PSBT/MuSig2 coordination over Nostr relays: transport invariants for nonce safety under at-least-once delivery

The discussion revolves around the complexities and challenges associated with multi-party custody arrangements, such as 2-of-3 multisig, MuSig2 Taproot aggregates, and covenant-free time-locked vaults, particularly focusing on the movement of PSBTs (Partially Signed Bitcoin Transactions) and signing rounds. Despite the decentralized design of these systems, the coordination path often remains centrally managed by a coordinator, typically operated by the wallet vendor, which potentially reintroduces central points of failure or observation.

Recent developments have indicated that Nostr relays could play a role in decentralizing this aspect of digital custody. Examples include platforms like Joinstr, Munstr, Smart Vaults, and Nunchuk, which have utilized Nostr relays for parts of their transaction traffic. A significant publication addressing these concerns is a working note released in August, which explores the coordination of PSBT (defined in BIP-174) and MuSig2 (defined in BIP-327) over a network of independent relays. This approach leverages the remote-signer pattern from NIP-46 and integrates with BSMS (BIP-129) to ensure that no relay has access to key material, can decrypt fragments, or discern the spending graph. The primary risk identified with this model is that an adversarial relay might only be capable of denial of service attacks. Further insights into these discussions can be accessed through the following resources: PSBT Coordination over Nostr Relays and Vault Construction and Coordination Transport, which also includes a SHA-256 digest for verification purposes.

The document identifies critical open problems within this framework, with nonce safety under adversarial conditions highlighted as a primary concern. The nature of relay-based delivery systems inherently involves risks such as message duplication, retries, and reordering, which imposes significant demands on the handling of nonce states and message sequencing to maintain security. Specific questions raised include the sufficiency of client-side sequencing controls for securing nonce uniqueness, the possibility of constructing garbage-resistant transport layers without imposing censorship, and the feasibility of establishing cryptographic structures that enable misbehavior proofs without necessitating global observation.

These inquiries underscore the need for further research and refinement in the architectural design of these systems to address identified gaps and enhance the robustness and reliability of decentralized digital custody solutions.