READ THE CODE

Inside Bitcoin

The code behind the network, with room to understand it.

Stable release v32.1bitcoin/bitcoin · f0de87f04062 ↗3,020 source files · 47.5 MB stored on the server340 file guides

Release published 2026-10-28 · Snapshot fetched 2026-11-01. Latest stable release at fetch time; development branches and Git history are excluded. Only the selected code window and visible folders load here.

12,871 bytes · SHA-256 c0e8a399a725c815… · View upstream ↗

1// Copyright (c) 2024-present The Bitcoin Core developers
2// Distributed under the MIT software license, see the accompanying
3// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4
5#include <musig.h>
6#include <key.h>
7#include <random.h>
8#include <support/allocators/secure.h>
9
10#include <secp256k1_musig.h>
11
12//! MuSig2 chaincode as defined by BIP 328
13using namespace util::hex_literals;
14const ChainCode MUSIG_CHAINCODE{"868087ca02a6f974c4598924c36b57762d32cb45717167e300622c7167e38965"_hex_u8};
15
16static bool GetMuSig2KeyAggCache(const std::vector<CPubKey>& pubkeys, secp256k1_musig_keyagg_cache& keyagg_cache)
17{
18    if (pubkeys.empty()) {
19        return false;
20    }
21
22    // Parse the pubkeys
23    std::vector<secp256k1_pubkey> secp_pubkeys;
24    std::vector<const secp256k1_pubkey*> pubkey_ptrs;
25    for (const CPubKey& pubkey : pubkeys) {
26        if (!secp256k1_ec_pubkey_parse(secp256k1_context_static, &secp_pubkeys.emplace_back(), pubkey.data(), pubkey.size())) {
27            return false;
28        }
29    }
30    pubkey_ptrs.reserve(secp_pubkeys.size());
31    for (const secp256k1_pubkey& p : secp_pubkeys) {
32        pubkey_ptrs.push_back(&p);
33    }
34
35    // Aggregate the pubkey
36    if (!secp256k1_musig_pubkey_agg(secp256k1_context_static, nullptr, &keyagg_cache, pubkey_ptrs.data(), pubkey_ptrs.size())) {
37        return false;
38    }
39    return true;
40}
41
42static std::optional<CPubKey> GetCPubKeyFromMuSig2KeyAggCache(secp256k1_musig_keyagg_cache& keyagg_cache)
43{
44    // Get the plain aggregated pubkey
45    secp256k1_pubkey agg_pubkey;
46    if (!secp256k1_musig_pubkey_get(secp256k1_context_static, &agg_pubkey, &keyagg_cache)) {
47        return std::nullopt;
48    }
49
50    // Turn into CPubKey
51    unsigned char ser_agg_pubkey[CPubKey::COMPRESSED_SIZE];
52    size_t ser_agg_pubkey_len = CPubKey::COMPRESSED_SIZE;
53    secp256k1_ec_pubkey_serialize(secp256k1_context_static, ser_agg_pubkey, &ser_agg_pubkey_len, &agg_pubkey, SECP256K1_EC_COMPRESSED);
54    return CPubKey(ser_agg_pubkey, ser_agg_pubkey + ser_agg_pubkey_len);
55}
56
57std::optional<CPubKey> MuSig2AggregatePubkeys(const std::vector<CPubKey>& pubkeys, secp256k1_musig_keyagg_cache& keyagg_cache, const std::optional<CPubKey>& expected_aggregate)
58{
59    if (!GetMuSig2KeyAggCache(pubkeys, keyagg_cache)) {
60        return std::nullopt;
61    }
62    std::optional<CPubKey> agg_key = GetCPubKeyFromMuSig2KeyAggCache(keyagg_cache);
63    if (!agg_key.has_value()) return std::nullopt;
64    if (expected_aggregate.has_value() && expected_aggregate != agg_key) return std::nullopt;
65    return agg_key;
66}
67
68std::optional<CPubKey> MuSig2AggregatePubkeys(const std::vector<CPubKey>& pubkeys)
69{
70    secp256k1_musig_keyagg_cache keyagg_cache;
71    return MuSig2AggregatePubkeys(pubkeys, keyagg_cache, std::nullopt);
72}
73
74CExtPubKey CreateMuSig2SyntheticXpub(const CPubKey& pubkey)
75{
