Round 2: Sign’ and the Cascading Insight

Round 2 is where NestedMuSig2 differs most from flat MuSig2. In flat MuSig2, each signer uses one aggregation context. In a tree, each leaf signer sits under a path of aggregators, so its partial signature must absorb multiple levels of key coefficients and nonce-binding values.

Take one leaf signer at depth Λ. The signer reconstructs the ancestor contexts along its path to the root.

  1. For each level ℓ, reconstruct that level’s key list L_ℓ and compute the signer-side coefficient a_{1,ℓ} with KeyAggCoef.
  2. Collect binding values for each level. Intermediate levels use this form:
bℓ=Hnon(pk1,ℓ−1,R1,ℓ′,…,Rν,ℓ′)b_\ell = H_{\text{non}}(pk_{1,\ell-1}, R^{\prime}_{1,\ell}, \ldots, R^{\prime}_{\nu,\ell})

and the root uses:

b0=Hnon_bar(X~,R1,0′,…,Rν,0′,m)b_0 = H_{\text{non\_bar}}(\tilde{X}, R^{\prime}_{1,0}, \ldots, R^{\prime}_{\nu,0}, m)
  1. Build the cascade terms:
bˇ=∏ℓ=0Λ−1bℓ,cˇ=c⋅∏ℓ=0Λ−1a1,ℓ\check{b} = \prod_{\ell=0}^{\Lambda-1} b_\ell, \qquad \check{c} = c \cdot \prod_{\ell=0}^{\Lambda-1} a_{1,\ell}

where c = H_sig(X̃, R, m).

  1. Compute the partial signature:
s1=cˇ⋅sk+∑j=0ν−1rj⋅bˇjs_1 = \check{c} \cdot sk + \sum_{j=0}^{\nu-1} r_j \cdot \check{b}^j

All scalar operations in this step are computed mod p, the curve order.

This equation is the heart of NestedMuSig2. It looks like a normal Schnorr-style affine form, but both challenge and nonce weights are now products across tree levels.

After every leaf computes $s_i$, SignAgg' is simple:

s=∑isis = \sum_i s_i

Why does this verify as normal Schnorr? Intuitively, the coefficient products were chosen so every leaf contribution is weighted exactly as its key and nonce were weighted during recursive aggregation. When summed, the nested terms collapse into one root-level relation between $s$, $R$, and the aggregate key X̃. The verifier does not see per-level artifacts, only the final tuple.

This also explains why Round 1 must retain internal aggregates. Sign' needs those internal values to recompute the same binding factors that shaped each ancestor’s external nonce output.

From an engineering perspective, Round 2 is deterministic once Round 1 artifacts and the message are fixed. If any signer feeds inconsistent values or attempts to deviate, the final signature fails verification. In interactive protocols, honest participants can run blame procedures to identify which participant produced an invalid partial signature or malformed transcript contribution.