Multisignatures

Cryptography · Axiom Academy

How multiple parties can jointly create a single compact signature In a multisignature scheme, n parties each with their own secret key can jointly produce a single signature that proves all parties approved the message. This animation shows three parties (Alice, Bob, and Carol) each with their own key pair, jointly creating one multisignature: Compact size: One signature regardless of number of signers Efficient verification: Single verification operation Privacy: Doesn't reveal how many parties signed Bandwidth savings: Critical for blockchain applications 2. The Rogue Key Attack Problem A naive approach might be to simply add public keys and signatures together. Unfortunately, this is vulnerable to rogue key attacks . In the naive approach, if Alice and Bob's public keys are X₁ and X₂, the aggregated key is simply X̃ = X₁ + X₂. Watch how Eve can exploit this: Eve sets her public key to X_E = X - X_A where X is a key she controls. Then the aggregate becomes X̃ = X_A + X_E = X_A + (X - X_A) = X, giving Eve full control! 3. MuSig Protocol: Secure Key Aggregation The MuSig protocol (for Schnorr signatures) solves the rogue key attack by using unique coefficients for each public key based on a hash of all keys. Step 1: Key Aggregation with Coefficients Each party's public key X_i is multiplied by a coefficient a_i derived from hashing all public keys: This animation shows how coefficients prevent the rogue key attack:

This is the written version of the interactive lesson above. See the full Cryptography course.