Inside Bitcoin
Opening the selected file…
Opening the selected file…
The code behind the network, with room to understand it.
Release published 2026-10-28 · Snapshot fetched 2026-11-01. Latest stable release at fetch time; development branches and Git history are excluded. Only the selected code window and visible folders load here.
1// Copyright (c) 2024-present The Bitcoin Core developers2// Distributed under the MIT software license, see the accompanying3// file COPYING or https://www.opensource.org/licenses/mit-license.php.5#ifndef BITCOIN_MUSIG_H6#define BITCOIN_MUSIG_H8#include <pubkey.h>10#include <optional>11#include <vector>13class CKey;14struct secp256k1_musig_keyagg_cache;15class MuSig2SecNonceImpl;16struct secp256k1_musig_secnonce;18inline constexpr size_t MUSIG2_PUBNONCE_SIZE{66};20//! Compute the full aggregate pubkey from the given participant pubkeys in their current order.21//! Outputs the secp256k1_musig_keyagg_cache and validates that the computed aggregate pubkey matches an expected aggregate pubkey.22//! This is necessary for most MuSig2 operations.23std::optional<CPubKey> MuSig2AggregatePubkeys(const std::vector<CPubKey>& pubkeys, secp256k1_musig_keyagg_cache& keyagg_cache, const std::optional<CPubKey>& expected_aggregate);24std::optional<CPubKey> MuSig2AggregatePubkeys(const std::vector<CPubKey>& pubkeys);26//! Construct the BIP 328 synthetic xpub for a pubkey27CExtPubKey CreateMuSig2SyntheticXpub(const CPubKey& pubkey);29/**30* MuSig2SecNonce encapsulates a secret nonce in use in a MuSig2 signing session.31* Since this nonce persists outside of libsecp256k1 signing code, we must handle32* its construction and destruction ourselves.33* The secret nonce must be kept a secret, otherwise the private key may be leaked.34* As such, it needs to be treated in the same way that CKeys are treated.35* So this class handles the secure allocation of the secp256k1_musig_secnonce object36* that libsecp256k1 uses, and only gives out references to this object to avoid37* any possibility of copies being made. Furthermore, objects of this class are not38* copyable to avoid nonce reuse.39*/40class MuSig2SecNonce41{42private:43std::unique_ptr<MuSig2SecNonceImpl> m_impl;45public:46MuSig2SecNonce();47MuSig2SecNonce(MuSig2SecNonce&&) noexcept;48MuSig2SecNonce& operator=(MuSig2SecNonce&&) noexcept;49~MuSig2SecNonce();51// Delete copy constructors52MuSig2SecNonce(const MuSig2SecNonce&) = delete;53MuSig2SecNonce& operator=(const MuSig2SecNonce&) = delete;55secp256k1_musig_secnonce* Get() const;56void Invalidate();57bool IsValid();58};60/**61* Computes an arbitrary unique session ID to identify ongoing signing sessions.62* It is the SHA256 of the signing (aggregate) pubkey, the participant pubkey, the sighash, and the pubnonce63*/64uint256 MuSig2SessionID(const CPubKey& script_pubkey, const CPubKey& part_pubkey, const uint256& sighash, const std::vector<uint8_t>& pubnonce);66std::vector<uint8_t> CreateMuSig2Nonce(MuSig2SecNonce& secnonce, const uint256& sighash, const CKey& our_seckey, const CPubKey& aggregate_pubkey, const std::vector<CPubKey>& pubkeys);67std::optional<uint256> CreateMuSig2PartialSig(const uint256& hash, const CKey& our_seckey, const CPubKey& aggregate_pubkey, const std::vector<CPubKey>& pubkeys, const std::map<CPubKey, std::vector<uint8_t>>& pubnonces, MuSig2SecNonce& secnonce, const std::vector<std::pair<uint256, bool>>& tweaks);68std::optional<std::vector<uint8_t>> CreateMuSig2AggregateSig(const std::vector<CPubKey>& participants, const CPubKey& aggregate_pubkey, const std::vector<std::pair<uint256, bool>>& tweaks, const uint256& sighash, const std::map<CPubKey, std::vector<uint8_t>>& pubnonces, const std::map<CPubKey, uint256>& partial_sigs);70#endif // BITCOIN_MUSIG_H
Independent explanations by MyBitcoinExplorer. Not affiliated with or endorsed by Bitcoin Core. Guides are educational and do not replace the source or its tests.
Bitcoin Core source © its contributors, distributed under the MIT license. Original notices and bundled third-party licenses are retained in the source tree.