What is cross-input signature aggregation and how would it work?

Question

I'm seeing lots of mentions of cross-input signature aggregation (CISA) lately. It appears to be something that one can do with Schnorr signatures. What is the main idea of CISA? What would a transaction look like that makes use of CISA?

Answer 1

The idea behind CISA is to only provide a single signature per Bitcoin transaction even when there are multiple inputs.

A key advantage of the Schnorr signature algorithm over ECDSA is its linearity. As Sachin's answer described already, this permits multiple signers to construct a single signature which proves a message's authorization by several keys.

In Bitcoin, traditionally each input requires a signature committing to a digest of the complete transaction, the sighash. For non-segwit inputs, each input's sighash was distinct (which was also causing the quadratic hashing problem), but the sighash is uniform for all segwit inputs in one transaction. Since all segwit inputs in one transaction commit to the same digest, a single signature can be used to satisfy multiple inputs.

The current sketch for CISA proposes to replace all but one of the corresponding witnesses with a one-byte placeholder and then to provide only a single signature for all the encompassed inputs in the last input's witness. For a transaction with n inputs, this would reduce the transaction data by n-1 signatures adding n-1 one-byte placeholders in their stead.

Answer 2

Schnorr Signatures and public keys can be aggregated (added together) such that

S1 + S2 = S3 and P1 + P2 = P3 where (S3, P3) is a valid signature-pubkey pair IFF (S1, P1) and (S2,P2) were valid signature-pubkey pairs.

Because of this, if a transaction has n inputs, the signatures of those inputs can be aggregated, so the transaction only needs one signature and public key even with any number of inputs, whereas a regular transaction would need n signatures and public keys.

The main benefit being block space (fee) savings.