6

Cross-input signature aggregation (CISA) refers to an idea to produce one shared signature that covers multiple inputs in one transaction. The aggregation is made possible by the linearity of the Schnorr signature algorithm. Note that CISA seems to be mostly interesting for key path spending and this answer will not look at script path spending at all. ...


4

Cross-Input Signature Aggregation (CISA) is an idea for allowing multiple inputs to be covered by a single signature. One of the main motivations is that it would allow multiple users to combine transactions they're about to send in a single transaction and reduce the overall cost. To that end, CISA is chiefly interesting for key path spends. The current ...


4

Pieter Wuille answered this on Twitter. The most important complication of cross input aggregation is explained in this Bitcoin dev mailing list post by AJ Towns. TL;DR: if softforks change which signatures are checked, they mustn't change what is aggregated together. This is especially complicated when they interact with BIP341's OP_SUCCESSx upgrade ...


3

As Pieter Wuille states here key aggregation is completed at address creation time not at signing time or post signing time. Of course, key aggregation has an impact on the signing algorithm, and that's probably one of the main reasons why it's useful to do it before CISA: the work needed to support MuSig signing in wallet will take a while, but it's pretty ...


2

Murch answered this on Twitter. The signatures for P2TR are part of the witness data already, and Schnorr sigs are only 64 bytes. Each aggregated signature but the last would need a one byte placeholder. So, the savings for a n-input tx would be (n-1)*63WU minus whatever other overhead is added. A P2TR key-path input weighs 230 WU (57.5 vB), the header 42 ...


1

The idea behind CISA is to only provide a single signature per Bitcoin transaction even when there are multiple inputs. A key advantage of the Schnorr signature algorithm over ECDSA is its linearity. As Sachin's answer described already, this permits multiple signers to construct a single signature which proves a message's authorization by several keys. In ...


1

Schnorr Signatures and public keys can be aggregated (added together) such that S1 + S2 = S3 and P1 + P2 = P3 where (S3, P3) is a valid signature-pubkey pair IFF (S1, P1) and (S2,P2) were valid signature-pubkey pairs. Because of this, if a transaction has n inputs, the signatures of those inputs can be aggregated, so the transaction only needs one signature ...


1

Without CISA: Multiple inputs in a Bitcoin transaction requires multiple signatures With CISA: Multiple inputs require only one signature How many inputs are used in different coinjoin implementations? Joinmarket: More than 3 (Example Tx) Wasabi: More than 10 (Example Tx) Whirlpool: 5 (Example Tx) Let's assume 5 number of inputs for whirlpool, 50 for ...


Only top voted, non community-wiki answers of a minimum length are eligible