Experimental musig2 python code, not for production use! This is just for testing things out.

All public keys are encoded as 32 bytes, assuming an even y coordinate, as in BIP-340.

Signatures are 64 bytes. The first 32 bytes encode the x-coordinate of the point R (which is again assumed to have an even y coordinate). The second 32 bytes encode the integer s. This makes them compatible with BIP-340, and hence valid as BIP-341 Taproot Schnorr signatures.


  1. First generate a public and private keypair:
> python3 keygen
Your public key: 666e941a926819cb0ea0147a98531cf99e179ca1fc1d8b4dbd6fb9b198fc4f49

This will create a file secret.key containing the secret key for the above public key. Keep this safe.

  1. Generate nonces:
> python3 noncegen
Your nonces:

This will also create a file secret_nonces containing the secrets corresponding to these nonces.

  1. Send your public key and two nonces to all other participants in the multisig.
  2. Receive from all participants their public keys and create a file called public_keys containing all these keys (including your own). The order is not important. For example:
  1. Generate the aggregate public key:
> python3 aggregatekeys
Aggregate public key: 9875f69e3368d774743d78f80603a05270d4cc72dff90645fadb9a09ec5ebf37

This public key does not depend on the nonces for this session, and will remain the same even if all participants delete their secret_nonces files and generate new nonces. This will be the final public key used for verification of the signature.

  1. Receive from all participants their nonces for this signing session, and create a file called public_nonces containing all these nonce pairs. The two nonces from each participant must be kept in order, but the order of the participants is not important. For example:
  1. Create a file called message containing the message you wish to sign. The contents of the file are interpreted as bytes, not as a string. Then use the sign command to generate a partial signature.
> cat message
hello world
> python3 sign
Aggregate key: 9875f69e3368d774743d78f80603a05270d4cc72dff90645fadb9a09ec5ebf37
Signature R: 90753c99410a4a8b111af67569d6fa56b2b45424d16f2c2950653a0c7c7fcee8
Partial signature s_1: 08348189f0f2cec03bc49b5acafeded13982a9cacc6fab758aa050114a8dc9b5
  1. Send the partial signature s_1 to all other parties and receive their partial signatures. Create a file called s_values containing all these partial signatures (order does not matter):
  1. Aggregate the partial signatures:
> python3 aggregatesignature
Hex-encoded signature: 90753c99410a4a8b111af67569d6fa56b2b45424d16f2c2950653a0c7c7fcee8f828bec7167924307a4c71f0670d248f07f2086fcd5f9468896c0e34a40e41c2
  1. Verify the signature created:
> python3 verify 9875f69e3368d774743d78f80603a05270d4cc72dff90645fadb9a09ec5ebf37 90753c99410a4a8b111af67569d6fa56b2b45424d16f2c2950653a0c7c7fcee8f828bec7167924307a4c71f0670d248f07f2086fcd5f9468896c0e34a40e41c2
Signature is valid: True

The format for the verification command is verify <public key> <signature>


This repository includes two types of tests. The unit tests are run on specific functions to ensure individual components are working correctly.

> python3
test_seckey_gen PASSED
test_read_write_bytes PASSED
test_compute_R PASSED
test_aggregate_nonces PASSED
test_aggregate_public_keys PASSED

The functional tests run the code externally simulating multiple users in a key establishment and signing session.

> python3
X: ac4a3b78a1368de26f96346cdf87149a2e2d6201b14559120f73c78b1b8253c3
S: 3d18300bbcac308f7f860cc263fe0cafd8a54c0b0a18c953b3f5884dd5012e03bcc45d03cab195223bc6bf98f85f7a4ac33a29eb1d46faac172aec9649cfa678
Signature is valid: True
GitHub - meshcollider/musig2-py at
Experimental musig2 python code, not for production use! - GitHub - meshcollider/musig2-py at