BIP 328: Derivation Scheme for MuSig2 Aggregate Keys

0328 - Proposed - Informational - June 4, 2024 (2 years, 1 month ago)

Number
328
Status
Proposed
Type
Informational
Created
June 4, 2024
License
CC0-1.0

June

4

2024

  BIP: 328
Layer: Applications
Title: Derivation Scheme for MuSig2 Aggregate Keys
Author: Ava Chow <[email protected]>
Comments-Summary: No comments yet.
Comments-URI: https://github.com/bitcoin/bips/wiki/Comments:BIP 328
Status: Proposed
Type: Informational
Created: 2024-06-04
License: CC0-1.0

Abstract

This document specifies how BIP 32 extended public keys can be constructed from a BIP 327 MuSig2 aggregate public key and how such keys should be used for key derivation.

This BIP is licensed under the Creative Commons CC0 1.0 Universal license.

Motivation

Multiple signers can create a single aggregate public key with MuSig2 that is indistinguishable from a random public key. The cosigners need a method for generating additional aggregate pubkeys to follow the best practice of using a new address for every payment.

The obvious method is for the cosigners to generate multiple public keys and produce a new aggregate pubkey every time one is needed. This is similar to how multisig using Bitcoin script works where all of the cosigners share their extended public keys and do derivation to produce the multisig script. The same could be done with MuSig2 and instead of producing a multisig script, the result would be a MuSig2 aggregate pubkey.

However, it is much simpler to be able to derive from a single extended public key instead of having to derive from many extended public keys and aggregate them. As MuSig2 produces a normal looking public key, the aggregate public can be used in this way. This reduces the storage and computation requirements for generating new aggregate pubkeys.

Specification

A synthetic xpub can be created from a BIP 327 MuSig2 plain aggregate public key by setting the depth to 0, the child number to 0, and attaching a chaincode with the byte string 868087ca02a6f974c4598924c36b57762d32cb45717167e300622c7167e38965 1 . This fixed chaincode should be used by all such synthetic xpubs following this specification. Unhardened child public keys can be derived from the synthetic xpub as with any other xpub. Since the aggregate public key is all that is necessary to produce the synthetic xpub, any aggregate public key that will be used in this way shares the same privacy concerns as typical xpubs.

Furthermore, as there is no aggregate private key, only unhardened derivation from the aggregate public key is possible.

When signing, all signers must compute the tweaks used in the BIP 32 derivation for the child key being signed for. The I L value computed in CKDpub is the tweak used at each derivation step. These are provided in the session context, each with a tweak mode of plain ( is_xonly_t = false ). When the Sign algorithm is used, the tweaks will be applied to the partial signatures.

Test Vectors

  • Aggregate pubkey 0354240c76b8f2999143301a99c7f721ee57eee0bce401df3afeaa9ae218c70f23
    • Synthetic xpub xpub661MyMwAqRbcFt6tk3uaczE1y6EvM1TqXvawXcYmFEWijEM4PDBnuCXwwXEKGEouzXE6QLLRxjatMcLLzJ5LV5Nib1BN7vJg6yp45yHHRbm
    • Keys:
      • 03935F972DA013F80AE011890FA89B67A27B7BE6CCB24D3274D18B2D4067F261A9
      • 02F9308A019258C31049344F85F89D5229B531C845836F99B08601F113BCE036F9
  • Aggregate pubkey 0290539eede565f5d054f32cc0c220126889ed1e5d193baf15aef344fe59d4610c
    • Synthetic xpub xpub661MyMwAqRbcFt6tk3uaczE1y6EvM1TqXvawXcYmFEWijEM4PDBnuCXwwVk5TFJk8Tw5WAdV3DhrGfbFA216sE9BsQQiSFTdudkETnKdg8k
    • Keys:
      • 02F9308A019258C31049344F85F89D5229B531C845836F99B08601F113BCE036F9
      • 03DFF1D77F2A671C5F36183726DB2341BE58FEAE1DA2DECED843240F7B502BA659
      • 023590A94E768F8E1815C2F24B4D80A8E3149316C3518CE7B7AD338368D038CA66
  • Aggregate pubkey 022479f134cdb266141dab1a023cbba30a870f8995b95a91fc8464e56a7d41f8ea
    • Synthetic xpub xpub661MyMwAqRbcFt6tk3uaczE1y6EvM1TqXvawXcYmFEWijEM4PDBnuCXwwUvaZYpysLX4wN59tjwU5pBuDjNrPEJbfxjLwn7ruzbXTcUTHkZ
    • Keys:
      • 02DFF1D77F2A671C5F36183726DB2341BE58FEAE1DA2DECED843240F7B502BA659
      • 023590A94E768F8E1815C2F24B4D80A8E3149316C3518CE7B7AD338368D038CA66
      • 02F9308A019258C31049344F85F89D5229B531C845836F99B08601F113BCE036F9
      • 03935F972DA013F80AE011890FA89B67A27B7BE6CCB24D3274D18B2D4067F261A9

Backwards Compatibility

Once a synthetic xpub is created, it is fully backwards compatible with BIP 32 - only unhardened derivation can be done, and the signers will be able to produce a signature for any derived children.

Rationale

Reference Implementation

A Python reference implementation is available in this BIP's Auxiliary Files .

Acknowledgements

Thanks to Pieter Wuille, Andrew Poelstra, Sanket Kanjalkar, Salvatore Ingala, and all others who participated in discussions on this topic.

  1. Where does this constant chaincode come from? It is the SHA256 of the text MuSig2MuSig2MuSig2 ↩︎

View on GitHub

Authors

Ava Chow