<p>Firstly, it is worth emphasizing that both classic MuSig (referred to here as &quot;MuSig&quot;) and MuSig-DN are relatively new cryptographic schemes and the paper for MuSig-DN is fresh off the presses at the time of writing (September 2020) with no current implementation. So use both at your own risk but even more so for MuSig-DN. The MuSig paper needed to be <a href="https://medium.com/blockstream/insecure-shortcuts-in-musig-2ad0d38a97da" rel="nofollow noreferrer">revised</a> and it is certainly possible that the MuSig-DN paper will need to go through revision(s).</p>
<p>There are so many trade-offs with multisignature schemes that is hard to be precise and weigh them all up against each other. I will outline some of the key trade-offs that Pieter Wuille mentioned on IRC (any mistakes are my own).</p>
<p>Currently, MuSig-DN has a high <strong>computational cost</strong> with approximately a 1 second signing time on a modern desktop CPU. It is possible that this could be reduced but this would likely impact the existence of a security proof. On computational cost MuSig signing is clearly preferable. (Verification cost is identical.)</p>
<p>The motivation for MuSig-DN in the first place is that it has two <strong>communication rounds</strong> rather than MuSig's three. On communication rounds MuSig-DN is preferable.</p>
<p>MuSig-DN offers <strong>stateless signing</strong> which means the signer doesn't need to remember the rounds he/she has already participated in or remember nonces from one round to the next. In contrast MuSig needs <strong>randomly generated nonces</strong> at signing time and previous state must be stored securely. On stateless signing and randomness requirements MuSig-DN is preferable.</p>
<p>Both MuSig and MuSig-DN have a <strong>security proof</strong> under similar assumptions.</p>
<p>As you can tell from the above on multiple dimensions MuSig-DN is superior to MuSig. However, the computational cost of MuSig-DN arguably outweighs all the benefits for practical use cases and one would expect classic MuSig to generally be used over the current iteration of MuSig-DN.</p>
<p>As an aside there is a strict improvement of classic MuSig being worked on, let's call it &quot;MuSig2&quot;, which has two communication rounds and would allow for private nesting. You could have multiple levels of MuSig aggregation and not tell your sibling participants that you have child participants.</p>
<p>[edit in October 2020: The <a href="https://eprint.iacr.org/2020/1261" rel="nofollow noreferrer">paper</a> for MuSig2 has now been published.]</p>
<p>For more information on MuSig-DN see this <a href="https://medium.com/blockstream/musig-dn-schnorr-multisignatures-with-verifiably-deterministic-nonces-27424b5df9d6" rel="nofollow noreferrer">blog post</a> from Jonas Nick and Tim Ruffing.</p>
<p>Pieter Wuille discussed the advantages and disadvantages of MuSig-DN <a href="https://github.com/bitcoin/bitcoin/issues/23326#issuecomment-950163967" rel="nofollow noreferrer">here</a>.</p>
<p>Thanks to Pieter Wuille for answering my questions on IRC. Any errors are my own.</p>

CC BY-SA 4.0
2020-09-03T09:55:45.237Z
2022-02-25T12:58:29.680Z
2022-02-25T12:58:29.680Z
Michael Folkson
<p>Now we have two competing MuSig schemes which is better? Classic <a href="https://eprint.iacr.org/2018/068.pdf" rel="nofollow noreferrer">MuSig</a> or <a href="https://eprint.iacr.org/2020/1057.pdf" rel="nofollow noreferrer">MuSig-DN</a>? Which use case(s) might choose classic MuSig over MuSig-DN and vice versa?</p>

<multi-signature><schnorr-signatures><musig>
Which MuSig scheme is optimal? Classic MuSig or this new MuSig-DN scheme?
Michael Folkson
# Which MuSig scheme is optimal? Classic MuSig or this new MuSig-DN scheme?

(Asked by: username_0 on 2020-09-03)

Now we have two competing MuSig schemes which is better? Classic [MuSig](https://eprint.iacr.org/2018/068.pdf) or [MuSig-DN](https://eprint.iacr.org/2020/1057.pdf)? Which use case(s) might choose classic MuSig over MuSig-DN and vice versa?

**Tags:** multi-signature, schnorr-signatures, musig


---

## 1 answers

### Answer by username_0 on 2020-09-03. Score: 2 | Accepted answer

Firstly, it is worth emphasizing that both classic MuSig (referred to here as "MuSig") and MuSig-DN are relatively new cryptographic schemes and the paper for MuSig-DN is fresh off the presses at the time of writing (September 2020) with no current implementation. So use both at your own risk but even more so for MuSig-DN. The MuSig paper needed to be [revised](https://medium.com/blockstream/insecure-shortcuts-in-musig-2ad0d38a97da) and it is certainly possible that the MuSig-DN paper will need to go through revision(s).

There are so many trade-offs with multisignature schemes that is hard to be precise and weigh them all up against each other. I will outline some of the key trade-offs that Pieter Wuille mentioned on IRC (any mistakes are my own).

Currently, MuSig-DN has a high **computational cost** with approximately a 1 second signing time on a modern desktop CPU. It is possible that this could be reduced but this would likely impact the existence of a security proof. On computational cost MuSig signing is clearly preferable. (Verification cost is identical.)

The motivation for MuSig-DN in the first place is that it has two **communication rounds** rather than MuSig's three. On communication rounds MuSig-DN is preferable.

MuSig-DN offers **stateless signing** which means the signer doesn't need to remember the rounds he/she has already participated in or remember nonces from one round to the next. In contrast MuSig needs **randomly generated nonces** at signing time and previous state must be stored securely. On stateless signing and randomness requirements MuSig-DN is preferable.

Both MuSig and MuSig-DN have a **security proof** under similar assumptions.

As you can tell from the above on multiple dimensions MuSig-DN is superior to MuSig. However, the computational cost of MuSig-DN arguably outweighs all the benefits for practical use cases and one would expect classic MuSig to generally be used over the current iteration of MuSig-DN.

As an aside there is a strict improvement of classic MuSig being worked on, let's call it "MuSig2", which has two communication rounds and would allow for private nesting. You could have multiple levels of MuSig aggregation and not tell your sibling participants that you have child participants.

[edit in October 2020: The [paper](https://eprint.iacr.org/2020/1261) for MuSig2 has now been published.]

For more information on MuSig-DN see this [blog post](https://medium.com/blockstream/musig-dn-schnorr-multisignatures-with-verifiably-deterministic-nonces-27424b5df9d6) from Jonas Nick and Tim Ruffing.

Pieter Wuille discussed the advantages and disadvantages of MuSig-DN [here](https://github.com/bitcoin/bitcoin/issues/23326#issuecomment-950163967).

Thanks to Pieter Wuille for answering my questions on IRC. Any errors are my own.


---

