CISA Part 2: Half Signature Aggregation (Half-Agg)CISA Part 2: Half Signature Aggregation (Half-Agg)
Let’s break down how it works and where it can be used — with diagrams 👇
Quick reminder from Part 1Quick reminder from Part 1
CISA allows multiple Schnorr signatures from different inputs to be combined into one aggregated signature.
CISA has two modes:CISA has two modes:
→ Full agg: Interactive
→ Half agg: Non-Interactive
In this post, we explain half-agg.
Half-agg allows signatures to be combined into oneHalf-agg allows signatures to be combined into one
WITHOUT signers needing to interact
Each signer signs independently, and an aggregator compresses the result later.
Why does half-agg save ~50% in size?Why does half-agg save ~50% in size?
(If you're not into technical breakdowns, feel free to skip this part 😁)
BEFOREBEFORE
– Each Schnorr sig = 64 bytes
– So for n inputs: n × 64 bytes
AFTERAFTER
– Keep R values
– Combine all s values into one
➡️ New size: 32 × n + 32 bytes
Based on recent Bitcoin usage...Based on recent Bitcoin usage...
Estimated savings using half-agg:
- ~19.3% space
- ~6.9% fees
(Assumes no major behavior change post-CISA)
Now that we understand how half-agg works…Now that we understand how half-agg works…
Let’s look at where it can actually be used 👇
Application #1: Transaction-wide AggregationApplication #1: Transaction-wide Aggregation
Combine all input signatures within a single transaction.
Application #2: Block-wide AggregationApplication #2: Block-wide Aggregation
Combine all input signatures across a whole block.
Application #3: Off-chain protocols / P2PApplication #3: Off-chain protocols / P2P
Used for things like Lightning gossip messages — no miner or soft fork required.
But there are challenges!!But there are challenges!!
At the block level, half-agg can:
– Break adaptor sigs (e.g. DLCs, atomic swaps)
– Impact reorg recovery of transactions
We’ll explain more in the next post 👇