OMDL ⇒ MuSig2

Fully-black-box reduction · random oracle model · NRS21

Statement

MuSig2 is a two-round Schnorr multi-signature with key aggregation whose signatures are Schnorr signatures, with the key included in the hash, under the aggregate key. With $\nu =4$ nonces per signer it is unforgeable in the plain public-key model, against concurrent signing sessions, in the random-oracle model if an algebraic variant of OMDL, implied by OMDL, is hard — NRS21. The more efficient variant with $\nu =2$ is proved secure under the same assumption in the combination of the algebraic group model and the random-oracle model — NRS21.

Notes

• Signing takes two rounds, of which the first can be run before the message is known, and each signer’s cost is close to that of a plain Schnorr signature — NRS21.
• Two-round MuSig, with a single nonce per signer, has no algebraic reduction from DLOG or OMDL if OMDL is hard (barrier) — DEF+19.