READ THE CODE

Inside Bitcoin

The code behind the network, with room to understand it.

Stable release v32.1bitcoin/bitcoin · f0de87f04062 ↗3,020 source files · 47.5 MB stored on the server440 file guides

Release published 2026-10-28 · Snapshot fetched 2026-11-01. Latest stable release at fetch time; development branches and Git history are excluded. Only the selected code window and visible folders load here.

11,242 bytes · SHA-256 76f7b09a0bd44802… · View upstream ↗

1/*************************************************************************
2 * To the extent possible under law, the author(s) have dedicated all    *
3 * copyright and related and neighboring rights to the software in this  *
4 * file to the public domain worldwide. This software is distributed     *
5 * without any warranty. For the CC0 Public Domain Dedication, see       *
6 * EXAMPLES_COPYING or https://creativecommons.org/publicdomain/zero/1.0 *
7 *************************************************************************/
8
9/** This file demonstrates how to use the MuSig module to create a
10 *  3-of-3 multisignature. Additionally, see the documentation in
11 *  include/secp256k1_musig.h and doc/musig.md.
12 */
13
14#include <stdio.h>
15#include <stdlib.h>
16#include <assert.h>
17#include <string.h>
18
19#include <secp256k1.h>
20#include <secp256k1_extrakeys.h>
21#include <secp256k1_musig.h>
22#include <secp256k1_schnorrsig.h>
23
24#include "examples_util.h"
25
26struct signer_secrets {
27    secp256k1_keypair keypair;
28    secp256k1_musig_secnonce secnonce;
29};
30
31struct signer {
32    secp256k1_pubkey pubkey;
33    secp256k1_musig_pubnonce pubnonce;
34    secp256k1_musig_partial_sig partial_sig;
35};
36
37 /* Number of public keys involved in creating the aggregate signature */
38#define N_SIGNERS 3
39/* Create a key pair, store it in signer_secrets->keypair and signer->pubkey */
40static int create_keypair(const secp256k1_context* ctx, struct signer_secrets *signer_secrets, struct signer *signer) {
41    unsigned char seckey[32];
42
43    if (!fill_random(seckey, sizeof(seckey))) {
44        printf("Failed to generate randomness\n");
45        return 0;
46    }
47    /* Try to create a keypair with a valid context. This only fails if the
48     * secret key is zero or out of range (greater than secp256k1's order). Note
49     * that the probability of this occurring is negligible with a properly
50     * functioning random number generator. */
51    if (!secp256k1_keypair_create(ctx, &signer_secrets->keypair, seckey)) {
52        return 0;
53    }
54    if (!secp256k1_keypair_pub(ctx, &signer->pubkey, &signer_secrets->keypair)) {
55        return 0;
56    }
57
58    secure_erase(seckey, sizeof(seckey));
59    return 1;
60}
61
62/* Tweak the pubkey corresponding to the provided keyagg cache, update the cache
63 * and return the tweaked aggregate pk. */
64static int tweak(const secp256k1_context* ctx, secp256k1_xonly_pubkey *agg_pk, secp256k1_musig_keyagg_cache *cache) {
65    secp256k1_pubkey output_pk;
66    /* For BIP 32 tweaking the plain_tweak is set to a hash as defined in BIP
67     * 32. */
68    unsigned char plain_tweak[32] = "this could be a BIP32 tweak....";
69    /* For Taproot tweaking the xonly_tweak is set to the TapTweak hash as
70     * defined in BIP 341 */
71    unsigned char xonly_tweak[32] = "this could be a Taproot tweak..";
72
73
74    /* Plain tweaking which, for example, allows deriving multiple child
75     * public keys from a single aggregate key using BIP32 */
76    if (!secp256k1_musig_pubkey_ec_tweak_add(ctx, NULL, cache, plain_tweak)) {
77        return 0;
78    }
79    /* Note that we did not provide an output_pk argument, because the
80     * resulting pk is also saved in the cache and so if one is just interested
81     * in signing, the output_pk argument is unnecessary. On the other hand, if
82     * one is not interested in signing, the same output_pk can be obtained by
