Notation Guide

This page is a quick reference for the symbols, indices, and conventions used throughout the narrative. Keep it open alongside any other page.

Conventions

All arithmetic on scalars is mod

p

, the order of the secp256k1 curve. Points like

X

R

live on the curve. We write

g^x

for scalar-to-point multiplication (multiplicative group notation), where

g

is the standard generator.

Index	Ranges over	Example
$i$	Signers (or keys) within one aggregation level	$a_i, R_{i,j}, s_i$
$j$	Nonce coordinates, 0 to $\nu$ - 1	$R_{i,j}, r_j, b^j$
$\ell$	Tree levels on a leaf’s path, 0 = root	$b_\ell, a_{1,\ell}, L_\ell$
$\Lambda$	Nesting depth (number of aggregator ancestors)	Flat MuSig2: $\Lambda = 1$

The subscript pattern

a_{1,\ell}

means “signer 1’s coefficient at level

\ell

.” The “1” refers to the specific leaf signer whose partial signature is being computed.

Mark	Meaning	Examples
Tilde $\tilde{X}$	Aggregate quantity	$\tilde{X}$ = aggregate public key
Prime $R'_j$	Pre-binding intermediate	$R'_j$ = internal aggregate nonce (before `SignAggExt`)
Check $\check{b}$	Cascaded product across tree levels	$\check{b}$ = product of all binding values on path to root

All four map arbitrary inputs to scalars in

\mathbb{Z}_p

Function	Inputs	Purpose
$H_{\text{agg}}$	Key multiset $L$ , key $X_i$	Aggregation coefficient for rogue-key resistance
$H_{\text{non}}$	Parent key, pre-binding nonce vector	Nonce binding at non-root levels
$H_{\text{non\_bar}}$	Root key $\tilde{X}$ , root nonce vector, message $m$	Nonce binding at root (message-dependent)
$H_{\text{sig}}$	$\tilde{X}$ , $R$ , $m$	Schnorr challenge scalar $c$

H_{\text{non}}

does not include the message.

H_{\text{non\_bar}}

does. That split allows lower-level nonce exchange to happen before the message is finalized.

Symbol	Type	Meaning
$g$	Point	secp256k1 generator
$p$	Scalar	Curve group order
$m$	Bytes	Message to sign
$\nu$	Constant	Number of nonce pairs per signer (= 2)
$\Lambda$	Integer	Leaf’s nesting depth (aggregator count on path to root)
$sk$	Scalar	Leaf signer’s secret key
$pk$	Point	Public key: $g^{sk}$
$L$	Multiset	Key multiset at one aggregation level
$a_i$	Scalar	Aggregation coefficient: $H_{\text{agg}}(L, X_i)$
$\tilde{X}$	Point	Aggregate public key: $\prod_i X_i^{a_i}$
$r_{i,j}$	Scalar	Nonce secret (single-use)
$R_{i,j}$	Point	Nonce commitment: $g^{r_{i,j}}$
$R'_j$	Point	Pre-binding aggregate nonce: $\prod_i R_{i,j}$
$R_j$	Point	Post-binding aggregate nonce: $(R'_j)^{b^{j-1}}$
$b$	Scalar	Binding value from `SignAggExt`
$b_\ell$	Scalar	Binding value at level $\ell$
$b_0$	Scalar	Root binding (uses $H_{\text{non\_bar}}$ , includes $m$ )
$\check{b}$	Scalar	Cascaded binding: $\prod_{\ell=0}^{\Lambda-1} b_\ell$
$c$	Scalar	Schnorr challenge: $H_{\text{sig}}(\tilde{X}, R, m)$
$\check{c}$	Scalar	Cascaded challenge: $c \cdot \prod_{\ell=0}^{\Lambda-1} a_{1,\ell}$
$s_i$	Scalar	Leaf partial signature
$s$	Scalar	Final aggregated signature scalar: $\sum_i s_i$
$\sigma$	Pair	Signature: $(R, s)$
$R$	Point	Final root nonce commitment

a_i = H_{\text{agg}}(L, X_i)

Aggregation coefficient (Key Aggregation)

\tilde{X} = \prod_i X_i^{a_i}

Key aggregation (Key Aggregation)

R'_j = \prod_i R_{i,j}

Nonce aggregation, SignAgg (Round One)

R_j = (R'_j)^{b^{j-1}}

Nonce binding, SignAggExt (Round One)

s_1 = \check{c} \cdot sk + \sum_{j=0}^{\nu-1} r_j \cdot \check{b}^j

Partial signature, Sign' (Round Two)

g^s = R \cdot \tilde{X}^c

Schnorr verification (Verification)