Insecurity of MuSig and BN Multi-Signatures with Delayed Message Selection

ePrint Report: Insecurity of MuSig and BN Multi-Signatures with Delayed Message Selection

Sela Navot

This note reveals a vulnerability of MuSig and BN multi-signatures when used with delayed message selection. Despite the fact that both schemes can be correctly implemented with preprocessing of the first two signing rounds before the message to sign is selected, we show that they are insecure (i.e. not existentially unforgeable against chosen message attacks) when the message selection is deferred to the third signing round …

can eprint report fact insecurity message report signatures signing vulnerability