83     * calling `secp256k1_musig_pubkey_get` right after key aggregation to get
84     * the full pubkey and then call `secp256k1_ec_pubkey_tweak_add`. */
85
86    /* Xonly tweaking which, for example, allows creating Taproot commitments */
87    if (!secp256k1_musig_pubkey_xonly_tweak_add(ctx, &output_pk, cache, xonly_tweak)) {
88        return 0;
89    }
90    /* Note that if we wouldn't care about signing, we can arrive at the same
91     * output_pk by providing the untweaked public key to
92     * `secp256k1_xonly_pubkey_tweak_add` (after converting it to an xonly pubkey
93     * if necessary with `secp256k1_xonly_pubkey_from_pubkey`). */
94
95    /* Now we convert the output_pk to an xonly pubkey to allow to later verify
96     * the Schnorr signature against it. For this purpose we can ignore the
97     * `pk_parity` output argument; we would need it if we would have to open
98     * the Taproot commitment. */
99    if (!secp256k1_xonly_pubkey_from_pubkey(ctx, agg_pk, NULL, &output_pk)) {
100        return 0;
101    }
102    return 1;
103}
104
105/* Sign a message hash with the given key pairs and store the result in sig */
106static int sign(const secp256k1_context* ctx, struct signer_secrets *signer_secrets, struct signer *signer, const secp256k1_musig_keyagg_cache *cache, const unsigned char *msg32, unsigned char *sig64) {
107    int i;
108    const secp256k1_musig_pubnonce *pubnonces[N_SIGNERS];
109    const secp256k1_musig_partial_sig *partial_sigs[N_SIGNERS];
110    /* The same for all signers */
111    secp256k1_musig_session session;
112    secp256k1_musig_aggnonce agg_pubnonce;
113
114    for (i = 0; i < N_SIGNERS; i++) {
115        unsigned char seckey[32];
116        unsigned char session_secrand[32];
117        /* Create random session ID. It is absolutely necessary that the session ID
118         * is unique for every call of secp256k1_musig_nonce_gen. Otherwise
119         * it's trivial for an attacker to extract the secret key! */
120        if (!fill_random(session_secrand, sizeof(session_secrand))) {
121            return 0;
122        }
123        if (!secp256k1_keypair_sec(ctx, seckey, &signer_secrets[i].keypair)) {
124            return 0;
125        }
126        /* Initialize session and create secret nonce for signing and public
127         * nonce to send to the other signers. */
128        if (!secp256k1_musig_nonce_gen(ctx, &signer_secrets[i].secnonce, &signer[i].pubnonce, session_secrand, seckey, &signer[i].pubkey, msg32, NULL, NULL)) {
129            return 0;
130        }
131        pubnonces[i] = &signer[i].pubnonce;
132
133        secure_erase(seckey, sizeof(seckey));
134    }
135
136    /* Communication round 1: Every signer sends their pubnonce to the
137     * coordinator. The coordinator runs secp256k1_musig_nonce_agg and sends
138     * agg_pubnonce to each signer */
139    if (!secp256k1_musig_nonce_agg(ctx, &agg_pubnonce, pubnonces, N_SIGNERS)) {
140        return 0;
141    }
142
143    /* Every signer creates a partial signature */
144    for (i = 0; i < N_SIGNERS; i++) {
145        /* Initialize the signing session by processing the aggregate nonce */
146        if (!secp256k1_musig_nonce_process(ctx, &session, &agg_pubnonce, msg32, cache)) {
147            return 0;
148        }
149        /* partial_sign will clear the secnonce by setting it to 0. That's because
150         * you must _never_ reuse the secnonce (or use the same session_secrand to
151         * create a secnonce). If you do, you effectively reuse the nonce and
152         * leak the secret key. */
153        if (!secp256k1_musig_partial_sign(ctx, &signer[i].partial_sig, &signer_secrets[i].secnonce, &signer_secrets[i].keypair, cache, &session)) {
154            return 0;
155        }
156        partial_sigs[i] = &signer[i].partial_sig;
157    }
158    /* Communication round 2: Every signer sends their partial signature to the
159     * coordinator, who verifies the partial signatures and aggregates them. */
