The MuSig paper (2018) describes a Schnorr signature key aggregation scheme which lets a set of individual public keys to be merged into a single, "aggregated" public key.

In the protocol each individual public key creates an own signature which can be merged into the "aggregated signature". The aggregated signature will verify with the aggregated public key like the signature was created by only one key.

Is it possible to prove that a particular individual public key is part of the aggregate public key without sharing the other public keys?

  • 1
    $\begingroup$ This signature verification algorithm requires explicit individual public keys. That means, proving some individual public key is a part of the aggregate (without releasing that individual key) assumes prover help for verifying aggregate signatures. Having said this, yes, individual key membership in the aggregate can be proved. $\endgroup$ Commented Jul 8, 2021 at 9:33
  • $\begingroup$ @VadymFedyukovych it sounds to me like OP is looking for the opposite: proving that some individual public key is part of an aggregate public key by knowing only (1) the aggregate public key, and (2) this individual public key, but not the remaining public keys (which, together with the individual public key, comprise the aggregate public key). $\endgroup$
    – runeks
    Commented Dec 4, 2021 at 10:59

1 Answer 1


The MuSig (and MuSig2) key aggregation function, for the purpose of this question, is a hash function from multisets of public keys to public keys.

Proving that a particular key is a member of an aggregrate is possible, but requires revealing all public keys that were aggregated together. Of course, generic zero-knowledge proof techniques can also be used too, if their complexity is acceptable.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.