajax/libs/highlight.js/9.12.0/styles/default.min.css"/><script>
function createToggler(togglerSelector, targetSelector, className) {
var toggler = document.querySelector(togglerSelector);
var target = document.querySelector(targetSelector);
if (!toggler) {
return;
}
toggler.onclick = function(event) {
event.preventDefault();
target.classList.toggle(className);
};
}
});
</script></nav></div><divclass="container mainContainer docsContainer"><divclass="wrapper"><divclass="post"><headerclass="postHeader"><aclass="edit-page-link button"href="https://github.com/bitcoin-s/bitcoin-s/blob/master/docs/crypto/musig.md"target="_blank"rel="noreferrer noopener">Edit</a><h1id="__docusaurus"class="postHeaderTitle">MuSig</h1></header><article><div><span><p>Bitcoin-S now has support for <ahref="https://github.com/jonasnick/bips/blob/musig2/bip-musig2.mediawiki">MuSig</a>.</p>
<p>This module contains classes representing public <code>KeySet</code>s, MuSig nonces, and MuSig aggregate key tweaks, as well as utility functions for all MuSig computations.</p>
<p>The functions for aggregating key data are:</p>
<ul>
<li><code>aggPubKey</code>
<ul>
<li>This is a member of <code>KeySet</code> and returns the aggregate public key for this set of signers, including the tweaks provided. In most uses, a subsequent call to <code>schnorrPublicKey</code> is required for Bitcoin applications.</li>
</ul></li>
<li><code>MuSigNoncePub.aggregate</code>
<ul>
<li>Given a <code>Vector[MuSigNoncePub]</code> of the signer's nonces, returns the aggregate <code>MuSigNoncePub</code>. This aggregation can be done before the message, or even the <code>KeySet</code> is known.</li>
</ul></li>
</ul>
<p>The functions for signing and verification are:</p>
<ul>
<li><code>MuSigUtil.sign</code>
<ul>
<li>This function generates a MuSig partial signature using a private key and <code>MuSigNoncePriv</code>. This consists of a pair <code>(R, s)</code> where <code>R</code> is the aggregate nonce key (same for all signers) and <code>s</code> is the actual partial signature that needs to be shared.</li>
</ul></li>
<li><code>MuSigUtil.partialSigVerify</code>
<ul>
<li>This function validates a single partial signature against that signer's public key and <code>MuSigNoncePub</code>.</li>
</ul></li>
<li><code>MuSigUtil.signAgg</code>
<ul>
<li>This function aggregates all of the <code>s</code> values into a single valid <code>SchnorrDigitalSignature</code> (using the aggregate nonce key <code>R</code>).</li>
</ul></li>
</ul>
<p>Note that no new function is required for aggregate verification as <code>SchnorrPublicKey</code>'s <code>verify</code> function is to be used.</p>
<p>Lastly, it should be mentioned that <code>MuSigNoncePriv</code>s must be constructed using either <code>MuSigNoncePriv.gen</code> or <code>MuSigNoncePriv.genInternal</code> (the latter should only be used with 32 bytes of secure random entropy). These generation functions take as input any context information that is available at nonce generation time, namely your signing key, aggregate public key, message, and any extra bytes you may have available. Including these optional inputs improves the security of nonce generation (which must be absolutely secure).</p>
<p>The following code shows a two-party MuSig execution:</p>
<pre><codeclass="hljs css language-scala"><spanclass="hljs-comment">// Alice and Bob generate and exchange nonce data (new nonces for every sig)</span>
<spanclass="hljs-keyword">val</span> keySet = <spanclass="hljs-type">KeySet</span>(pubKeys, tweaks) <spanclass="hljs-comment">// This is where you put MuSigTweaks</span>
