What is the difference between key aggregation and signature aggregation?

Question

What is the difference between key aggregation (e.g. MuSig) and signature aggregation?

Many people (including myself) have in the past used these terms interchangeably. Why is it important to be careful to use the correct term in its correct setting?

Answer 1

As Pieter Wuille states here key aggregation is completed at address creation time not at signing time or post signing time.

Of course, key aggregation has an impact on the signing algorithm, and that's probably one of the main reasons why it's useful to do it before CISA: the work needed to support MuSig signing in wallet will take a while, but it's pretty similar to CISA signing.

Why is key aggregation better? Because it means the original keys never end up on chain. With signature aggregation you still have on-chain keys, but with 1 signature....Key aggregation means the consensus rules can be completely oblivious of even the concept of aggregation.

Downside: key aggregation cannot be used cross input, as you can't predict which UTXOs will be spent together.

Meanwhile signature aggregation is completed at signing time or post signing time, not at address creation time. To implement it it would possibly need a specific opcode that observes multiple keys.

Signature aggregation implies a verification algorithm that receives a list of (message,pubkey) pairs and a signature.

You could see key aggregation as a special case of signature aggregation as the aggregated signature is also a valid "single key" signature for the aggregated key. But conceptually there is a huge difference in how they would be implemented.

Why is it important to be careful to use the correct term in its correct setting?

The proposed Taproot soft fork does not enable signature aggregation at all (cross input or otherwise), it facilitates key aggregation schemes e.g. MuSig. As Pieter says, the consensus rules of Taproot and Schnorr don't have any awareness of aggregation. Hence if you say Taproot enables signature aggregation this is incorrect and will confuse. In addition, when moving onto the discussion of what soft fork(s) could potentially follow Taproot, enabling signature aggregation will be a candidate feature that is seriously considered as the block space savings could be significant. (Note witness data is already discounted post SegWit). Key aggregation allows you to aggregate keys within one input but cross input signature aggregation could potentially allow you to aggregate signatures across inputs.

Aggregating signatures not only across inputs but across transactions could potentially mean only one signature goes onchain for the entire block. However, this is not possible with discrete logarithm based cryptography (see Pieter's comment below). It needs non-interactive aggregation as you can't require transaction authors to cooperate. This aggregation needs to be done by miners.