Proposed BIP for MuSig2 Descriptors

Hi All,

I've written up a BIP draft for MuSig2 descriptors. It can be viewed at https://github.com/achow101/bips/blob/musig2-descriptors/bip-musig2-descriptors.mediawiki.

Andrew

Hi Andrew,

Thank you for putting this together; these standards will be of great help for implementations.

The only concern I have is about the utility of supporting KEY expressions inside musig to contain ranged derivations with `/*`.

Consider a wallet described as follows:

  musig(key1/<0;1>/*, key2/<0;1>/*, ..., keyN/<0;1>/*)

With such a setup, for each input being spent, each signer is required to derive the child xpub for each key, and then execute the KeyAgg algorithm [1] (which includes N scalar multiplications).

Instead, a policy like:

  musig(key1, key2, ..., keyN)/<0;1>/*

is more succinct, and KeyAgg is executed only once for all the inputs. I think the performance impact is substantial for signing devices.

Therefore, unless there are known use cases, I would suggest keeping the standard minimal and supporting only the second form, avoiding both the performance overhead and the additional complexity when writing descriptor parsers.

If, on the contrary, there are legitimate use cases, a discussion about them (and the above mentioned tradeoffs) might be worth adding to the BIP proposal.

Best, Salvatore

[1] - BIP-327 MuSig2: https://github.com/bitcoin/bips/blob/master/bip-0327