BIP459: Full-Aggregation of BIP340 Signatures #2210

This is a BIP draft for full-aggregation of BIP340 Schnorr signatures, a standard for the DahLIAS scheme by Jonas Nick, Tim Ruffing, and Yannick Seurin. It complements BIP458 half-aggregation. Full-aggregation results in a constant 64-byte signature but requires an interactive signing protocol.

Compared to the version shared on the mailing list recently, this version incorporates waxwing's feedback from the thread, most notably:

1. More info on the uniqueness check in Sign and new test vectors covering this and other checks
2. A description of the deterministic nonce attack
3. Clarifications on the security model and other language improvements for clarity

The reference implementation is written in Python based on secp256k1lab, and the latest master of secp256k1lab is vendored with the BIP, same as it was done for BIP458.

I had asked BIP editors to reserve 459 for this so the CISA related BIPs can be in consecutive order, but I didn't want to cause confusion as it might have looked like self-assigment if had just pushed it with the number. So waiting for a confirmation for the number :)

Yes, 459 was reserved for Full-Aggregation of BIP340 Signatures.