READ THE CODE

Inside Bitcoin

The code behind the network, with room to understand it.

Stable release v32.1bitcoin/bitcoin · f0de87f04062 ↗3,020 source files · 47.5 MB stored on the server440 file guides

Release published 2026-10-28 · Snapshot fetched 2026-11-01. Latest stable release at fetch time; development branches and Git history are excluded. Only the selected code window and visible folders load here.

28,115 bytes · SHA-256 b7e7772dfc78585d… · View upstream ↗

1#ifndef SECP256K1_MUSIG_H
2#define SECP256K1_MUSIG_H
3
4#include "secp256k1_extrakeys.h"
5
6#ifdef __cplusplus
7extern "C" {
8#endif
9
10#include <stddef.h>
11#include <stdint.h>
12
13/** This module implements BIP 327 "MuSig2 for BIP340-compatible
14 *  Multi-Signatures"
15 *  (https://github.com/bitcoin/bips/blob/master/bip-0327.mediawiki)
16 *  v1.0.0. You can find an example demonstrating the musig module in
17 *  examples/musig.c.
18 *
19 *  The module also supports BIP 341 ("Taproot") public key tweaking.
20 *
21 *  It is recommended to read the documentation in this include file carefully.
22 *  Further notes on API usage can be found in doc/musig.md
23 *
24 *  Since the first version of MuSig is essentially replaced by MuSig2, we use
25 *  MuSig, musig and MuSig2 synonymously unless noted otherwise.
26 */
27
28/** Opaque data structures
29 *
30 *  The exact representation of data inside the opaque data structures is
31 *  implementation defined and not guaranteed to be portable between different
32 *  platforms or versions. With the exception of `secp256k1_musig_secnonce`, the
33 *  data structures can be safely copied/moved. If you need to convert to a
34 *  format suitable for storage, transmission, or comparison, use the
35 *  corresponding serialization and parsing functions.
36 */
37
38/** Opaque data structure that caches information about public key aggregation.
39 *
40 *  Guaranteed to be 197 bytes in size. No serialization and parsing functions
41 *  (yet).
42 */
43typedef struct secp256k1_musig_keyagg_cache {
44    unsigned char data[197];
45} secp256k1_musig_keyagg_cache;
46
47/** Opaque data structure that holds a signer's _secret_ nonce.
48 *
49 *  Guaranteed to be 132 bytes in size.
50 *
51 *  WARNING: This structure MUST NOT be copied or read or written to directly. A
52 *  signer who is online throughout the whole process and can keep this
53 *  structure in memory can use the provided API functions for a safe standard
54 *  workflow.
55 *
56 *  Copying this data structure can result in nonce reuse which will leak the
57 *  secret signing key.
58 */
59typedef struct secp256k1_musig_secnonce {
60    unsigned char data[132];
61} secp256k1_musig_secnonce;
62
63/** Opaque data structure that holds a signer's public nonce.
64 *
65 *  Guaranteed to be 132 bytes in size. Serialized and parsed with
66 *  `musig_pubnonce_serialize` and `musig_pubnonce_parse`.
67 */
68typedef struct secp256k1_musig_pubnonce {
69    unsigned char data[132];
70} secp256k1_musig_pubnonce;
71
72/** Opaque data structure that holds an aggregate public nonce.
73 *
74 *  Guaranteed to be 132 bytes in size. Serialized and parsed with
75 *  `musig_aggnonce_serialize` and `musig_aggnonce_parse`.
76 */
77typedef struct secp256k1_musig_aggnonce {
78    unsigned char data[132];
79} secp256k1_musig_aggnonce;
80
81/** Opaque data structure that holds a MuSig session.
82 *
83 *  This structure is not required to be kept secret for the signing protocol to
84 *  be secure. Guaranteed to be 133 bytes in size. No serialization and parsing
85 *  functions (yet).
86 */
87typedef struct secp256k1_musig_session {
88    unsigned char data[133];
