Skip to content
ecdsa.com

MuSig2

The two-round multi-signature scheme of BIP-327 in which n signers jointly produce one BIP-340 Schnorr signature valid under a single aggregate public key, indistinguishable on-chain from a single-signer spend.
Also written asMuSig2BIP-327multi-signature aggregation

Key aggregation combines the participants' public keys with per-key coefficients to stop rogue-key attacks. Each signer first sends two public nonces (this round can be done in advance), then partial signatures, which anyone can add up. Nonces must never be reused or derived deterministically from the message alone; BIP-327 specifies nonce generation, and reuse leaks a signer's key.

MuSig2 is n-of-n. For t-of-n use FROST or Taproot script paths with several keys. Coordination (nonce exchange, PSBT fields from BIP-373) is the hard part in practice, and hardware-wallet support is still limited.

Standards and references

All terms