76    CExtPubKey extpub;
77    extpub.nDepth = 0;
78    extpub.fingerprint.fill(0);
79    extpub.nChild = 0;
80    extpub.chaincode = MUSIG_CHAINCODE;
81    extpub.pubkey = pubkey;
82    return extpub;
83}
84
85class MuSig2SecNonceImpl
86{
87private:
88    //! The actual secnonce itself
89    secure_unique_ptr<secp256k1_musig_secnonce> m_nonce;
90
91public:
92    MuSig2SecNonceImpl() : m_nonce{make_secure_unique<secp256k1_musig_secnonce>()} {}
93
94    // Delete copy constructors
95    MuSig2SecNonceImpl(const MuSig2SecNonceImpl&) = delete;
96    MuSig2SecNonceImpl& operator=(const MuSig2SecNonceImpl&) = delete;
97
98    secp256k1_musig_secnonce* Get() const { return m_nonce.get(); }
99    void Invalidate() { m_nonce.reset(); }
100    bool IsValid() { return m_nonce != nullptr; }
101};
102
103MuSig2SecNonce::MuSig2SecNonce() : m_impl{std::make_unique<MuSig2SecNonceImpl>()} {}
104
105MuSig2SecNonce::MuSig2SecNonce(MuSig2SecNonce&&) noexcept = default;
106MuSig2SecNonce& MuSig2SecNonce::operator=(MuSig2SecNonce&&) noexcept = default;
107
108MuSig2SecNonce::~MuSig2SecNonce() = default;
109
110secp256k1_musig_secnonce* MuSig2SecNonce::Get() const
111{
112    return m_impl->Get();
113}
114
115void MuSig2SecNonce::Invalidate()
116{
117    return m_impl->Invalidate();
118}
119
120bool MuSig2SecNonce::IsValid()
121{
122    return m_impl->IsValid();
123}
124
125uint256 MuSig2SessionID(const CPubKey& script_pubkey, const CPubKey& part_pubkey, const uint256& sighash, const std::vector<uint8_t>& pubnonce)
126{
127    HashWriter hasher;
128    hasher << script_pubkey << part_pubkey << sighash << pubnonce;
129    return hasher.GetSHA256();
130}
131
132std::vector<uint8_t> CreateMuSig2Nonce(MuSig2SecNonce& secnonce, const uint256& sighash, const CKey& our_seckey, const CPubKey& aggregate_pubkey, const std::vector<CPubKey>& pubkeys)
133{
134    // Get the keyagg cache and aggregate pubkey
135    secp256k1_musig_keyagg_cache keyagg_cache;
136    if (!MuSig2AggregatePubkeys(pubkeys, keyagg_cache, aggregate_pubkey)) return {};
137
138    // Parse participant pubkey
139    CPubKey our_pubkey = our_seckey.GetPubKey();
140    secp256k1_pubkey pubkey;
141    if (!secp256k1_ec_pubkey_parse(secp256k1_context_static, &pubkey, our_pubkey.data(), our_pubkey.size())) {
142        return {};
143    }
144
145    // Generate randomness for nonce
146    uint256 rand;
147    GetStrongRandBytes(rand);
148
149    // Generate nonce
150    secp256k1_musig_pubnonce pubnonce;
151    if (!secp256k1_musig_nonce_gen(GetSecp256k1SignContext(), secnonce.Get(), &pubnonce, rand.data(), UCharCast(our_seckey.begin()), &pubkey, sighash.data(), &keyagg_cache, nullptr)) {
152        return {};
153    }
154
155    // Serialize pubnonce
156    std::vector<uint8_t> out;
157    out.resize(MUSIG2_PUBNONCE_SIZE);
158    if (!secp256k1_musig_pubnonce_serialize(secp256k1_context_static, out.data(), &pubnonce)) {
159        return {};
160    }
161
162    return out;
163}
164
165std::optional<uint256> CreateMuSig2PartialSig(const uint256& sighash, const CKey& our_seckey, const CPubKey& aggregate_pubkey, const std::vector<CPubKey>& pubkeys, const std::map<CPubKey, std::vector<uint8_t>>& pubnonces, MuSig2SecNonce& secnonce, const std::vector<std::pair<uint256, bool>>& tweaks)
166{
167    secp256k1_keypair keypair;
168    if (!secp256k1_keypair_create(GetSecp256k1SignContext(), &keypair, UCharCast(our_seckey.begin()))) return std::nullopt;
