musig2 with BIP-32 style nonce chain
I am interested in the case where a fixed pool of signers will sign a series of many messages. As I understand it, musig2 would allow pre-processing, whereby a signature aggregator could collect a list of public nonce pairs from each signer in advance, and then consume one pair from each signer for each message to sign. Signers would need to save the private key associated with each public nonce, and the aggregator would need to signal which one to use for each signature.
I wonder, could the public nonce list be generated from a chain code in the same manner that BIP-32 allows a list of public keys to be generated? So, signers would commit to "extended public nonces" (R,c),(S,d), and then the signature aggregator would include a sequence number with each message, to define the nonce key pair in the manner of BIP-32? Or, better, could the BIP-32 sequence number be replaced with some deterministic function of the message being signed?
from Recent Questions - Bitcoin Stack Exchange https://ift.tt/qJjmiRH
via IFTTT