89} secp256k1_musig_session;
90
91/** Opaque data structure that holds a partial MuSig signature.
92 *
93 *  Guaranteed to be 36 bytes in size. Serialized and parsed with
94 *  `musig_partial_sig_serialize` and `musig_partial_sig_parse`.
95 */
96typedef struct secp256k1_musig_partial_sig {
97    unsigned char data[36];
98} secp256k1_musig_partial_sig;
99
100/** Parse a signer's public nonce.
101 *
102 *  Returns: 1 when the nonce could be parsed, 0 otherwise.
103 *  Args:    ctx: pointer to a context object
104 *  Out:   nonce: pointer to a nonce object
105 *  In:     in66: pointer to the 66-byte nonce to be parsed
106 */
107SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_musig_pubnonce_parse(
108    const secp256k1_context *ctx,
109    secp256k1_musig_pubnonce *nonce,
110    const unsigned char *in66
111) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
112
113/** Serialize a signer's public nonce
114 *
115 *  Returns: 1 always
116 *  Args:    ctx: pointer to a context object
117 *  Out:   out66: pointer to a 66-byte array to store the serialized nonce
118 *  In:    nonce: pointer to the nonce
119 */
120SECP256K1_API int secp256k1_musig_pubnonce_serialize(
121    const secp256k1_context *ctx,
122    unsigned char *out66,
123    const secp256k1_musig_pubnonce *nonce
124) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
125
126/** Parse an aggregate public nonce.
127 *
128 *  Returns: 1 when the nonce could be parsed, 0 otherwise.
129 *  Args:    ctx: pointer to a context object
130 *  Out:   nonce: pointer to a nonce object
131 *  In:     in66: pointer to the 66-byte nonce to be parsed
132 */
133SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_musig_aggnonce_parse(
134    const secp256k1_context *ctx,
135    secp256k1_musig_aggnonce *nonce,
136    const unsigned char *in66
137) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
138
139/** Serialize an aggregate public nonce
140 *
141 *  Returns: 1 always
142 *  Args:    ctx: pointer to a context object
143 *  Out:   out66: pointer to a 66-byte array to store the serialized nonce
144 *  In:    nonce: pointer to the nonce
145 */
146SECP256K1_API int secp256k1_musig_aggnonce_serialize(
147    const secp256k1_context *ctx,
148    unsigned char *out66,
149    const secp256k1_musig_aggnonce *nonce
150) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
151
152/** Parse a MuSig partial signature.
153 *
154 *  Returns: 1 when the signature could be parsed, 0 otherwise.
155 *  Args:    ctx: pointer to a context object
156 *  Out:     sig: pointer to a signature object
157 *  In:     in32: pointer to the 32-byte signature to be parsed
158 */
159SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_musig_partial_sig_parse(
160    const secp256k1_context *ctx,
161    secp256k1_musig_partial_sig *sig,
162    const unsigned char *in32
163) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
164
165/** Serialize a MuSig partial signature
166 *
167 *  Returns: 1 always
168 *  Args:    ctx: pointer to a context object
169 *  Out:   out32: pointer to a 32-byte array to store the serialized signature
170 *  In:      sig: pointer to the signature
171 */
172SECP256K1_API int secp256k1_musig_partial_sig_serialize(
173    const secp256k1_context *ctx,
174    unsigned char *out32,
175    const secp256k1_musig_partial_sig *sig
176) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
177
178/** Computes an aggregate public key and uses it to initialize a keyagg_cache
179 *
180 *  Different orders of `pubkeys` result in different `agg_pk`s.
181 *
182 *  Before aggregating, the pubkeys can be sorted with `secp256k1_ec_pubkey_sort`