169
170    // Get the keyagg cache and aggregate pubkey
171    secp256k1_musig_keyagg_cache keyagg_cache;
172    if (!MuSig2AggregatePubkeys(pubkeys, keyagg_cache, aggregate_pubkey)) return std::nullopt;
173
174    // Check that there are enough pubnonces
175    if (pubnonces.size() != pubkeys.size()) return std::nullopt;
176
177    // Parse the pubnonces
178    std::vector<std::pair<secp256k1_pubkey, secp256k1_musig_pubnonce>> signers_data;
179    std::vector<const secp256k1_musig_pubnonce*> pubnonce_ptrs;
180    std::optional<size_t> our_pubkey_idx;
181    CPubKey our_pubkey = our_seckey.GetPubKey();
182    for (const CPubKey& part_pk : pubkeys) {
183        const auto& pn_it = pubnonces.find(part_pk);
184        if (pn_it == pubnonces.end()) return std::nullopt;
185        const std::vector<uint8_t> pubnonce = pn_it->second;
186        if (pubnonce.size() != MUSIG2_PUBNONCE_SIZE) return std::nullopt;
187        if (part_pk == our_pubkey) {
188            our_pubkey_idx = signers_data.size();
189        }
190
191        auto& [secp_pk, secp_pn] = signers_data.emplace_back();
192
193        if (!secp256k1_ec_pubkey_parse(secp256k1_context_static, &secp_pk, part_pk.data(), part_pk.size())) {
194            return std::nullopt;
195        }
196
197        if (!secp256k1_musig_pubnonce_parse(secp256k1_context_static, &secp_pn, pubnonce.data())) {
198            return std::nullopt;
199        }
200    }
201    if (our_pubkey_idx == std::nullopt) {
202        return std::nullopt;
203    }
204    pubnonce_ptrs.reserve(signers_data.size());
205    for (auto& [_, pn] : signers_data) {
206        pubnonce_ptrs.push_back(&pn);
207    }
208
209    // Aggregate nonces
210    secp256k1_musig_aggnonce aggnonce;
211    if (!secp256k1_musig_nonce_agg(secp256k1_context_static, &aggnonce, pubnonce_ptrs.data(), pubnonce_ptrs.size())) {
212        return std::nullopt;
213    }
214
215    // Apply tweaks
216    for (const auto& [tweak, xonly] : tweaks) {
217        if (xonly) {
218            if (!secp256k1_musig_pubkey_xonly_tweak_add(secp256k1_context_static, nullptr, &keyagg_cache, tweak.data())) {
219                return std::nullopt;
220            }
221        } else if (!secp256k1_musig_pubkey_ec_tweak_add(secp256k1_context_static, nullptr, &keyagg_cache, tweak.data())) {
222            return std::nullopt;
223        }
224    }
225
226    // Create musig_session
227    secp256k1_musig_session session;
228    if (!secp256k1_musig_nonce_process(secp256k1_context_static, &session, &aggnonce, sighash.data(), &keyagg_cache)) {
229        return std::nullopt;
230    }
231
232    // Create partial signature
233    secp256k1_musig_partial_sig psig;
234    if (!secp256k1_musig_partial_sign(secp256k1_context_static, &psig, secnonce.Get(), &keypair, &keyagg_cache, &session)) {
235        return std::nullopt;
236    }
237    // The secnonce must be deleted after signing to prevent nonce reuse.
238    secnonce.Invalidate();
239
240    // Verify partial signature
241    if (!secp256k1_musig_partial_sig_verify(secp256k1_context_static, &psig, &(signers_data.at(*our_pubkey_idx).second), &(signers_data.at(*our_pubkey_idx).first), &keyagg_cache, &session)) {
242        return std::nullopt;
243    }
244
245    // Serialize
246    uint256 sig;
247    if (!secp256k1_musig_partial_sig_serialize(secp256k1_context_static, sig.data(), &psig)) {
248        return std::nullopt;
249    }
250