160    for (i = 0; i < N_SIGNERS; i++) {
161        /* To check whether signing was successful, it suffices to either verify
162         * the aggregate signature with the aggregate public key using
163         * secp256k1_schnorrsig_verify, or verify all partial signatures of all
164         * signers individually. Verifying the aggregate signature is cheaper but
165         * verifying the individual partial signatures has the advantage that it
166         * can be used to determine which of the partial signatures are invalid
167         * (if any), i.e., which of the partial signatures cause the aggregate
168         * signature to be invalid and thus the protocol run to fail. It's also
169         * fine to first verify the aggregate sig, and only verify the individual
170         * sigs if it does not work.
171         */
172        if (!secp256k1_musig_partial_sig_verify(ctx, &signer[i].partial_sig, &signer[i].pubnonce, &signer[i].pubkey, cache, &session)) {
173            return 0;
174        }
175    }
176    return secp256k1_musig_partial_sig_agg(ctx, sig64, &session, partial_sigs, N_SIGNERS);
177}
178
179int main(void) {
180    secp256k1_context* ctx;
181    int i;
182    struct signer_secrets signer_secrets[N_SIGNERS];
183    struct signer signers[N_SIGNERS];
184    const secp256k1_pubkey *pubkeys_ptr[N_SIGNERS];
185    secp256k1_xonly_pubkey agg_pk;
186    secp256k1_musig_keyagg_cache cache;
187    unsigned char msg[32] = "this_could_be_the_hash_of_a_msg";
188    unsigned char sig[64];
189
190    /* Create a secp256k1 context */
191    ctx = secp256k1_context_create(SECP256K1_CONTEXT_NONE);
192    printf("Creating key pairs......");
193    fflush(stdout);
194    for (i = 0; i < N_SIGNERS; i++) {
195        if (!create_keypair(ctx, &signer_secrets[i], &signers[i])) {
196            printf("FAILED\n");
197            return EXIT_FAILURE;
198        }
199        pubkeys_ptr[i] = &signers[i].pubkey;
200    }
201    printf("ok\n");
202
203    /* The aggregate public key produced by secp256k1_musig_pubkey_agg depends
204     * on the order of the provided public keys. If there is no canonical order
205     * of the signers, the individual public keys can optionally be sorted with
206     * secp256k1_ec_pubkey_sort to ensure that the aggregate public key is
207     * independent of the order of signers. */
208    printf("Sorting public keys.....");
209    fflush(stdout);
210    if (!secp256k1_ec_pubkey_sort(ctx, pubkeys_ptr, N_SIGNERS)) {
211        printf("FAILED\n");
212        return EXIT_FAILURE;
213    }
214    printf("ok\n");
215
216    printf("Combining public keys...");
217    fflush(stdout);
218    /* If you just want to aggregate and not sign, you can call
219     * secp256k1_musig_pubkey_agg with the keyagg_cache argument set to NULL
220     * while providing a non-NULL agg_pk argument. */
221    if (!secp256k1_musig_pubkey_agg(ctx, NULL, &cache, pubkeys_ptr, N_SIGNERS)) {
222        printf("FAILED\n");
223        return EXIT_FAILURE;
224    }
225    printf("ok\n");
226    printf("Tweaking................");
227    fflush(stdout);
228    /* Optionally tweak the aggregate key */
229    if (!tweak(ctx, &agg_pk, &cache)) {
230        printf("FAILED\n");
231        return EXIT_FAILURE;
232    }
233    printf("ok\n");
234    printf("Signing message.........");
235    fflush(stdout);
236    if (!sign(ctx, signer_secrets, signers, &cache, msg, sig)) {
237        printf("FAILED\n");
238        return EXIT_FAILURE;
239    }
240    printf("ok\n");
241    printf("Verifying signature.....");
242    fflush(stdout);
243    if (!secp256k1_schnorrsig_verify(ctx, sig, msg, 32, &agg_pk)) {
244        printf("FAILED\n");
245        return EXIT_FAILURE;
246    }
247    printf("ok\n");
248
249    /* It's best practice to try to clear secrets from memory after using them.
250     * This is done because some bugs can allow an attacker to leak memory, for