183 *  which ensures the same `agg_pk` result for the same multiset of pubkeys.
184 *  This is useful to do before `pubkey_agg`, such that the order of pubkeys
185 *  does not affect the aggregate public key.
186 *
187 *  Returns: 0 if the arguments are invalid, 1 otherwise
188 *  Args:        ctx: pointer to a context object
189 *  Out:      agg_pk: the MuSig-aggregated x-only public key. If you do not need it,
190 *                    this arg can be NULL.
191 *      keyagg_cache: if non-NULL, pointer to a musig_keyagg_cache struct that
192 *                    is required for signing (or observing the signing session
193 *                    and verifying partial signatures).
194 *   In:     pubkeys: input array of pointers to public keys to aggregate. The order
195 *                    is important; a different order will result in a different
196 *                    aggregate public key.
197 *         n_pubkeys: length of pubkeys array. Must be greater than 0.
198 */
199SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_musig_pubkey_agg(
200    const secp256k1_context *ctx,
201    secp256k1_xonly_pubkey *agg_pk,
202    secp256k1_musig_keyagg_cache *keyagg_cache,
203    const secp256k1_pubkey * const *pubkeys,
204    size_t n_pubkeys
205) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(4);
206
207/** Obtain the aggregate public key from a keyagg_cache.
208 *
209 *  This is only useful if you need the non-xonly public key, in particular for
210 *  plain (non-xonly) tweaking or batch-verifying multiple key aggregations
211 *  (not implemented).
212 *
213 *  Returns: 0 if the arguments are invalid, 1 otherwise
214 *  Args:        ctx: pointer to a context object
215 *  Out:      agg_pk: the MuSig-aggregated public key.
216 *  In: keyagg_cache: pointer to a `musig_keyagg_cache` struct initialized by
217 *                    `musig_pubkey_agg`
218 */
219SECP256K1_API SECP256K1_WARN_UNUSED_RESULT int secp256k1_musig_pubkey_get(
220    const secp256k1_context *ctx,
221    secp256k1_pubkey *agg_pk,
222    const secp256k1_musig_keyagg_cache *keyagg_cache
223) SECP256K1_ARG_NONNULL(1) SECP256K1_ARG_NONNULL(2) SECP256K1_ARG_NONNULL(3);
224
225/** Apply plain "EC" tweaking to a public key in a given keyagg_cache by adding
226 *  the generator multiplied with `tweak32` to it. This is useful for deriving
227 *  child keys from an aggregate public key via BIP 32 where `tweak32` is set to
228 *  a hash as defined in BIP 32.
229 *
230 *  Callers are responsible for deriving `tweak32` in a way that does not reduce
231 *  the security of MuSig (for example, by following BIP 32).
232 *
233 *  The tweaking method is the same as `secp256k1_ec_pubkey_tweak_add`. So after
234 *  the following pseudocode buf and buf2 have identical contents (absent
235 *  earlier failures).
236 *
237 *  secp256k1_musig_pubkey_agg(..., keyagg_cache, pubkeys, ...)
238 *  secp256k1_musig_pubkey_get(..., agg_pk, keyagg_cache)
239 *  secp256k1_musig_pubkey_ec_tweak_add(..., output_pk, tweak32, keyagg_cache)
240 *  secp256k1_ec_pubkey_serialize(..., buf, ..., output_pk, ...)
241 *  secp256k1_ec_pubkey_tweak_add(..., agg_pk, tweak32)
242 *  secp256k1_ec_pubkey_serialize(..., buf2, ..., agg_pk, ...)
243 *
244 *  This function is required if you want to _sign_ for a tweaked aggregate key.
245 *  If you are only computing a public key but not intending to create a
246 *  signature for it, use `secp256k1_ec_pubkey_tweak_add` instead.
247 *
248 *  Returns: 0 if the arguments are invalid, 1 otherwise
249 *  Args:            ctx: pointer to a context object
250 *  Out:   output_pubkey: pointer to a public key to store the result. Will be set

