<blockquote>
<p>I wonder, could the public nonce list be generated from a chain code in the same manner that BIP-32 allows a list of public keys to be generated?</p>
</blockquote>
<p><strong>Absolutely not.</strong> (private) nonces need to be entirely unpredictable to other participants. If your (public) nonces are generated according to a publicly (to other participants) known xpub, that implies a known relation between the corresponding private nonces. This <em>completely</em> breaks the security of MuSig and related schemes. The other participants will be able to compute your private key after seeing a few partial signatures.</p>
<p>There does exist a scheme that combines MuSig with deterministic nonces, called <a href="https://eprint.iacr.org/2020/1057" rel="noreferrer">MuSig-DN</a> (disclaimer: I'm a co-author). It is significantly more complex than just a publicly derivable set of nonces however, and involves zero-knowledge proofs where participants prove to each other their nonces were generated honestly.</p>

CC BY-SA 4.0
2022-08-25T23:46:23.643Z
2022-08-26T00:49:17.363Z
2022-08-26T00:49:17.363Z
Pieter Wuille
<p>I am interested in the case where a fixed pool of signers will sign a series of many messages.  As I understand it, musig2 would allow pre-processing, whereby a signature aggregator could collect a list of public nonce pairs from each signer in advance, and then consume one pair from each signer for each message to sign.  Signers would need to save the private key associated with each public nonce, and the aggregator would need to signal which one to use for each signature.</p>
<p>I wonder, could the public nonce list be generated from a chain code in the same manner that BIP-32 allows a list of public keys to be generated?  So, signers would commit to &quot;extended public nonces&quot; (R,c),(S,d), and then the signature aggregator would include a sequence number with each message, to define the nonce key pair in the manner of BIP-32?  Or, better, could the BIP-32 sequence number be replaced with some deterministic function of the message being signed?</p>

CC BY-SA 4.0
2022-08-27T11:20:26.553Z
See my comment here https://bitcoin.stackexchange.com/questions/110811/why-is-it-important-that-nonces-when-signing-not-be-related/110814#comment125641_110814
real-or-random
<multi-signature><bip32-hd-wallets><musig>
musig2 with BIP-32 style nonce chain
user1055568
# musig2 with BIP-32 style nonce chain

(Asked by: username_0 on 2022-08-25)

I am interested in the case where a fixed pool of signers will sign a series of many messages. As I understand it, musig2 would allow pre-processing, whereby a signature aggregator could collect a list of public nonce pairs from each signer in advance, and then consume one pair from each signer for each message to sign. Signers would need to save the private key associated with each public nonce, and the aggregator would need to signal which one to use for each signature.

I wonder, could the public nonce list be generated from a chain code in the same manner that BIP-32 allows a list of public keys to be generated? So, signers would commit to "extended public nonces" (R,c),(S,d), and then the signature aggregator would include a sequence number with each message, to define the nonce key pair in the manner of BIP-32? Or, better, could the BIP-32 sequence number be replaced with some deterministic function of the message being signed?

**Tags:** multi-signature, bip32-hd-wallets, musig

> **Comments:**
> **username_1**: See my comment here https://bitcoin.stackexchange.com/questions/110811/why-is-it-important-that-nonces-when-signing-not-be-related/110814#comment125641_110814  

---

## 1 answers

### Answer by username_2 on 2022-08-25. Score: 7 | Accepted answer

> I wonder, could the public nonce list be generated from a chain code in the same manner that BIP-32 allows a list of public keys to be generated?

**Absolutely not.** (private) nonces need to be entirely unpredictable to other participants. If your (public) nonces are generated according to a publicly (to other participants) known xpub, that implies a known relation between the corresponding private nonces. This *completely* breaks the security of MuSig and related schemes. The other participants will be able to compute your private key after seeing a few partial signatures.

There does exist a scheme that combines MuSig with deterministic nonces, called [MuSig-DN](https://eprint.iacr.org/2020/1057) (disclaimer: I'm a co-author). It is significantly more complex than just a publicly derivable set of nonces however, and involves zero-knowledge proofs where participants prove to each other their nonces were generated honestly.


---

