Home › Topics › Signatures › BIP 390

BIP 390 (MuSig2 descriptors): musig() Descriptor Key Expression

Also known as: MuSig2 descriptors, musig(), BIP390, BIP-0390.

In plain English: Adds a 'musig()' expression to descriptors, which combines several people's public keys into a single shared key using the MuSig2 method. The resulting coins look like an ordinary single-key payment on-chain, and this lets wallets describe and recover such shared setups.

Status
Draft
Type
Specification
Layer
Applications
Authors
Ava Chow
Assigned
Last changed
Requires
BIP 380, BIP 328
Topics
Signatures, Wallets
Source
bip-0390.mediawiki on GitHub · Markdown

Full specification

Abstract

This document specifies a musig() key expression for output script descriptors. musig() expressions take multiple keys and produce an aggregate public key using BIP-327.

This BIP is licensed under the Creative Commons CC0 1.0 Universal license.

Motivation

BIP-327 introduces the MuSig2 Multi-Signature scheme. It is useful to have a way for keys to be used in a MuSig2 aggregate key to be expressed in descriptors so that wallets can more easily use MuSig2.

Specification

A new key expression is defined: musig().

In the following sections, the term KEY refers to key expressions as defined in BIP-380 and BIP-389.

musig(KEY, KEY, ..., KEY)

The musig(KEY, KEY, ..., KEY) expression can only be used inside of a tr(), rawtr() or sp() expression as a key expression. It additionally cannot be nested within another musig() expression. Participant public keys may be repeated. The aggregate public key is produced by using the KeyAgg algorithm on all KEYs specified in the expression after performing all specified derivation. As with script expressions, KEY can contain child derivation specified by /*. A new aggregate public key will be computed for each child index. Keys must be sorted with the KeySort algorithm after all derivation and prior to aggregation[1].

musig(KEY, KEY, ..., KEY)/NUM/.../*

musig(KEY, KEY, ..., KEY)/NUM/.../* expressions are also allowed if no KEY expression contains child derivation as specified by /* or multipath as specified with /<NUM;NUM;...>, in addition to the same usage restrictions as in the previous section. The KEY expressions additionally must be xpubs or derived from xpubs. The aggregate public key is first computed as described above, with the keys also being sorted after all derivation and prior to aggregation. Then further BIP-32 derivation will be performed on the aggregate public key as described in BIP-328. The /NUM/.../* following the musig() specifies the derivation path to be used when deriving from the aggregate public key. /* is also optional. As there is no aggregate private key, only unhardened derivation from the aggregate public key is allowed. Thus these derivation steps cannot contain /NUMh or /NUM' nor can child derivation be specified as /*h, or /*'.

Test Vectors

Valid descriptors containing followed by the scripts they produce. Descriptors involving derived child keys will have the 0th, 1st, and 2nd scripts listed.