src/wallet/receive.cpp

src/wallet/coinselection.cpp

src/consensus/validation.h

src/primitives/transaction.cpp

src/script/descriptor.cpp

src/bitcoin-cli.cpp

src/rpc/blockchain.cpp

src/rpc/rawtransaction.cpp

src/init.cpp

src/crypto/sha256.cpp

src/consensus/merkle.h

src/consensus/tx_check.h

src/consensus/tx_verify.h

src/policy/feerate.h

src/policy/feerate.cpp

src/primitives/transaction_identifier.h

src/chainparamsbase.h

src/chainparamsbase.cpp

src/util/moneystr.cpp

src/crypto/ripemd160.h

src/crypto/sha1.h

src/crypto/sha512.h

src/crypto/hmac_sha256.h

src/crypto/hmac_sha512.h

src/crypto/hmac_sha256.cpp

src/crypto/hmac_sha512.cpp

src/crypto/hkdf_sha256_32.h

src/crypto/hkdf_sha256_32.cpp

src/support/cleanse.h

src/support/cleanse.cpp

src/crypto/siphash.cpp

src/crypto/muhash.h

src/crypto/chacha20.h

src/crypto/poly1305.h

src/crypto/chacha20poly1305.h

src/crypto/chacha20poly1305.cpp

src/util/chaintype.cpp

src/util/obfuscation.h

src/util/byte_units.h

src/util/overflow.h

src/blockencodings.cpp

src/net_permissions.cpp

src/policy/packages.cpp

src/policy/rbf.cpp

src/policy/truc_policy.cpp

src/policy/ephemeral_policy.cpp

src/policy/settings.cpp

src/policy/policy.cpp

src/node/transaction.cpp

src/node/coin.cpp

src/rpc/client.cpp

src/rpc/external_signer.cpp

src/rpc/request.cpp

src/rpc/server_util.cpp

src/rpc/fees.cpp

src/rpc/output_script.cpp

src/rpc/rawtransaction_util.cpp

src/rpc/rawtransaction_util.h

src/rpc/register.h

src/rpc/request.h

src/rpc/server_util.h

src/rpc/protocol.h

src/rpc/server.h

src/rpc/signmessage.cpp

src/rpc/txoutproof.cpp

src/rpc/util.cpp

src/rpc/util.h

src/wallet/rpc/addresses.cpp

src/wallet/rpc/backup.cpp

src/wallet/rpc/coins.cpp

src/wallet/rpc/encrypt.cpp

src/wallet/rpc/signmessage.cpp

src/wallet/rpc/util.cpp

src/wallet/rpc/util.h

src/wallet/coincontrol.cpp

src/wallet/coincontrol.h

src/wallet/context.cpp

src/wallet/context.h

src/wallet/crypter.cpp

src/wallet/crypter.h

src/wallet/db.cpp

src/wallet/export.cpp

src/wallet/external_signer_scriptpubkeyman.cpp

src/wallet/rpc/spend.cpp

src/wallet/rpc/transactions.cpp

src/wallet/rpc/wallet.cpp

src/wallet/feebumper.cpp

src/wallet/feebumper.h

src/index/base.h

src/index/base.cpp

src/index/txindex.h

src/index/txindex.cpp

src/index/txindex_key.h

src/index/txospenderindex.h

src/index/txospenderindex.cpp

src/index/blockfilterindex.h

src/index/blockfilterindex.cpp

src/index/coinstatsindex.h

src/index/coinstatsindex.cpp

src/index/db_key.h

src/index/disktxpos.h

src/kernel/chain.cpp

src/kernel/chain.h

src/kernel/checks.cpp

src/kernel/checks.h

src/kernel/context.cpp

src/kernel/context.h

src/kernel/cs_main.cpp

src/kernel/cs_main.h

src/kernel/disconnected_transactions.cpp

src/kernel/disconnected_transactions.h

src/kernel/mempool_removal_reason.cpp

src/kernel/mempool_removal_reason.h

src/kernel/coinstats.cpp

src/kernel/coinstats.h

src/kernel/chainparams.cpp

src/kernel/chainparams.h

src/wallet/sqlite.cpp

src/wallet/sqlite.h

src/wallet/transaction.cpp

src/wallet/transaction.h

src/wallet/dump.cpp

src/wallet/dump.h

src/wallet/init.cpp

src/wallet/walletutil.cpp

src/wallet/walletutil.h

src/wallet/wallettool.cpp

src/wallet/wallettool.h

src/wallet/export.h

src/wallet/migrate.cpp

src/wallet/migrate.h

src/wallet/db.h

src/wallet/walletdb.cpp

src/wallet/interfaces.cpp

src/wallet/scriptpubkeyman.cpp

src/wallet/scriptpubkeyman.h

src/kernel/bitcoinkernel.cpp

src/kernel/bitcoinkernel.h

src/kernel/bitcoinkernel_wrapper.h

src/node/chainstate.cpp

src/node/chainstate.h

src/node/blockstorage.cpp

src/node/blockstorage.h

src/node/mempool_persist.cpp

src/node/mempool_persist.h

src/node/utxo_snapshot.cpp

src/node/utxo_snapshot.h

src/node/kernel_notifications.cpp

src/node/kernel_notifications.h

src/node/blockmanager_args.cpp

src/kernel/blockmanager_opts.h

src/util/expected.cpp

src/policy/settings.h

src/util/types.h

src/kernel/messagestartchars.h

src/kernel/warning.h

src/util/exception.h

src/common/license_info.h

src/node/coins_view_args.h

