Tim Ruffing, Yannick Seurin and I published DahLIAS, the first protocol for full cross-input signature aggregation (CISA) that can reuse Bitcoin’s curve, secp256k1.
- Aggregate signatures are 64 bytes.
- Verification is about twice as fast as for half-aggregated Schnorr signatures.
- Signing takes two rounds.
For more background on cross-input signature aggregation in Bitcoin, see Fabian Jahr’s report for the Human Rights Foundation.