  • rawtr(musig(KwDiBf89QgGbjEhKnhXJuH7LrciVrZi3qYjgd9M7rFU74sHUHy8S,03dff1d77f2a671c5f36183726db2341be58feae1da2deced843240f7b502ba659,023590a94e768f8e1815c2f24b4d80a8e3149316c3518ce7b7ad338368d038ca66))
    • 5120789d937bade6673538f3e28d8368dda4d0512f94da44cf477a505716d26a1575
  • tr(musig(02f9308a019258c31049344f85f89d5229b531c845836f99b08601f113bce036f9,03dff1d77f2a671c5f36183726db2341be58feae1da2deced843240f7b502ba659,023590a94e768f8e1815c2f24b4d80a8e3149316c3518ce7b7ad338368d038ca66))
    • 512079e6c3e628c9bfbce91de6b7fb28e2aec7713d377cf260ab599dcbc40e542312
  • rawtr(musig(xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL,xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y)/0/*)
    • 51209508c08832f3bb9d5e8baf8cb5cfa3669902e2f2da19acea63ff47b93faa9bfc
    • 51205ca1102663025a83dd9b5dbc214762c5a6309af00d48167d2d6483808525a298
    • 51207dbed1b89c338df6a1ae137f133a19cae6e03d481196ee6f1a5c7d1aeb56b166
  • tr(musig(xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL,xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y)/0/*,pk(f9308a019258c31049344f85f89d5229b531c845836f99b08601f113bce036f9))
    • 51201d377b637b5c73f670f5c8a96a2c0bb0d1a682a1fca6aba91fe673501a189782
    • 51208950c83b117a6c208d5205ffefcf75b187b32512eb7f0d8577db8d9102833036
    • 5120a49a477c61df73691b77fcd563a80a15ea67bb9c75470310ce5c0f25918db60d
  • tr(f9308a019258c31049344f85f89d5229b531c845836f99b08601f113bce036f9,pk(musig(xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL,xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y)/0/*))
    • 512068983d461174afc90c26f3b2821d8a9ced9534586a756763b68371a404635cc8
    • 5120368e2d864115181bdc8bb5dc8684be8d0760d5c33315570d71a21afce4afd43e
    • 512097a1e6270b33ad85744677418bae5f59ea9136027223bc6e282c47c167b471d5
  • tr(musig(xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL/1,xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL/1)/2)
    • 5120a17ceacd6422bd5ffd9f165807b254b7d68ad39f179cc4f11545a6835227e97c

Invalid descriptors

  • musig() is not allowed in top-level pk(): pk(musig(02f9308a019258c31049344f85f89d5229b531c845836f99b08601f113bce036f9,03dff1d77f2a671c5f36183726db2341be58feae1da2deced843240f7b502ba659,023590a94e768f8e1815c2f24b4d80a8e3149316c3518ce7b7ad338368d038ca66))
  • musig() is not allowed in top-level pkh(): pkh(musig(02f9308a019258c31049344f85f89d5229b531c845836f99b08601f113bce036f9,03dff1d77f2a671c5f36183726db2341be58feae1da2deced843240f7b502ba659,023590a94e768f8e1815c2f24b4d80a8e3149316c3518ce7b7ad338368d038ca66))
  • musig() is not allowed in wpkh(): wpkh(musig(02f9308a019258c31049344f85f89d5229b531c845836f99b08601f113bce036f9,03dff1d77f2a671c5f36183726db2341be58feae1da2deced843240f7b502ba659,023590a94e768f8e1815c2f24b4d80a8e3149316c3518ce7b7ad338368d038ca66))
  • musig() is not allowed in combo(): combo(musig(02f9308a019258c31049344f85f89d5229b531c845836f99b08601f113bce036f9,03dff1d77f2a671c5f36183726db2341be58feae1da2deced843240f7b502ba659,023590a94e768f8e1815c2f24b4d80a8e3149316c3518ce7b7ad338368d038ca66))
  • musig() is not allowed in sh(wpkh()): sh(wpkh(musig(02f9308a019258c31049344f85f89d5229b531c845836f99b08601f113bce036f9,03dff1d77f2a671c5f36183726db2341be58feae1da2deced843240f7b502ba659,023590a94e768f8e1815c2f24b4d80a8e3149316c3518ce7b7ad338368d038ca66)))
  • musig() is not allowed in sh(wsh()): sh(wsh(pk(musig(02f9308a019258c31049344f85f89d5229b531c845836f99b08601f113bce036f9,03dff1d77f2a671c5f36183726db2341be58feae1da2deced843240f7b502ba659,023590a94e768f8e1815c2f24b4d80a8e3149316c3518ce7b7ad338368d038ca66))))
  • musig() is not allowed in wsh(): wsh(musig(02f9308a019258c31049344f85f89d5229b531c845836f99b08601f113bce036f9,03dff1d77f2a671c5f36183726db2341be58feae1da2deced843240f7b502ba659,023590a94e768f8e1815c2f24b4d80a8e3149316c3518ce7b7ad338368d038ca66))
  • musig() is not allowed in sh(): sh(musig(02f9308a019258c31049344f85f89d5229b531c845836f99b08601f113bce036f9,03dff1d77f2a671c5f36183726db2341be58feae1da2deced843240f7b502ba659,023590a94e768f8e1815c2f24b4d80a8e3149316c3518ce7b7ad338368d038ca66))
  • Ranged musig() requires all participants to be xpubs: tr(musig(02f9308a019258c31049344f85f89d5229b531c845836f99b08601f113bce036f9,03dff1d77f2a671c5f36183726db2341be58feae1da2deced843240f7b502ba659,023590a94e768f8e1815c2f24b4d80a8e3149316c3518ce7b7ad338368d038ca66)/0/0)
  • Cannot have ranged participants if musig() is also ranged: tr(musig(xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL/*,xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y)/0/*)
  • Cannot have multipath participants if musig() is also multipath: tr(musig(xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL/<0;1>,xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y)/<2;3>)
  • musig() cannot have hardened derivation steps: tr(musig(xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL,xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y)/0h/*)
  • musig() cannot have hardened child derivation: tr(musig(xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL,xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y)/0/*h)
  • musig() cannot have participants with child derivation when musig() has derivation steps: tr(musig(xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL/*,xpub68NZiKmJWnxxS6aaHmn81bvJeTESw724CRDs6HbuccFQN9Ku14VQrADWgqbhhTHBaohPX4CjNLf9fq9MYo6oDaPPLPxSb7gwQN3ih19Zm4Y/*)/1/2)

