Save Fees with MuSig2 at BitGo

A year and a half (about 85,000 blocks) ago, we launched support for Taproot on BitGo wallets, concurrent with bitcoin’s Taproot soft fork activation. A major benefit of Taproot is enabling multi-signature protocols such as MuSig2, which promise significant fee savings. We wrote, “we’re very excited to release MuSig2 support in the near future, which will be an automatic and seamless upgrade for existing wallets with Taproot UTXOs.” None of that turned out to be true. The MuSig2 specification wasn’t standardized until March of this year, and the standard uses a slightly (but importantly) different key aggregation function than the draft we implemented. With MuSig2 now accepted as BIP-0327, we are very excited to launch Taproot MuSig2 on BitGo bitcoin hot wallets.

Background

Bitcoin’s Taproot soft fork added Schnorr BIP-0340 as a new method for creating and validating the signatures which authorize most movements of bitcoin. These new digital signatures are expressed more compactly (in 64–65 bytes, instead of 72–73 bytes). More importantly Schnorr signatures are “linear”, which makes the creation of aggregate keys and corresponding signatures much simpler than the non-linear ECDSA signatures originally used on bitcoin. Aggregating multiple keys and signatures into a single key and signature that appear on chain is a big efficiency gain for multi-signature transactions like those sent from BitGo wallets.

Several key aggregation and signing protocols have been proposed to take advantage of Schnorr signatures. Two of these are now widely reviewed and on the path to having accepted specifications: MuSig2 (paper) and FROST (paper). MuSig2 is a multi-signature protocol, i.e. all signers involved in the aggregate key must collaborate to produce a valid signature for the aggregate key. FROST is a threshold signature protocol, i.e. a chosen threshold, less than or equal to all signers involved in the aggregate key, must collaborate to produce a valid signature for the aggregate key. MuSig2 is a much simpler protocol, does not require interactive key aggregation, and has a security proof relying on a more widely accepted assumption.

The Taproot soft fork also added support for Merklized script trees, as specified in BIP-0341. These script trees can be combined with a key path condition to create a rich set of spending conditions on any bitcoin locked using Taproot. By combining MuSig2’s simple multi-signature protocol with the Merklized script tree of Taproot, we are able to offer BitGo’s 2-of-3 hot wallet experience for bitcoin without compromise.

Bitcoin Addresses at BitGo

BitGo wallets support sending and receiving to all bitcoin address types. Let’s compare our receiving/change address types to understand the trade-offs of each:

Fees

As you can see, for the BitGo / User key path Taproot MuSig2 inputs save 47 vBytes per input over the next smallest (Native SegWit). This results in a 30% fee saving compared to Native SegWit. Compared to Wrapped SegWit, Taproot MuSig2 saves 43% in fees. With Taproot MuSig2 inputs, script spend paths involving the backup key take a small (3 virtual byte, 2%) penalty compared to Native SegWit.

Signing

When spending a Taproot MuSig2 input with the BitGo / User key path, 2 round trips between the signers are needed: First each signer provides a nonce, and then each provides a signature. This, combined with the fee trade-offs mentioned above make Taproot MuSig2 addresses best for hot wallets where the majority spending is done using the BitGo / User key path. For cold wallets where keys are offline, or where Backup spends are more common, Native SegWit remains the best address type.

Privacy

Another benefit of Taproot MuSig2 spends using the BitGo / User key path is that they do not reveal the existence of other spending paths. This means that both addresses and spends using this path are indistinguishable from single signature Taproot spends. Users of BitGo wallets have long been statistically identifiable as BitGo users on chain because BitGo wallets produce the most 2-of-3 spends. Users of Taproot MuSig2 key path spends will no longer be automatically pooled with 2-of-3 wallets, but rather with all other Taproot key path spends no matter what other conditions may have been available.

Wallet Support

A final word of caution about Taproot MuSig2 addresses: Not all wallets support sending to Taproot addresses yet. We recommend against using Taproot Keypath receiving addresses if you expect to receive funds from one of the wallets that does not support them. Note, you can still take advantage of Taproot Keypath change addresses in this case.

How and when can I use MuSig2?

Right now Taproot MuSig2 addresses are available for dedicated wallets. Please contact BitGo support to enable Taproot MuSig2 for a dedicated wallet. These dedicated wallets will provide Taproot MuSig2 addresses by default both for receiving and change.

In the coming weeks Taproot MuSig2 will become available on all BitGo hot wallets by specifying chain codes 40 or 41 when creating new addresses.

In the coming months Taproot MuSig2 addresses will become the default change address type for all hot wallets.

Closing thoughts

The launch of Taproot MuSig2 on BitGo wallets marks an important milestone in enhancing efficiency, reducing fees, and improving privacy for bitcoin transactions. By leveraging the benefits of Schnorr signatures and Merklized script trees, BitGo is able to offer a seamless and secure 2-of-3 hot wallet experience without compromising on fees or functionality. While Taproot MuSig2 addresses bring significant fee savings and enhanced privacy, it is important to note that not all wallets currently support sending funds to these addresses. This upgrade is the latest example of BitGo leveraging the latest bitcoin technologies to provide the best experience for our customers.

Connect with us to learn more.