Why Multisig is Important – And How to do it Right
summary
Explains why multisig is essential for redundancy, atomic swaps and decentralized custody, shows concrete attacks and fixes: a rogue key attack on naive key aggregation, Wagner/Grover collisions that broke early MuSig, and the move to MuSig2 (two nonces + binding). Covers Schnorr/CLSAG math, Monero-specific burning bug (duplicate stealth outputs) and the fix: output keys derived by hashing with key images plus leader entropy. Mentions a binomial multisig PR, an ongoing Rhino audit, and a Rust Frost multisig library that is published but not yet safe for production.
AI-written summary · about
chapters (13)
- 0:00Multisig security benefits
- 1:11Multisig in cryptocurrency
- 2:35Elliptic curve basics for multisig
- 4:00Doing multisig right with key aggregation
- 5:44Schnorr signatures in multisig
- 8:36Insecure MuSig and Wagner's attack
- 11:05MuSig 2 secure protocols
- 12:10Monero complexities and burning bug
- 13:53Preventing Monero multisig attacks
- 15:38Monero multisig state and fixes
- 16:43Future of multisig with Frost
- 17:24Why multisig matters for Monero
- 18:08Q&A on multisig risks
related talks
27mMulti Vendor Multisig
14mAdvanced On-chain Security: Multisig & More
31mPanel 2: Hard things we forget to talk about
28mRecent Developments on Multi-Party Schnorr Signatures
18mLearn how to use Bitcoin Multi-sig!
21mFuture of Multisigs
32mSome useful bits: A few solved development problems via Crypto
23mBreaking Watchman: Pushing the Limits on Federated Hot Wallet Security