Why does blockwide signature aggregation prevent adaptor signatures?

Question

In a recent video about half signatures, Jonas Nick mentions that blockwide signature aggregation interferes with adaptor signatures and offering atomic swaps (I guess via PTLCs).

I am confused about what breaks in that case. Do I understand correctly that the main issue is that the signature depends on the adaptor secret? If so, the transaction (including its signature) would already be fixed in the block anyway. The only other intuition I have would be that it might hinder a non-interactive protocol for adaptor signatures, but that also doesn't seem obvious to me since, as far as I understand, blockwide aggregation would be done by the miners at the very end after all signatures are presented.

Answer 1

There is a simple information theoretic argument: when two parties produce an adaptor signature, one party will learn a secret tweak from the eventually published on-chain signature, by comparing it with the adaptor signature they had ahead of time.

In case of block-wide signature aggregation, there is just a single signature for the entire block. There is simply no space for that single signature to reveal multiple independent secrets to multiple independent parties.

Answer 2

The adaptor signature s' is the real signature s, minus a secret tweak t: s'=s-t

The adaptor signature is published together with the elliptic curve points R for the nonce and T for the tweak, which belong to their corresponding secrets r and t.

The Verifier can now do the verification and check that everything is valid. After this the Verifier has to wait for the real signature s to appear on-chain to calculate t: t=s-s'.

But in the case of block-wide signature aggregation, the real signature s never appears on-chain because it gets "lost" inside the aggregate signature. The aggregate signature s_agg is a sum of all the other signatures; in the case of Signature Half Aggregation it's a sum of all signatures, each multiplied by an unpredictable value z_i:

s_agg is the only value to appear on-chain and it's useless for calculating t.

More in-depth info can be found here: https://www.gijsvandam.nl/post/why-does-signature-half-aggregation-break-adaptor-signatures/