src/wallet/receive.cpp

src/wallet/coinselection.cpp

src/consensus/validation.h

src/primitives/transaction.cpp

src/script/descriptor.cpp

src/bitcoin-cli.cpp

src/rpc/blockchain.cpp

src/rpc/rawtransaction.cpp

src/init.cpp

src/crypto/sha256.cpp

src/consensus/merkle.h

src/consensus/tx_check.h

src/consensus/tx_verify.h

src/policy/feerate.h

src/policy/feerate.cpp

src/primitives/transaction_identifier.h

src/chainparamsbase.h

src/chainparamsbase.cpp

src/util/moneystr.cpp

src/crypto/ripemd160.h

src/crypto/sha1.h

src/crypto/sha512.h

src/crypto/hmac_sha256.h

src/crypto/hmac_sha512.h

src/crypto/hmac_sha256.cpp

src/crypto/hmac_sha512.cpp

src/crypto/hkdf_sha256_32.h

src/crypto/hkdf_sha256_32.cpp

src/support/cleanse.h

src/support/cleanse.cpp

src/crypto/siphash.cpp

src/crypto/muhash.h

src/crypto/chacha20.h

src/crypto/poly1305.h

src/crypto/chacha20poly1305.h

src/crypto/chacha20poly1305.cpp

src/util/chaintype.cpp

src/util/obfuscation.h

src/util/byte_units.h

src/util/overflow.h

src/blockencodings.cpp

src/net_permissions.cpp

src/policy/packages.cpp

src/policy/rbf.cpp

src/policy/truc_policy.cpp

src/policy/ephemeral_policy.cpp

src/policy/settings.cpp

src/policy/policy.cpp

src/node/transaction.cpp

src/node/coin.cpp

src/rpc/client.cpp

src/rpc/external_signer.cpp

src/rpc/request.cpp

src/rpc/server_util.cpp

src/rpc/fees.cpp

src/rpc/output_script.cpp

src/rpc/rawtransaction_util.cpp

src/rpc/rawtransaction_util.h

src/rpc/register.h

src/rpc/request.h

src/rpc/server_util.h

src/rpc/protocol.h

src/rpc/server.h

src/rpc/signmessage.cpp

src/rpc/txoutproof.cpp

src/rpc/util.cpp

src/rpc/util.h

src/wallet/rpc/addresses.cpp

src/wallet/rpc/backup.cpp

src/wallet/rpc/coins.cpp

src/wallet/rpc/encrypt.cpp

src/wallet/rpc/signmessage.cpp

src/wallet/rpc/util.cpp

src/wallet/rpc/util.h

src/wallet/coincontrol.cpp

src/wallet/coincontrol.h

src/wallet/context.cpp

src/wallet/context.h

src/wallet/crypter.cpp

src/wallet/crypter.h

src/wallet/db.cpp

src/wallet/export.cpp

src/wallet/external_signer_scriptpubkeyman.cpp

src/wallet/rpc/spend.cpp

src/wallet/rpc/transactions.cpp

src/wallet/rpc/wallet.cpp

src/wallet/feebumper.cpp

src/wallet/feebumper.h

src/index/base.h

src/index/base.cpp

src/index/txindex.h

src/index/txindex.cpp

src/index/txindex_key.h

src/index/txospenderindex.h

src/index/txospenderindex.cpp

src/index/blockfilterindex.h

src/index/blockfilterindex.cpp

src/index/coinstatsindex.h

src/index/coinstatsindex.cpp

src/index/db_key.h

src/index/disktxpos.h

src/kernel/chain.cpp

src/kernel/chain.h

src/kernel/checks.cpp

src/kernel/checks.h

src/kernel/context.cpp

src/kernel/context.h

src/kernel/cs_main.cpp

src/kernel/cs_main.h

src/kernel/disconnected_transactions.cpp

src/kernel/disconnected_transactions.h

src/kernel/mempool_removal_reason.cpp

src/kernel/mempool_removal_reason.h

src/kernel/coinstats.cpp

src/kernel/coinstats.h

src/kernel/chainparams.cpp

src/kernel/chainparams.h

src/wallet/sqlite.cpp

src/wallet/sqlite.h

src/wallet/transaction.cpp

src/wallet/transaction.h

src/wallet/dump.cpp

src/wallet/dump.h

src/wallet/init.cpp

src/wallet/walletutil.cpp

src/wallet/walletutil.h

src/wallet/wallettool.cpp

