5
Disclaimer: This question is of theoretical importance to me trying to educate myself better on cryptographic principles and signature schemes. I don't intend to imply that in practice schnorr signatures are less secure than current 2-2 multisig transactions / scripts.
I am currently reading the musig paper and about scriptless scripts. In my understanding an important common idea in both cases seems to be able to have a single signature produced from several private keys.
Let us assume I can brute force the private key from a public key within reasonable time let's say 1 month (for example because I have a somewhat efficient algorithm for the discrete log in ecdsa (which I don't have). Also assume I can invert the hash function of Bitcoin addresses quickly. Or assume we just know the public keys because I am the third party in an escrow service)
Wouldn't I be able to break a MuSig address within 1 month (under the above assumption) by breaking the aggregated private key to the aggregated public key whereas in the setting of a common 2-2 multisig wallet I would need 2 months in order to be able to provide two valid signatures since I'd have to bruteforce both private keys independently of each other?
3Thanks for elaborating on the practical considerations too. Though it was quite clearto me that such a factor is not of practical relevance I learned a few more things from your answer! Btw expect more questions about rogue attacks, key aggregation and the musig paper over the next days (: – Rene Pickhardt – 2019-03-06T19:32:12.083
1Keep 'em coming. – Pieter Wuille – 2019-03-06T19:36:07.137