In our ongoing commitment to improving Bitcoin self-custody, we're thrilled to announce the Taproot Multisig Wallet, a new type of multisig wallet that leverages Taproot, Schnorr signatures, and the MuSig2 protocol to offer greater privacy and lower on-chain fees. Taproot wallet is a beta feature, so please consider it experimental and avoid storing significant amounts of funds for now.

What Is Taproot Multisig?

Taproot Multisig is a wallet design that uses Taproot (BIP 341) to make multisig transactions look indistinguishable from single-signature transactions on the Bitcoin blockchain. All Taproot addresses begin with “bc1p”, distinguishing them from legacy Bitcoin addresses. This implementation boosts user privacy and helps reduce fees¹. The key innovations powering Taproot Multisig are:

• Schnorr Signatures (BIP 340): A more efficient and provably secure signature scheme compared to ECDSA.
• MuSig2 Protocol (BIP 327): A technique for aggregating multiple signatures into one, optimizing how multisig transactions are handled on-chain.

By implementing these cutting-edge technologies, Taproot Multisig offers a sleek, privacy-focused alternative to traditional multisig wallets.

Why Taproot Multisig?

Enhanced Privacy

Taproot transactions make multisig activity indistinguishable from single-sig on-chain. Observers cannot tell how many parties participated in signing.

Lower Fees

Consolidating multiple signatures into a single Schnorr signature reduces transaction size, which typically results in lower fees.

Provably Secure

Schnorr signatures boast mathematical proofs of security, unlike ECDSA's more ad hoc security assumptions.

Key Path Spending

A Taproot feature called "key path spending" allows a specific subset of keys - which we coined the Value Keyset - to sign a transaction in a way that maximizes privacy and fee savings. Different subsets of keys (also known as "script path spending") still benefit from Taproot's privacy and fee improvements, but using the Value Keyset offers the highest advantage.

Understanding the Trade-offs

While Taproot Multisig offers significant advantages in privacy and fees, it's important to understand its trade-offs. The key difference from traditional multisig is in the signing process:

Traditional multisig requires only one round of signing, where each participant can sign independently. In contrast, Taproot Multisig using MuSig2 requires two rounds of signing coordination between participants. This additional round is the trade-off for achieving enhanced privacy and lower fees through signature aggregation.

This means:

• Participants need to be available for two rounds of signing
• The signing process takes slightly longer to complete

For users who prioritize privacy and lower fees, this trade-off is often worthwhile. The two-round signing process is what enables Taproot Multisig to aggregate multiple signatures into one, making transactions indistinguishable from single-sig on the blockchain.

"Value Keyset": Our New Term for Optimal Key Subsets

In traditional (non-Taproot) multisig, all keys are effectively equal, and any valid combination of M-of-N can spend from the wallet. With Taproot, we're introducing a user-friendly concept called the Value Keyset:

Value Keyset: A particular subset of keys that, when used to sign a transaction, fully leverages Taproot's key path spending. This subset provides the best combination of privacy and fee savings.

While any subset of keys will still benefit from Taproot's inherent advantages, using the Value Keyset is our recommended approach for optimal performance.

Nunchuk Reuses Bitcoin Core Code and libsecp256k1

Like all our wallet implementations, our Taproot Multisig continues Nunchuk's foundational approach of reusing Bitcoin Core's code and cryptographic libraries (e.g. libsecp256k1). This includes the critical components for Taproot and MuSig2, ensuring we maintain our commitment to using the most battle-tested and reviewed code in the Bitcoin ecosystem. This approach:

• Minimizes dependencies and reduces potential attack surfaces.
• Ensures we leverage libsecp256k1, the most widely-reviewed cryptographic library for Bitcoin.
• Includes critical components like nonce generation for MuSig2, following best practices vetted by the community.

By continuing to build directly on Bitcoin Core's proven code and libraries, we deliver a robust, security-first Taproot Multisig solution that upholds our core architectural principles.

Beta Disclaimer

Because Taproot wallet is a beta feature, we strongly recommend against placing significant amounts of funds into this wallet until the feature matures.

Key points to note:

• Hot Keys Only: In this initial release, only software (hot) keys are supported.
• Hardware Wallet Integration: We plan to add hardware signing support in the future. While some hardware wallet vendors like Ledger and Coinkite are working on Taproot support, their implementations are still in experimental stages. Broader hardware wallet support is still evolving.

Flexible M-of-N and Up to 5 Keys

Taproot Multisig supports any combination of M-of-N multisig with up to 5 keys in this implementation. While our traditional multisig wallets support up to 15 keys, we've initially limited Taproot multisig to 5 keys. Whether you need a simple 2-of-3 or want the added security of 3-of-5, our Taproot implementation has you covered.

Creating a Taproot Wallet in Nunchuk

Ready to try Taproot Multisig? Here's how to create a Taproot wallet in Nunchuk:

1. Add Keys: First, create or import the software keys you want to include in your wallet. Note that in this beta release, only software (hot) keys are supported. Hardware wallet support is coming in the near future.
2. Add Wallet: In the app's main screen, select Add Wallet. On the screen that follows, choose Create New Wallet.
3. Taproot Address Type: When prompted to select the address type, choose "Taproot."

From there, you can configure your M-of-N structure, assign keys to the wallet, and define your Value Keyset for maximum privacy and fee savings. Keep in mind that this is a beta feature - start with small balances to familiarize yourself with Taproot's workflow and benefits.

Conclusion

Taproot Multisig Wallet represents the next leap forward in Bitcoin self-custody, combining privacy and fee efficiency through cutting-edge cryptographic innovations. We're excited to push Bitcoin multisig technology to new frontiers - so try it out with small amounts, explore the Value Keyset, and stay tuned for further updates on hardware compatibility.

Secure your Bitcoin with Taproot Multisig: Enhanced privacy, lower fees, and the flexibility to define how you use your keys.
 

Technical Notes

¹ How MuSig2 Enables M-of-N

While MuSig2 is technically an N-of-N signature scheme, we achieve M-of-N functionality by combining it with Taproot's capabilities. Here's how it works:

Let's take a 2-of-3 wallet with keys A, B, and C as an example. The wallet is structured to allow signing with any two keys through these combinations:

• Keys A and B (key path)
• Keys A and C (script path)
• Keys B and C (script path)

Each of these combinations operates as a 2-of-2 MuSig2 signature. Using Taproot, we can designate the most frequently used combination (say, A and B) as the key path for optimal privacy and fees, while other valid combinations (A and C, or B and C) are included in the script path.

This elegant combination of MuSig2 and Taproot allows us to:

1. Achieve M-of-N functionality while leveraging MuSig2's signature aggregation
2. Optimize for your most common signing scenario via the key path
3. Maintain flexibility with alternative signing combinations via the script path