Resources

This page contains resources on CISA that were considered valuable input for this website and may also be interesting content for anyone else interested in getting up to speed. However, keep in mind that some of the information linked here may have been superseeded by newer research already.

Write-ups/Mailing list

(current) - Cross-Input Signature Aggregation by Blockstream Research

2022-07-07 - Blockstream Research: Half-Aggregation of BIP 340 Signatures

2022-04-04 - Why does signature half aggregation break adaptor signatures? (Gijs van Dam)

2020-08-17 - Taproot, CoinJoins, and Cross-Input Signature Aggregation (u/almkglor)

2019-11-21 - Entroot (sipa)

2018-07-31 - Generalized Taproot/G’root (AJ Towns)

2018-03-21 - Soft-forks and schnorr signature aggregation (AJ Towns)

2018-02-05 - Graftroot (Greg Maxwell)

2017-05-07 - Per-block non-interactive Schnorr signature aggregation (Tadge)

2017-03-23 - bitcoincore.org: Roadmap for Schnorr Signatures

Academic Papers

2022-02-25 - Half-Aggregation of Schnorr Signatures with Tight Reductions (Yanbo Chen & Yunlei Zhao)

2021-03-22 - Non-interactive half-aggregation of EdDSA and variants of Schnorr signatures (Konstantinos Chalkias, Francois Garillot, Yashvanth Kondi & Valeria Nikolaenko)

2018-05-20 - Simple Schnorr Multi-Signatures with Applications to Bitcoin (Gregory Maxwell, Andrew Poelstra, Yannick Seurin & Pieter Wuille)

Videos

2021-06-23 - Half-Aggregation Implementation in C - Live Coding (Jonas Nick & Tim Ruffing)

2018-01-24 - Schnorr signatures for Bitcoin: challenges and opportunities - BPASE ‘18 (Pieter Wuille)

• Transcript

Podcasts

2023-09-07 - Bitcoin Review #50: Libsecp Panel (Jonas Nick, Tim Ruffing, Lloyd Fournier, Jesse Posner & Rijndael)

• Transcript

2022-12-27 - Chaincode Podcast #27: Nesting, ROAST, Half-Aggregation, Adaptor Signatures (Pieter Wuille & Tim Ruffing - Part 2)

2022-12-15 - Chaincode Podcast #26: Schnorr, MuSig, FROST and more (Pieter Wuille & Tim Ruffing - Part 1)

2022-08-02 - SLP #400: Half Signature Aggregation (Jonas Nick & Tim Ruffing)

2021-11-16 - SLP #321: On-Chain Scaling (Pieter Wuille, Andrew Poelstra, Andrew Chow & Murch)

2021-10-21 - Unhashed Podcast #157: Choosing Sigs (Ruben Somsen et al)

2020-02-16 - SLP #149: Is Consumerism at odds with Privacy in Bitcoin? (Adam Gibson/Waxwing)

Meeting Transcripts

2023-09-21 - CoreDev Tech Meeting: Signature Aggregation Update

Bitcoin Stack Exchange

What is the difference between key aggregation and signature aggregation?

What is cross-input signature aggregation and how would it work?

What makes cross input signature aggregation complicated to implement?

Would signature aggregation reduce the largest feasible blocksize

Why is full blockwide signature aggregation of schnorr signatures non-interactive?

What block space savings would we get for coinjoins (and payjoins) if we had cross input signature aggregation?

Will cross-input signature aggregation need a new output type?

How could Schnorr signatures be aggregated across the whole transaction?

Can Schnorr aggregate signatures be nested inside other Schnorr aggregate signatures?

Why does blockwide signature aggregation prevent adaptor signatures?

Why is adding s values in half aggregation insecure?

How does CoinJoin affect the total transaction size?