Exploring Cross-Input Signature Aggregation (CISA)

Bitcoin's growing popularity has everyone talking about what can be done next for better scalability and privacy. CISA, or Cross-Input Signature Aggregation, is one approach that combines multiple signatures into one, thanks to schnorr signatures from the taproot upgrade.

The idea of reducing transaction size is pretty exciting. With blocksize limits and low Lightning Network usage, it could have a real impact. I’m curious how much space we can save by merging transaction and block-level aggregation. My bet is not many wallets will bother with full aggregation since it requires more coding.

CISA has two models: half-agg and full-agg. The half-agg model is non-interactive and based on blocks 833000 to 886000, it could save around 19% in space and nearly 7% in fees.

It's worth mentioning that CISA doesn't directly boost privacy. But it does make coinjoin transactions cheaper, which can motivate users to gain privacy while saving some cash.

I just caught a podcast update about CISA that pointed to a paper on this topic. It’s on the same site you posted. Gonna keep this thread saved for later.

If this works out, it could be a major win for privacy, assuming aggregated inputs can't be reverse-engineered. I’m a fan of this direction; we need more scalability in Bitcoin, and it’s finally in the early stages.

Really cool stuff here. The effects on CoinJoins and exchange consolidation could be massive. But it still feels like we’re a ways off. I saw a draft BIP for half-agg, but some research suggests it might mess with privacy for methods like adaptor signatures. Plus, the full-agg hasn’t been proven secure yet.

The devs mostly come from research backgrounds. They usually won’t make changes unless there’s solid proof of security. Has half-agg been proven safe? I’m not diving into papers any time soon.

From what I gathered in that 2024 chat, it is secure. The CISA research site has some details on half-agg. I found links to the proofs too.

After sharing slides on half-agg, I’ve got full-agg slides to show. For full-agg, interactivity is key; everyone needs to participate for the signature to work. It should save a bit more space and fees than half-agg.

@cygan, those visuals are great! Did you whip them up? They should be showcased somewhere like the Bitcoin Wiki.

I didn’t make them, just sourced them from the slides. But yeah, full-agg is trickier but offers more savings.

I’m curious how this will affect transaction transparency.

Actually, it might not impact transparency the way some think. The links between signatures and previous transactions remain intact. The catch is not every kind of transaction can use CISA for signature aggregation. If people start using this to save fees, there might be very few non-CISA transactions left, mainly special cases.