src/wallet/receive.cpp

src/wallet/coinselection.cpp

src/consensus/validation.h

src/primitives/transaction.cpp

src/script/descriptor.cpp

src/bitcoin-cli.cpp

src/rpc/blockchain.cpp

src/rpc/rawtransaction.cpp

src/init.cpp

src/crypto/sha256.cpp

src/consensus/merkle.h

src/consensus/tx_check.h

src/consensus/tx_verify.h

src/policy/feerate.h

src/policy/feerate.cpp

src/primitives/transaction_identifier.h

src/chainparamsbase.h

src/chainparamsbase.cpp

src/util/moneystr.cpp

src/crypto/ripemd160.h

src/crypto/sha1.h

src/crypto/sha512.h

src/crypto/hmac_sha256.h

src/crypto/hmac_sha512.h

src/crypto/hmac_sha256.cpp

src/crypto/hmac_sha512.cpp

src/crypto/hkdf_sha256_32.h

src/crypto/hkdf_sha256_32.cpp

src/support/cleanse.h

src/support/cleanse.cpp

src/crypto/siphash.cpp

src/crypto/muhash.h

src/crypto/chacha20.h

src/crypto/poly1305.h

src/crypto/chacha20poly1305.h

src/crypto/chacha20poly1305.cpp

src/util/chaintype.cpp

src/util/obfuscation.h

src/util/byte_units.h

src/util/overflow.h

src/blockencodings.cpp

src/net_permissions.cpp

src/policy/packages.cpp

src/policy/rbf.cpp

src/policy/truc_policy.cpp

src/policy/ephemeral_policy.cpp

src/policy/settings.cpp

src/policy/policy.cpp

src/node/transaction.cpp

src/node/coin.cpp

src/rpc/client.cpp

src/rpc/external_signer.cpp

src/rpc/request.cpp

src/rpc/server_util.cpp

src/rpc/fees.cpp

src/rpc/output_script.cpp

src/rpc/rawtransaction_util.cpp

src/rpc/rawtransaction_util.h

src/rpc/register.h

src/rpc/request.h

src/rpc/server_util.h

src/rpc/protocol.h

src/rpc/server.h

src/rpc/signmessage.cpp

src/rpc/txoutproof.cpp

src/rpc/util.cpp

src/rpc/util.h

src/wallet/rpc/addresses.cpp

src/wallet/rpc/backup.cpp

src/wallet/rpc/coins.cpp

src/wallet/rpc/encrypt.cpp

src/wallet/rpc/signmessage.cpp

src/wallet/rpc/util.cpp

src/wallet/rpc/util.h

src/wallet/coincontrol.cpp

src/wallet/coincontrol.h

src/wallet/context.cpp

src/wallet/context.h

src/wallet/crypter.cpp

src/wallet/crypter.h

src/wallet/db.cpp

src/wallet/export.cpp

src/wallet/external_signer_scriptpubkeyman.cpp

src/wallet/rpc/spend.cpp

src/wallet/rpc/transactions.cpp

src/wallet/rpc/wallet.cpp

src/wallet/feebumper.cpp

src/wallet/feebumper.h

src/index/base.h

src/index/base.cpp

src/index/txindex.h

src/index/txindex.cpp

src/index/txindex_key.h

src/index/txospenderindex.h

src/index/txospenderindex.cpp

src/index/blockfilterindex.h

src/index/blockfilterindex.cpp

src/index/coinstatsindex.h

src/index/coinstatsindex.cpp

src/index/db_key.h

src/index/disktxpos.h

src/kernel/chain.cpp

src/kernel/chain.h

src/kernel/checks.cpp

src/kernel/checks.h

src/kernel/context.cpp

src/kernel/context.h

src/kernel/cs_main.cpp

src/kernel/cs_main.h

src/kernel/disconnected_transactions.cpp

src/kernel/disconnected_transactions.h

src/kernel/mempool_removal_reason.cpp

src/kernel/mempool_removal_reason.h

src/kernel/coinstats.cpp

src/kernel/coinstats.h

src/kernel/chainparams.cpp

src/kernel/chainparams.h

src/wallet/sqlite.cpp

src/wallet/sqlite.h

src/wallet/transaction.cpp

src/wallet/transaction.h

src/wallet/dump.cpp

src/wallet/dump.h

src/wallet/init.cpp

src/wallet/walletutil.cpp

src/wallet/walletutil.h

src/wallet/wallettool.cpp

src/wallet/wallettool.h

src/wallet/export.h

src/wallet/migrate.cpp

src/wallet/migrate.h

src/wallet/db.h

src/wallet/walletdb.cpp

src/wallet/interfaces.cpp

src/wallet/scriptpubkeyman.cpp

src/wallet/scriptpubkeyman.h

src/kernel/bitcoinkernel.cpp

src/kernel/bitcoinkernel.h

src/kernel/bitcoinkernel_wrapper.h

src/node/chainstate.cpp

src/node/chainstate.h

src/node/blockstorage.cpp

src/node/blockstorage.h

src/node/mempool_persist.cpp

src/node/mempool_persist.h

src/node/utxo_snapshot.cpp

src/node/utxo_snapshot.h

src/node/kernel_notifications.cpp

src/node/kernel_notifications.h

src/node/blockmanager_args.cpp

src/kernel/blockmanager_opts.h

src/util/expected.cpp

src/policy/settings.h

src/util/types.h

src/kernel/messagestartchars.h

src/kernel/warning.h

src/util/exception.h

src/common/license_info.h

src/node/coins_view_args.h

