BIP draft: Half-Aggregation of BIP 340 Signatures #2205

  21 | +Half-aggregation is a non-interactive process for aggregating a collection of signatures into a single aggregate signature.
  22 | +The size of the resulting aggregate signature is approximately half of the combined size of the original signatures.
  23 | +
  24 | +=== Copyright ===
  25 | +
  26 | +This document, along with the reference implementation and test vectors in the [[bip-XXXX/|bip-XXXX directory]], is licensed under the BSD-3-Clause License. The exception is the vendored copy of the secp256k1lab library in [[bip-XXXX/secp256k1lab/|bip-XXXX/secp256k1lab]], which is licensed under the MIT License as stated in its [[bip-XXXX/secp256k1lab/COPYING|COPYING]] file.

---

  17 | +
  18 | +=== Abstract ===
  19 | +
  20 | +This document describes ''half-aggregation'' of BIP 340 signatures.
  21 | +Half-aggregation is a non-interactive process for aggregating a collection of signatures into a single aggregate signature.
  22 | +The size of the resulting aggregate signature is approximately half of the combined size of the original signatures.

---

  62 | +            if expected_result == "FALSE":
  63 | +                try:
  64 | +                    Aggregate(pms)
  65 | +                    failures.append(f"Aggregate #{index}: {comment}")
  66 | +                except:
  67 | +                    pass

---

  93 | +
  94 | +The following pseudocode is ''not'' a specification but is only intended to augment the actual Python [[#specification|specification]].
  95 | +
  96 | +==== Notation ====
  97 | +
  98 | +The following conventions are used, with constants as defined for [https://www.secg.org/sec2-v2.pdf secp256k1]. We note that adapting this specification to other elliptic curves is not straightforward and can result in an insecure scheme<ref>Among other pitfalls, using the specification with a curve whose order is not close to the size of the range of the nonce derivation function is insecure.</ref>.

---

  90 | +        r_values.append(ri)
  91 | +
  92 | +        # Let si = int(sigi[32:64]); fail if si ≥ n
  93 | +        si = int_from_bytes(sigi[32:64])
  94 | +        if si >= n:
  95 | +            raise ValueError("si must be less than n")

---

 141 | +        # Let (pki, mi) = pm_aggdi
 142 | +        (pki, mi) = pm_aggd[i]
 143 | +
 144 | +        # Let Pi = lift_x(int(pki)); fail if that fails
 145 | +        try:
 146 | +            Pi = GE.lift_x(int_from_bytes(pki))

---

  36 | +    # Let aggsig = bytes(0)
  37 | +    aggsig = bytes([0] * 32)
  38 | +
  39 | +    pm_aggd = []
  40 | +    if not VerifyAggregate(aggsig, pm_aggd):
  41 | +        raise

---