Member-only story
MuSig: A Secure Method of Merging Public Keys with a Single Signature
The Schnorr signature method supports the merging of public keys to produce a single signature for a transaction [Schnorr aggregate]. Unfortunately, it is not secure and suffers from the cancellation problem [here], but which can be overcome with the MuSig method or the BN Method [here]. In this article, we will simplify the method in order to illustrate how it works, and use just two signers (Bob and Alice). The MuSig method is outlined by Greg Maxwell et al in this paper [1][here]:
To sign a message, Bob takes his private key, a random value (r_i) and a message (msg), and produces a signature: (R, s). Initially, Bob generates a private key of x_1 and a public key of:
X_1=x_1 G
and where G is the base point on the curve (and where X_1 is a point on the curve). Alice will generate her private key (x_2) and a public key of:
X_2=x_2 G
We compute the hash of the merged public keys with:
L=H(X_1||X_2)
Now we can merge their public keys (X) to give:
