MuSig2 (BIP327)

MuSig2, standardized in BIP327 (merged into the BIPs repository in 2023), is a multi-signature scheme that lets several parties combine their public keys into one aggregate key and then cooperatively produce a single ordinary Schnorr signature valid under that key. To the Bitcoin network, a MuSig2 spend is indistinguishable from a payment made by one person with one key. That is the headline property: multi-party custody with no on-chain fingerprint at all.

n-of-n, not threshold

MuSig2 is an n-of-n scheme: every listed participant must sign, or no signature exists. It is not by itself a t-of-n threshold scheme like a 2-of-3. In practice the two compose elegantly through Taproot: put the happy-path signer set behind the key path as a MuSig2 aggregate, and express fallback policies — different quorums, timelocked recovery keys — as script leaves committed via the Taproot tweak. Cooperative spends stay maximally cheap and private; the contingency plans surface on-chain only if actually used. This division of labor is exactly what Taproot (BIP341) was designed to enable.

Two rounds, and why nonces are the hard part

MuSig2's headline improvement over the original MuSig is reducing signing from three communication rounds to two — and the first round can be pre-processed before the message to sign is even known, making signing effectively non-interactive in the common case. That matters when co-signers coordinate over slow or high-latency links such as Tor. The engineering subtlety hides in the nonces: in any Schnorr-family scheme, reusing or biasing a nonce leaks the private key, and naive multi-party nonce handling is exploitable. MuSig2 has each signer contribute two nonce points, combined with a coefficient derived from all inputs, which is precisely what defeats those attacks while keeping only two rounds. The BIP327 specification is correspondingly insistent on state handling — fresh nonces per session, never persisted, never reused — and good wallet implementations treat that as law. The scheme carries a security proof under the algebraic one-more discrete logarithm (AOMDL) assumption.

What self-custodians gain

Compared to script-based multisig, which publishes its policy — every key, the threshold, the whole arrangement — a MuSig2 output is one public key and one signature on-chain. The wins compound: privacy, because nobody can identify multi-party wallets to target, and everyone shares one uniform anonymity set; fees, because one signature is far smaller than several plus a script; and verification cost, because nodes check one Schnorr signature regardless of how many people stand behind it. The scheme was specified by Jonas Nick, Tim Ruffing, and Elliott Jin, building on a long line of Schnorr multi-signature research. For a family securing savings or partners sharing a treasury, MuSig2 makes shared control cheap and invisible — collaborative custody that looks like a hermit's wallet. See also Elliptic Curve Diffie-Hellman (ECDH) for related key-combination machinery, and self-custody for the principles this all serves.