Backwards Compatibility

musig() expressions use the format and general operation specified in BIP-380. As these are a set of wholly new expressions, they are not compatible with any implementation. However the keys are produced using a standard process so existing software are likely to be familiar with them.

Rationale

  1. Why must the keys be sorted prior to aggregation? Although the descriptor's written form sets an order for the keys that could be used for aggregation, the order should not matter as MuSig2 philosophically operates over a set of keys, with the order merely being an implementation detail in aggregation itself. Requiring sorting of keys prior to aggregation enforces this philosophy as keys can be written in the descriptor in any order with the end result still being the same. Furthermore, this aids with recovery where the descriptor was not backed up as users will not need to also have backed up, or guess, the correct order of keys. ↩

Reference Implementation

The reference implementation is available in Bitcoin Core PR #31244.

Changelog

  • __0.2.0__ (2026-03-04) - Allow musig() inside sp() expressions.
  • __0.1.0__ (2025-12-08) - Allow musig() inside rawtr() expressions.

Acknowledgements

Thanks to Pieter Wuille, Andrew Poelstra, Sanket Kanjalkar, Salvatore Ingala, and all others who participated in discussions on this topic.

Questions about BIP 390

What is BIP 390?

BIP 390, “musig() Descriptor Key Expression”, also known as MuSig2 descriptors, is a specification Bitcoin Improvement Proposal written by Ava Chow and assigned in June 2024. Adds a 'musig()' expression to descriptors, which combines several people's public keys into a single shared key using the MuSig2 method. The resulting coins look like an ordinary single-key payment on-chain, and this lets wallets describe and recover such shared setups.

Is BIP 390 active?

No. BIP 390 is a Draft: it is still being written and discussed, so its details may change.

Who wrote BIP 390?

BIP 390 was written by Ava Chow. Its number was assigned on June 4, 2024.

What does BIP 390 build on?

BIP 390 requires BIP 380 (Output Script Descriptors General Operation) and BIP 328 (Derivation Scheme for MuSig2 Aggregate Keys). Read those first to understand this proposal.

Which BIPs build on BIP 390?

3 other BIPs reference BIP 390: BIP 380 (Output Script Descriptors General Operation), BIP 388 (Wallet Policies for Descriptor Wallets) and BIP 138 (Compact Encryption Scheme for Non-seed Wallet Data).

Where can I read the full BIP 390 specification?

The complete text of BIP 390 is on this page, taken unchanged from the official bitcoin/bips repository on GitHub. It is also available as Markdown and JSON.

BIPs that build on BIP 390

Learn more

Guides

Glossary

Related proposals