Date: Wed, 21 Mar 2018 19:28:00 -0400
To: Anthony Towns <aj@erisian.com.au>
From: ZmnSCPxj@protonmail.com
Reply-To: ZmnSCPxj@protonmail.com
Message-ID: <OKn7sFgvccsvoIDlGE_fFQ8a2EnGkfiWLvzBWs1vI2LdrWdQaO4ufySwLj1GDrykFrT5GI6-gLHDwuiKQOnvUEBe9oHLT3gu0jJJx7gw_xM=@protonmail.com>
In-Reply-To: <20180321112119.GA6588@erisian.com.au>
References: <20180321040618.GA4494@erisian.com.au>
	<d_OOMciZ--WI6X8V1PWVCcPGyEFo7AWcNcXls8uUK8itK8pkoUJLRsekBYUdXTRYg_pOinoBQliMFKfzWW48kd3isE6DbkIVoI5frIxOBFo=@protonmail.com>
	<20180321112119.GA6588@erisian.com.au>
Feedback-ID: el4j0RWPRERue64lIQeq9Y2FP-mdB86tFqjmrJyEPR9VAtMovPEo9tvgA0CrTsSHJeeyPXqnoAu6DN-R04uJUg==:Ext:ProtonMail
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Soft-forks and schnorr signature aggregation
Precedence: list

Good morning aj,


=E2=80=8BSent with ProtonMail Secure Email.=E2=80=8B

=E2=80=90=E2=80=90=E2=80=90=E2=80=90=E2=80=90=E2=80=90=E2=80=90 Original Me=
ssage =E2=80=90=E2=80=90=E2=80=90=E2=80=90=E2=80=90=E2=80=90=E2=80=90

On March 21, 2018 7:21 PM, Anthony Towns <aj@erisian.com.au> wrote:

> On Wed, Mar 21, 2018 at 03:53:59AM -0400, ZmnSCPxj wrote:
>=20
> > Good morning aj,
>=20
> Good evening Zeeman!
>=20
> [pulled from the bottom of your mail]
>=20
> > This way, rather than gathering signatures, we gather public keys for a=
ggregate signature checking.
>=20
> Sorry, I probably didn't explain it well (or at all): during the script,
>=20
> you're collecting public keys and messages (ie, BIP 143 style digests)
>=20
> which then go into the signing/verification algorithm to produce/check
>=20
> the signature.

Yes, I think this is indeed what OP_CHECK_AGG_SIG really does.

What I propose is that we have two places where we aggregate public keys: o=
ne at the script level, and one at the transaction level.  OP_ADD_AGG_PUBKE=
Y adds to the script-level aggregate, then OP_CHECK_AGG_SIG adds the script=
-level aggregate to the transaction-level aggregate.

Unfortunately it will not work since transaction-level aggregate (which is =
actually what gets checked) is different between pre-fork and post-fork nod=
es.

It looks like signature aggregation is difficult to reconcile with script..=
.

Regards,
ZmnSCPxj