<p>The number of signers with MuSig (and MuSig2) is practically infinite. For example, creating a MuSig signature with 1 million signers takes about 130 seconds on my laptop (see <a href="https://github.com/jonasnick/musig-benchmark" rel="noreferrer">https://github.com/jonasnick/musig-benchmark</a>).</p>
<p>However, MuSig(2) does not have the same functionality as <code>OP_CHECKMULTISIG</code>. MuSig only supports m = n which is the definition of &quot;multisignature&quot; outside the Bitcoin space. <code>OP_CHECKMULTISIG</code> supports m &lt;= n and is therefore more accurately referred to as &quot;threshold signature&quot;. There is a scheme called <a href="https://eprint.iacr.org/2020/852.pdf" rel="noreferrer">FROST</a> that allows creating threshold signatures that look like a single Schnorr signature and <a href="https://brink.dev/blog/2021/04/15/frost/" rel="noreferrer">ongoing work to implement it</a> for use in Bitcoin.</p>
<p>Note that <a href="https://github.com/bitcoin/bips/blob/master/bip-0342.mediawiki" rel="noreferrer">tapscript</a> disables <code>OP_CHECKMULTISIG</code> and instead introduces <code>OP_CHECKSIGADD</code>, which does not have the 20 signature limitiation.</p>

CC BY-SA 4.0
2021-06-14T17:05:02.877Z
2021-06-14T17:05:02.877Z
nickler
<p>With multisig, up to 20 signatures may be used in a threshold signature scheme (<a href="https://bitcoin.stackexchange.com/questions/23893/what-are-the-limits-of-m-and-n-in-m-of-n-multisig-addresses">What are the limits of m and n in m-of-n multisig addresses?</a>).</p>
<p>As far as I understand, there should be no hard-coded limit with MuSig, as to the blockchain every scheme would always look like just one single signature (from one single key-pair), even if in reality those were multiple signatures that just were aggregated into one.</p>
<p>Is there anything else that limits the amount of signatures that can be used with MuSig, or is this number of possible signatures essentially infinite?</p>

<multi-signature><schnorr-signatures><musig><key-aggregation>
Possible number of signers with MuSig
Dalit Sairio
# Possible number of signers with MuSig

(Asked by: username_0 on 2021-06-11)

With multisig, up to 20 signatures may be used in a threshold signature scheme ([What are the limits of m and n in m-of-n multisig addresses?](https://bitcoin.stackexchange.com/questions/23893/what-are-the-limits-of-m-and-n-in-m-of-n-multisig-addresses)).

As far as I understand, there should be no hard-coded limit with MuSig, as to the blockchain every scheme would always look like just one single signature (from one single key-pair), even if in reality those were multiple signatures that just were aggregated into one.

Is there anything else that limits the amount of signatures that can be used with MuSig, or is this number of possible signatures essentially infinite?

**Tags:** multi-signature, schnorr-signatures, musig, key-aggregation


---

## 1 answers

### Answer by username_1 on 2021-06-14. Score: 8 | Accepted answer

The number of signers with MuSig (and MuSig2) is practically infinite. For example, creating a MuSig signature with 1 million signers takes about 130 seconds on my laptop (see <https://github.com/jonasnick/musig-benchmark>).

However, MuSig(2) does not have the same functionality as `OP_CHECKMULTISIG`. MuSig only supports m = n which is the definition of "multisignature" outside the Bitcoin space. `OP_CHECKMULTISIG` supports m <= n and is therefore more accurately referred to as "threshold signature". There is a scheme called [FROST](https://eprint.iacr.org/2020/852.pdf) that allows creating threshold signatures that look like a single Schnorr signature and [ongoing work to implement it](https://brink.dev/blog/2021/04/15/frost/) for use in Bitcoin.

Note that [tapscript](https://github.com/bitcoin/bips/blob/master/bip-0342.mediawiki) disables `OP_CHECKMULTISIG` and instead introduces `OP_CHECKSIGADD`, which does not have the 20 signature limitiation.


---

