Thread by @adam3us

TL;DR @gregoryneven et al proved 2-round musig insecure, we made 2-round work with deterministic nonces + bulletproof ZKP (2 round is good for usability). as SHA256 is CPU expensive @pwuille @n1ckler @real_or_random @yannickseurin designed Purify for low bulletproof complexity.

I thought it was a pretty neat and simple trick to disprove the impossibility by counter-example: make a bulletproof that the nonce is deterministic, cuts off wagner adaptive attack as there are no free variables left. hearing "impossible" led to "is that true, really?" question.

in fairness the impossibility proof, is presumably correct, just within model assumptions that this solution side-steps. 2-round is interesting for usability because it reduces interactivity in multi-party signatures, which might involve fetching hardware-wallet from safe 2x.

the optimized-for-bulletproof Purify keyed-PRF to reduce the verification complexity, and security proofs of that were the bulk of the work by DN paper authors, as a bulletproof of normal bitcoin HMAC-SHA256 deterministic nonce is a bigger proof, and maybe 45x slower to verify.

the proof is more nuanced "we prove none of the schemes can be proved secure without radically departing from currently known techniques. We show if the one-more discrete-log problem is hard, no algebraic reduction exists that proves any of these schemes secure" @real_or_random

usually when people find impossible to prove results, it's a hint your direction is not securable, plus here Neven et al also concretely broke the previous MuSig version. which says if you try to repair by adding complexity, you're unlikely to get to work with this approach.

so bulletproof + determinstic nonce is a radically different technique and different approach, so the proof scope does not apply. plus it's pleasingly simple and has a clear intuitive security argument. the bulk of the work was the DN authors with #Purity and making it efficient.

and there firstly design of #Purity keyed-PRF (aka KDF, commonly built with MAC like HMAC), optimization of bulletproof circuit complexity (45x smaller vs HMAC) and security proofs of Purity's PRF security. strong work in applied crypto. MuSig2 is a whole other story, to come!