src/node/database_args.h

src/util/batchpriority.h

src/util/ui_change_type.h

src/node/coins_view_args.cpp

src/node/peerman_args.h

src/util/serfloat.h

src/node/blockmanager_args.h

src/node/database_args.cpp

src/util/overloaded.h

src/interfaces/types.h

src/node/chainstatemanager_args.h

src/node/minisketchwrapper.h

src/util/macros.h

src/util/syserror.h

src/common/run_command.h

src/util/bytevectorhash.cpp

src/node/mempool_persist_args.cpp

src/util/exec.h

src/util/rbf.h

src/crypto/hex_base.h

src/node/mempool_persist_args.h

src/interfaces/echo.h

src/util/any.h

src/util/batchpriority.cpp

src/util/threadnames.h

src/node/coin.h

src/node/mempool_args.h

src/util/asmap.h

src/util/bytevectorhash.h

src/node/context.cpp

src/util/insert.h

src/util/readwritefile.h

src/node/peerman_args.cpp

src/node/interface_ui.cpp

src/interfaces/handler.h

src/node/mining_args.h

src/util/hasher.cpp

src/common/init.h

src/kernel/mempool_limits.h

src/common/system.h

src/crypto/sha3.h

src/util/threadinterrupt.cpp

src/node/protocol_version.h

src/util/exception.cpp

src/common/messages.h

src/node/connection_types.cpp

src/util/bip32.h

src/common/license_info.cpp

src/util/stdmutex.h

src/common/run_command.cpp

src/util/check.cpp

src/util/golombrice.h

src/node/types.h

src/node/timeoffsets.h

src/util/readwritefile.cpp

src/util/fastrange.h

src/util/signalinterrupt.h

src/util/task_runner.h

src/util/syserror.cpp

src/common/interfaces.cpp

src/common/types.h

src/util/threadinterrupt.h

src/kernel/chainstatemanager_opts.h

src/node/psbt.h

src/policy/ephemeral_policy.h

src/util/trace.h

src/common/url.cpp

src/kernel/mempool_options.h

src/util/serfloat.cpp

src/kernel/notifications_interface.h

src/node/timeoffsets.cpp

src/node/warnings.cpp

src/util/hash_type.h

src/crypto/hex_base.cpp

src/node/eviction.h

src/util/tokenbucket.h

src/crypto/aes.h

src/common/pcp.h

src/util/feefrac.cpp

src/node/transaction.h

src/util/threadnames.cpp

src/common/signmessage.h

src/util/exec.cpp

src/util/signalinterrupt.cpp

src/clientversion.cpp

src/common/signmessage.cpp

src/compat/assumptions.h

src/compat/byteswap.h

src/deploymentinfo.cpp

src/deploymentinfo.h

src/deploymentstatus.cpp

src/deploymentstatus.h

src/dummywallet.cpp

src/external_signer.h

src/init/bitcoin-gui.cpp

src/init/bitcoin-node.cpp

src/init/bitcoin-qt.cpp

src/init/bitcoin-wallet.cpp

src/init/bitcoind.cpp

src/init/common.h

src/interfaces/init.h

src/interfaces/ipc.h

src/key_io.h

src/logging/categories.h

src/logging/timer.h

src/mapport.h

src/musig.h

src/net_permissions.h

src/netgroup.h

src/netmessagemaker.h

src/node/chainstatemanager_args.cpp

src/node/connection_types.h

src/node/context.h

src/node/interface_ui.h

src/node/mempool_args.cpp

src/node/mining_args.cpp

src/node/minisketchwrapper.cpp

src/node/txreconciliation.h

src/policy/fees/estimator_args.cpp

src/policy/fees/estimator_args.h

src/policy/fees/estimator_man.cpp

src/policy/fees/estimator_man.h

src/policy/packages.h

src/policy/rbf.h

src/policy/truc_policy.h

src/pow.h

src/primitives/block.cpp

src/randomenv.h

src/rest.h

src/script/keyorigin.h

src/script/parsing.cpp

src/script/parsing.h

src/script/script_error.h

src/script/sigcache.cpp

src/script/sigcache.h

src/script/solver.h

src/script/verify_flags.h

src/semaphore_grant.h

src/signet.h

src/span.h

src/support/allocators/secure.h

src/support/allocators/zeroafterfree.h

src/util/tokenpipe.cpp

src/util/translation.h

src/util/vector.h

src/versionbits.h

src/versionbits_impl.h

src/wallet/external_signer_scriptpubkeyman.h

src/wallet/fees.h

src/wallet/load.h

src/wallet/receive.h

src/wallet/rpc/wallet.h

src/wallet/types.h

src/walletinitinterface.h

src/zmq/zmqabstractnotifier.cpp

Independent explanations by MyBitcoinExplorer. Not affiliated with or endorsed by Bitcoin Core. Guides are educational and do not replace the source or its tests.

Bitcoin Core source © its contributors, distributed under the MIT license. Original notices and bundled third-party licenses are retained in the source tree.