src/wallet/wallettool.h

src/wallet/export.h

src/wallet/migrate.cpp

src/wallet/migrate.h

src/wallet/db.h

src/wallet/walletdb.cpp

src/wallet/interfaces.cpp

src/wallet/scriptpubkeyman.cpp

src/wallet/scriptpubkeyman.h

src/kernel/bitcoinkernel.cpp

src/kernel/bitcoinkernel.h

src/kernel/bitcoinkernel_wrapper.h

src/node/chainstate.cpp

src/node/chainstate.h

src/node/blockstorage.cpp

src/node/blockstorage.h

src/node/mempool_persist.cpp

src/node/mempool_persist.h

src/node/utxo_snapshot.cpp

src/node/utxo_snapshot.h

src/node/kernel_notifications.cpp

src/node/kernel_notifications.h

src/node/blockmanager_args.cpp

src/kernel/blockmanager_opts.h

src/util/expected.cpp

src/policy/settings.h

src/util/types.h

src/kernel/messagestartchars.h

src/kernel/warning.h

src/util/exception.h

src/common/license_info.h

src/node/coins_view_args.h

src/node/database_args.h

src/util/batchpriority.h

src/util/ui_change_type.h

src/node/coins_view_args.cpp

src/node/peerman_args.h

src/util/serfloat.h

src/node/blockmanager_args.h

src/node/database_args.cpp

src/util/overloaded.h

src/interfaces/types.h

src/node/chainstatemanager_args.h

src/node/minisketchwrapper.h

src/util/macros.h

src/util/syserror.h

src/common/run_command.h

src/util/bytevectorhash.cpp

src/node/mempool_persist_args.cpp

src/util/exec.h

src/util/rbf.h

src/crypto/hex_base.h

src/node/mempool_persist_args.h

src/interfaces/echo.h

src/util/any.h

src/util/batchpriority.cpp

src/util/threadnames.h

src/node/coin.h

src/node/mempool_args.h

src/util/asmap.h

src/util/bytevectorhash.h

src/node/context.cpp

src/util/insert.h

src/util/readwritefile.h

src/node/peerman_args.cpp

src/node/interface_ui.cpp

src/interfaces/handler.h

src/node/mining_args.h

src/util/hasher.cpp

src/common/init.h

src/kernel/mempool_limits.h

src/common/system.h

src/crypto/sha3.h

src/util/threadinterrupt.cpp

src/node/protocol_version.h

src/util/exception.cpp

src/common/messages.h

src/node/connection_types.cpp

src/util/bip32.h

src/common/license_info.cpp

src/util/stdmutex.h

src/common/run_command.cpp

src/util/check.cpp

src/util/golombrice.h

src/node/types.h

src/node/timeoffsets.h

src/util/readwritefile.cpp

src/util/fastrange.h

src/util/signalinterrupt.h

src/util/task_runner.h

src/util/syserror.cpp

src/common/interfaces.cpp

src/common/types.h

src/util/threadinterrupt.h

src/kernel/chainstatemanager_opts.h

src/node/psbt.h

src/policy/ephemeral_policy.h

src/util/trace.h

src/common/url.cpp

src/kernel/mempool_options.h

src/util/serfloat.cpp

src/kernel/notifications_interface.h

src/node/timeoffsets.cpp

src/node/warnings.cpp

src/util/hash_type.h

src/crypto/hex_base.cpp

src/node/eviction.h

src/util/tokenbucket.h

src/crypto/aes.h

src/common/pcp.h

src/util/feefrac.cpp

src/node/transaction.h

src/util/threadnames.cpp

src/common/signmessage.h

src/util/exec.cpp

src/util/signalinterrupt.cpp

Independent explanations by MyBitcoinExplorer. Not affiliated with or endorsed by Bitcoin Core. Guides are educational and do not replace the source or its tests.

Bitcoin Core source © its contributors, distributed under the MIT license. Original notices and bundled third-party licenses are retained in the source tree.