What makes cross input signature aggregation complicated to implement? Other than for design space reasons why didn't it make it into BIP-Taproot? (Key aggregation within one input can be achieved with MuSig, MuSig2 etc but signatures cannot be aggregated across different inputs with BIP-Taproot.)

This questions was asked by Thorkil Vaerge on Twitter.

1 Answer 1


Pieter Wuille answered this on Twitter.

The most important complication of cross input aggregation is explained in this Bitcoin dev mailing list post by AJ Towns.

TL;DR: if softforks change which signatures are checked, they mustn't change what is aggregated together. This is especially complicated when they interact with BIP341's OP_SUCCESSx upgrade mechanism, which could easily let future softforks change script semantics entirely. There is nothing fundamentally hard here - it's just engineering complexity to make sure everything works well together.

Pieter added at a London BitDevs Socratic Seminar on BIP-Taproot:

Graftroot and cross input aggregation are such deeply conceptual changes. You can’t permit building them later. It is such a structural change to how scripts work. These things are not something that can be just added later on top of Taproot. You need a successor. Cross input aggregation, the concept of script verification is no longer a per input thing but it is a per transaction thing. You can’t do it with optimal efficiency, I guess you can invent things. The type of extensibility that is built in is new opcodes, new types of public keys, new sighash types, all these things are made fairly easy and come with almost no downsides compared to not doing them immediately. Real structural changes to script execution, they need something else.

edit (September 2023): The latest state of research on cross input signature aggregation (CISA) is summarized here.

  • 1
    "These things are not something that can be just added later on top of Taproot." Isn't that exactly what will need to happen though?
    – nilskp
    May 30, 2021 at 16:13
  • 2
    @nilskp: There is a difference between building on top of Taproot (e.g. a new leaf version) and not leveraging Taproot. Pieter's point above is that cross input signature aggregation can't leverage Taproot and has to be built from scratch. May 31, 2021 at 17:19
  • Thanks @Murch, you're right. I'll delete that last edit. Oct 28, 2021 at 11:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.