musig2-linearity-insight

Wed Apr 01 2026

MuSig2 has two things to get right: induce linearity in Schnorr signatures, and preserve the already existing relation $c = f(x, k)$. If we can make partial signatures linear, summing them gives a valid single Schnorr signature, indistinguishable from a normal one.

Schnorr signatures are partially linear

A Schnorr signature resembles the function $f(x, y, z) = x + y \cdot z$. This function is not linear overall (with respect to all $x$, $y$, $z$), but it is linear with respect to $x$ and $y$ when $z$ is constant, and with respect to $x$ and $z$ when $y$ is constant.

The actual signature equation is $s = k + c \cdot x$. By keeping $c$ constant across multiple partial signatures, we induce linearity. Summing the partial signatures then produces a valid Schnorr signature.

How to keep c constant

The challenge value is computed as $c = H_{\text{non}}(R \| P \| \text{msg})$. To make $c$ constant across signers, we need $R$, $P$, and $\text{msg}$ to all be the same for every partial signature.

Preserving the relation between c, k, and x

In $f(x, y, z) = x + y \cdot z$, all three variables are independent. But in Schnorr signatures they are not. The challenge $c$ depends on $k$ and $x$ through the relation:

$c = H_{\text{non}}(g^k \| g^x \| \text{msg})$

We also need to preserve this relation when combining signatures. For $n$ signers:

$R = g^{k_1 + k_2 + \cdots + k_n}$ $P = g^{x_1 + x_2 + \cdots + x_n}$

The aggregate $R$ and $P$ must correspond to the sums of individual nonces and secret keys respectively. Then $c$ is consistent across all partial signatures, and their sum is valid under the aggregate key.

Why aggregate coefficients exist

The aggregate public key depends on the order of the individual public keys because of the aggregate coefficient $a_i = H_{\text{agg}}(L, X_i)$. If the order changes, $a_i$ changes, so the aggregate key changes. Without these coefficients, a malicious signer could pick their public key as a function of honest signers' keys to cancel them out. That's the rogue key attack, and the aggregate coefficients are what block it.

Open question

How is linearity defined when the domain is mod prime, instead of real numbers? The partial linearity argument above is stated over the reals, but Schnorr signatures operate in $\mathbb{Z}_p$. The same algebraic structure holds because $\mathbb{Z}_p$ is a field and the linearity argument only uses addition and multiplication, which are well-defined in any field.