Save Fees with MuSig2 at BitGo
A year and a half (about 85,000 blocks) ago, we launched support for Taproot on BitGo wallets, concurrent with bitcoin’s Taproot soft fork activation. A major benefit of Taproot is enabling multi-signature protocols such as MuSig2, which promise significant fee savings. We wrote, “we’re very excited to release MuSig2 support in the near future, which will be an automatic and seamless upgrade for existing wallets with Taproot UTXOs.” None of that turned out to be true. The MuSig2 specification wasn’t standardized until March of this year, and the standard uses a slightly (but importantly) different key aggregation function than the draft we implemented. With MuSig2 now accepted as BIP-0327, we are very excited to launch Taproot MuSig2 on BitGo bitcoin hot wallets.
Background
Bitcoin’s Taproot soft fork added Schnorr BIP-0340 as a new method for creating and validating the signatures which authorize most movements of bitcoin. These new digital signatures are expressed more compactly (in 64–65 bytes, instead of 72–73 bytes). More importantly Schnorr signatures are “linear”, which makes the creation of aggregate keys and corresponding signatures much simpler than the non-linear ECDSA signatures originally used on bitcoin. Aggregating multiple keys and signatures into a single key and signature that appear on chain is a big efficiency gain for multi-signature transactions like those sent from BitGo wallets.
Several key aggregation and signing protocols have been proposed to take advantage of Schnorr signatures. Two of these are now widely reviewed and on the path to having accepted specifications: MuSig2 (paper) and FROST (paper). MuSig2 is a multi-signature protocol, i.e. all signers involved in the aggregate key must collaborate to produce a valid signature for the aggregate key. FROST is a threshold signature protocol, i.e. a chosen threshold, less than or equal to all signers involved in the aggregate key, must collaborate to produce a valid signature for the aggregate key. MuSig2 is a much simpler protocol, does not require interactive key aggregation, and has a security proof relying on a more widely accepted assumption.
The Taproot soft fork also added support for Merklized script trees, as specified in BIP-0341. These script trees can be combined with a key path condition to create a rich set of spending conditions on any bitcoin locked using Taproot. By combining MuSig2’s simple multi-signature protocol with the Merklized script tree of Taproot, we are able to offer BitGo’s 2-of-3 hot wallet experience for bitcoin without compromise.
Bitcoin Addresses at BitGo
BitGo wallets support sending and receiving to all bitcoin address types. Let’s compare our receiving/change address types to understand the trade-offs of each:
Fees
As you can see, for the BitGo / User key path Taproot MuSig2 inputs save 47 vBytes per input over the next smallest (Native SegWit). This results in a 30% fee saving compared to Native SegWit. Compared to Wrapped SegWit, Taproot MuSig2 saves 43% in fees. With Taproot MuSig2 inputs, script spend paths involving the backup key take a small (3 virtual byte, 2%) penalty compared to Native SegWit.
Signing
When spending a Taproot MuSig2 input with the BitGo / User key path, 2 round trips between the signers are needed: First each signer provides a nonce, and then each provides a signature. This, combined with the fee trade-offs mentioned above make Taproot MuSig2 addresses best for hot wallets where the majority spending is done using the BitGo / User key path. For cold wallets where keys are offline, or where Backup spends are more common, Native SegWit remains the best address type.
Privacy
Another benefit of Taproot MuSig2 spends using the BitGo / User key path is that they do not reveal the existence of other spending paths. This means that both addresses and spends using this path are indistinguishable from single signature Taproot spends. Users of BitGo wallets have long been statistically identifiable as BitGo users on chain because BitGo wallets produce the most 2-of-3 spends. Users of Taproot MuSig2 key path spends will no longer be automatically pooled with 2-of-3 wallets, but rather with all other Taproot key path spends no matter what other conditions may have been available.
Wallet Support
A final word of caution about Taproot MuSig2 addresses: Not all wallets support sending to Taproot addresses yet. We recommend against using Taproot Keypath receiving addresses if you expect to receive funds from one of the wallets that does not support them. Note, you can still take advantage of Taproot Keypath change addresses in this case.
How and when can I use MuSig2?
Right now Taproot MuSig2 addresses are available for dedicated wallets. Please contact BitGo support to enable Taproot MuSig2 for a dedicated wallet. These dedicated wallets will provide Taproot MuSig2 addresses by default both for receiving and change.
In the coming weeks Taproot MuSig2 will become available on all BitGo hot wallets by specifying chain codes 40 or 41 when creating new addresses.
In the coming months Taproot MuSig2 addresses will become the default change address type for all hot wallets.
Closing thoughts
The launch of Taproot MuSig2 on BitGo wallets marks an important milestone in enhancing efficiency, reducing fees, and improving privacy for bitcoin transactions. By leveraging the benefits of Schnorr signatures and Merklized script trees, BitGo is able to offer a seamless and secure 2-of-3 hot wallet experience without compromising on fees or functionality. While Taproot MuSig2 addresses bring significant fee savings and enhanced privacy, it is important to note that not all wallets currently support sending funds to these addresses. This upgrade is the latest example of BitGo leveraging the latest bitcoin technologies to provide the best experience for our customers.
Connect with us to learn more.
About BitGo
BitGo provides the most secure and scalable solutions for the digital asset economy, offering regulated custody, borrowing and lending, and core infrastructure to investors and builders alike.
Founded in 2013 — the early days of crypto — BitGo pioneered the multi-signature wallet and later built TSS to improve upon other companies’ MPC offerings. Between multi-sig and TSS, BitGo offers the safest technology on the market and safeguards over 600 tokens across a wide variety of blockchains.
Over the years, BitGo has expanded from offering wallets into providing a full-suite solution that lets clients hold assets safely and then put them to work.
BitGo launched BitGo Trust Company in 2018, providing fully regulated, qualified cold storage to complement BitGo Inc’s original hot wallet solution. In 2020, BitGo launched BitGo Prime, which allows its clients to trade, borrow, and lend. Moreover, BitGo also provides access to DeFi, staking, NFT wallets, and beyond, and serves as the world’s sole custodian for WBTC, or wrapped Bitcoin.
Today, BitGo is the leader in digital asset security, custody, and liquidity, providing the operational backbone for more than 700 institutional clients in over 50 countries — a list that includes many regulated entities and the world’s top cryptocurrency exchanges and platforms. BitGo also processes approximately 20% of all global Bitcoin transactions by value.
For more information, please visit www.bitgo.com.
©2023 BitGo Inc. (collectively with its affiliates and subsidiaries, “BitGo”). All rights reserved. BitGo Trust Company, Inc., BitGo Inc., and BitGo Prime LLC are separately operated, wholly-owned subsidiaries of BitGo Holdings, Inc., a Delaware corporation headquartered in Palo Alto, CA. No legal, tax, investment, or other advice is provided by any BitGo entity. Please consult your legal/tax/investment professional for questions about your specific circumstances. Digital asset holdings involve a high degree of risk, and can fluctuate greatly on any given day. Accordingly, your digital asset holdings may be subject to large swings in value and may even become worthless. The information provided herein is not intended for distribution to, or use by, any person or entity in any jurisdiction or country where such distribution or use would be contrary to law or regulation. BitGo is not directing this information to any person in any jurisdiction where the publication or availability of the information is prohibited, by reason of that person’s citizenship, residence or otherwise.
