BIP 328 guide to synthetic xpubs for MuSig2 aggregate keys, fixed chaincode, unhardened derivation, signing tweaks, privacy and verification.
This guide explains BIP 328 Derivation Scheme for MuSig2 Aggregate Keys in plain English. It covers the problem behind the BIP, why it matters and whether the proposal is part of Bitcoin today.
BIP 328 Derivation Scheme for MuSig2 Aggregate Keys: Start with the plain MuSig2 aggregate public key, set depth and child number to zero and attach the exact fixed 32-byte chaincode specified by the BIP.
A node operator is checking BIP 328 Derivation Scheme for MuSig2 Aggregate Keys. The aggregate public key is enough to construct the synthetic xpub, but no aggregate private key exists.
BIP 328 is Complete, Informational, at the Applications layer. It standardises wallet interoperability and does not alter Taproot consensus or make all signers compatible.
Start with the plain MuSig2 aggregate public key, set depth and child number to zero and attach the exact fixed 32-byte chaincode specified by the BIP.
The aggregate public key is enough to construct the synthetic xpub, but no aggregate private key exists. Hardened derivation is therefore impossible and must be rejected.
Wallets use CKDpub to derive children. The left-hand value produced at each step is the public-key tweak applied along the derivation path.
Every signer must independently compute or verify the same tweaks and provide them to the MuSig2 session as plain tweaks. A mismatch yields a different key or invalid signature.
A synthetic aggregate xpub exposes linkability and derivation information much like an ordinary xpub. Protect it as wallet metadata and do not publish it as a harmless identifier.
Developers test the proposal with made-up data on an isolated test network. They check normal cases and deliberately invalid cases. Different implementations should reach the same result before anyone relies on the proposal.
BIP 328 Derivation Scheme for MuSig2 Aggregate Keys: Start with the plain MuSig2 aggregate public key, set depth and child number to zero and attach the exact fixed 32-byte chaincode specified by the BIP.
BIP 328 is Complete, Informational, at the Applications layer. It standardises wallet interoperability and does not alter Taproot consensus or make all signers compatible.
Start with the plain MuSig2 aggregate public key, set depth and child number to zero and attach the exact fixed 32-byte chaincode specified by the BIP.
The aggregate public key is enough to construct the synthetic xpub, but no aggregate private key exists.
BIP 328 reduces storage and repeated aggregation work while preserving MuSig2’s distributed signing model. Safety rests on exact synthetic-xpub construction, identical tweak calculation and strict rejection of hardened derivation.
Check the current specification status and the documentation for the exact implementation you operate before moving production funds or changing a mining node.
BIP 450 guide to Draft Formosa themed mnemonic stories, entropy and checksum mapping, theme JSON, BIP39 conversion, passphrases and recovery safety.
BIP 393 guide to Draft descriptor annotations for birth height, gap limit and Silent Payment max label, checksum rules, parsing and recovery safety.
BIP 392 guide to Draft sp() descriptors, spscan and spspend encodings, watch-only and full-wallet forms, key origins, recovery and validation.
Join the ASIC Mining Discussion
Members can read and join the discussion
Log in to read comments from other miners. Create a free account if you would like to ask a question or share your experience.
Membership helps us protect the discussion from spam and keep answers useful.