4

In a recent video about half signatures, Jonas Nick mentions that blockwide signature aggregation interferes with adaptor signatures and offering atomic swaps (I guess via PTLCs).

I am confused about what breaks in that case. Do I understand correctly that the main issue is that the signature depends on the adaptor secret? If so, the transaction (including its signature) would already be fixed in the block anyway. The only other intuition I have would be that it might hinder a non-interactive protocol for adaptor signatures, but that also doesn't seem obvious to me since, as far as I understand, blockwide aggregation would be done by the miners at the very end after all signatures are presented.

2 Answers 2

5

There is a simple information theoretic argument: when two parties produce an adaptor signature, one party will learn a secret tweak from the eventually published on-chain signature, by comparing it with the adaptor signature they had ahead of time.

In case of block-wide signature aggregation, there is just a single signature for the entire block. There is simply no space for that single signature to reveal multiple independent secrets to multiple independent parties.

1
  • But in theory, were a block to contain only one (1) adaptor signature, would it still work? Obviously that would be completely impractical and non-enforceable, but is it theoretically correct?
    – gijswijs
    Jan 27, 2022 at 5:15
1

The adaptor signature s' is the real signature s, minus a secret tweak t: s'=s-t

The adaptor signature is published together with the elliptic curve points R for the nonce and T for the tweak, which belong to their corresponding secrets r and t.

The Verifier can now do the verification and check that everything is valid. After this the Verifier has to wait for the real signature s to appear on-chain to calculate t: t=s-s'.

But in the case of block-wide signature aggregation, the real signature s never appears on-chain because it gets "lost" inside the aggregate signature. The aggregate signature s_agg is a sum of all the other signatures; in the case of Signature Half Aggregation it's a sum of all signatures, each multiplied by an unpredictable value z_i:

Signature Half Aggregation

s_agg is the only value to appear on-chain and it's useless for calculating t.

More in-depth info can be found here: https://www.gijsvandam.nl/post/why-does-signature-half-aggregation-break-adaptor-signatures/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.