src/node/database_args.h

src/util/batchpriority.h

src/util/ui_change_type.h

src/node/coins_view_args.cpp

src/node/peerman_args.h

src/util/serfloat.h

src/node/blockmanager_args.h

src/node/database_args.cpp

src/util/overloaded.h

src/interfaces/types.h

src/node/chainstatemanager_args.h

src/node/minisketchwrapper.h

src/util/macros.h

src/util/syserror.h

src/common/run_command.h

src/util/bytevectorhash.cpp

src/node/mempool_persist_args.cpp

src/util/exec.h

src/util/rbf.h

src/crypto/hex_base.h

src/node/mempool_persist_args.h

src/interfaces/echo.h

src/util/any.h

src/util/batchpriority.cpp

src/util/threadnames.h

src/node/coin.h

src/node/mempool_args.h

src/util/asmap.h

src/util/bytevectorhash.h

src/node/context.cpp

src/util/insert.h

src/util/readwritefile.h

src/node/peerman_args.cpp

src/node/interface_ui.cpp

src/interfaces/handler.h

src/node/mining_args.h

src/util/hasher.cpp

src/common/init.h

src/kernel/mempool_limits.h

src/common/system.h

src/crypto/sha3.h

src/util/threadinterrupt.cpp

src/node/protocol_version.h

src/util/exception.cpp

src/common/messages.h

src/node/connection_types.cpp

src/util/bip32.h

src/common/license_info.cpp

src/util/stdmutex.h

src/common/run_command.cpp

src/util/check.cpp

src/util/golombrice.h

src/node/types.h

src/node/timeoffsets.h

src/util/readwritefile.cpp

src/util/fastrange.h

src/util/signalinterrupt.h

src/util/task_runner.h

src/util/syserror.cpp

src/common/interfaces.cpp

src/common/types.h

src/util/threadinterrupt.h

src/kernel/chainstatemanager_opts.h

src/node/psbt.h

src/policy/ephemeral_policy.h

src/util/trace.h

src/common/url.cpp

src/kernel/mempool_options.h

src/util/serfloat.cpp

src/kernel/notifications_interface.h

src/node/timeoffsets.cpp

src/node/warnings.cpp

src/util/hash_type.h

src/crypto/hex_base.cpp

src/node/eviction.h

src/util/tokenbucket.h

src/crypto/aes.h

src/common/pcp.h

src/util/feefrac.cpp

src/node/transaction.h

src/util/threadnames.cpp

src/common/signmessage.h

src/util/exec.cpp

src/util/signalinterrupt.cpp

src/clientversion.cpp

src/common/signmessage.cpp

src/compat/assumptions.h

src/compat/byteswap.h

src/deploymentinfo.cpp

src/deploymentinfo.h

src/deploymentstatus.cpp

src/deploymentstatus.h

src/dummywallet.cpp

src/external_signer.h

src/init/bitcoin-gui.cpp

src/init/bitcoin-node.cpp

src/init/bitcoin-qt.cpp

src/init/bitcoin-wallet.cpp

src/init/bitcoind.cpp

src/init/common.h

src/interfaces/init.h

src/interfaces/ipc.h

src/key_io.h

src/logging/categories.h

src/logging/timer.h

src/mapport.h

src/musig.h

src/net_permissions.h

src/netgroup.h

src/netmessagemaker.h

src/node/chainstatemanager_args.cpp

src/node/connection_types.h

src/node/context.h

src/node/interface_ui.h

src/node/mempool_args.cpp

src/node/mining_args.cpp

src/node/minisketchwrapper.cpp

src/node/txreconciliation.h

src/policy/fees/estimator_args.cpp

src/policy/fees/estimator_args.h

src/policy/fees/estimator_man.cpp

src/policy/fees/estimator_man.h

src/policy/packages.h

src/policy/rbf.h

src/policy/truc_policy.h

src/pow.h

src/primitives/block.cpp

src/randomenv.h

src/rest.h

src/script/keyorigin.h

src/script/parsing.cpp

src/script/parsing.h

src/script/script_error.h

src/script/sigcache.cpp

src/script/sigcache.h

src/script/solver.h

src/script/verify_flags.h

src/semaphore_grant.h

src/signet.h

src/span.h

src/support/allocators/secure.h

src/support/allocators/zeroafterfree.h

src/util/tokenpipe.cpp

src/util/translation.h

src/util/vector.h

src/versionbits.h

src/versionbits_impl.h

src/wallet/external_signer_scriptpubkeyman.h

src/wallet/fees.h

src/wallet/load.h

src/wallet/receive.h

src/wallet/rpc/wallet.h

src/wallet/types.h

src/walletinitinterface.h

src/zmq/zmqabstractnotifier.cpp

Independent explanations by MyBitcoinExplorer. Not affiliated with or endorsed by Bitcoin Core. Guides are educational and do not replace the source or its tests.

Bitcoin Core source © its contributors, distributed under the MIT license. Original notices and bundled third-party licenses are retained in the source tree.