In a recent video about half signatures, Jonas Nick mentions that blockwide signature aggregation interferes with adaptor signatures and offering atomic swaps (I guess via PTLCs).

I am confused about what breaks in that case. Do I understand correctly that the main issue is that the signature depends on the adaptor secret? If so, the transaction (including its signature) would already be fixed in the block anyway. The only other intuition I have would be that it might hinder a non-interactive protocol for adaptor signatures, but that also doesn't seem obvious to me since, as far as I understand, blockwide aggregation would be done by the miners at the very end after all signatures are presented.


There is a simple information theoretic argument: when two parties produce an adaptor signature, one party will learn a secret tweak from the eventually published on-chain signature, by comparing it with the adaptor signature they had ahead of time.

In case of block-wide signature aggregation, there is just a single signature for the entire block. There is simply no space for that single signature to reveal multiple independent secrets to multiple independent parties.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.