Resources
This page contains resources on CISA that were considered valuable input for this website and may also be interesting content for anyone else interested in getting up to speed. However, keep in mind that some of the information linked here may have been superseeded by newer research already.
Write-ups/Mailing list
(current) - Cross-Input Signature Aggregation by Blockstream Research
2022-07-07 - Blockstream Research: Half-Aggregation of BIP 340 Signatures
2022-04-04 - Why does signature half aggregation break adaptor signatures? (Gijs van Dam)
2020-08-17 - Taproot, CoinJoins, and Cross-Input Signature Aggregation (u/almkglor)
2018-07-31 - Generalized Taproot/G’root (AJ Towns)
2018-03-21 - Soft-forks and schnorr signature aggregation (AJ Towns)
2018-02-05 - Graftroot (Greg Maxwell)
2017-05-07 - Per-block non-interactive Schnorr signature aggregation (Tadge)
2017-03-23 - bitcoincore.org: Roadmap for Schnorr Signatures
Academic Papers
2022-02-25 - Half-Aggregation of Schnorr Signatures with Tight Reductions (Yanbo Chen & Yunlei Zhao)
Videos
2021-06-23 - Half-Aggregation Implementation in C - Live Coding (Jonas Nick & Tim Ruffing)
Podcasts
2022-08-02 - SLP #400: Half Signature Aggregation (Jonas Nick & Tim Ruffing)
2021-11-16 - SLP #321: On-Chain Scaling (Pieter Wuille, Andrew Poelstra, Andrew Chow & Murch)
2021-10-21 - Unhashed Podcast #157: Choosing Sigs (Ruben Somsen et al)
2020-02-16 - SLP #149: Is Consumerism at odds with Privacy in Bitcoin? (Adam Gibson/Waxwing)
Meeting Transcripts
2016-05-22 - CoreDev Tech Meeting Zurich
2023-09-21 - CoreDev Tech Meeting: Signature Aggregation Update
Bitcoin Stack Exchange
What is the difference between key aggregation and signature aggregation?
What is cross-input signature aggregation and how would it work?
What makes cross input signature aggregation complicated to implement?
Would signature aggregation reduce the largest feasible blocksize
Why is full blockwide signature aggregation of schnorr signatures non-interactive?
Will cross-input signature aggregation need a new output type?
How could Schnorr signatures be aggregated across the whole transaction?
Can Schnorr aggregate signatures be nested inside other Schnorr aggregate signatures?
Why does blockwide signature aggregation prevent adaptor signatures?
Why is adding s values in half aggregation insecure?
How does CoinJoin affect the total transaction size?