Subject: Re: [bitcoin-dev] Design approaches for Signature Aggregation

From: "Russell O'Connor" <[email-masked]>
Date: Tue, 30 Jan 2018 18:25:55 -0500

On Tue, Jan 30, 2018 at 2:12 PM, Russell O'Connor <[email-masked]>
wrote:

>
> and there are probably other designs for signature aggregation beyond the
> two designs I'm discussing here.
>

For example, in private communication Pieter suggested putting the
aggregate signature data into the top of the first segwit v1+ input witness
(and pop it off before evaluation of the input script) whether or not that
input is participating in the aggregation or not.  This makes this
canonical choice of position independent of the runtime behaviour of other
scripts and also prevents the script from accessing the aggregate signature
data itself, while still fitting it into the existing witness data
structure. (It doesn't let us toy with the weights of aggregated signature,
but I hope people will still be motivated to use taproot solely over P2WPKH
based on having the option to perform aggregation.)

Being able to allow aggregation to be compatible with future script or
opcode upgrades is still very difficult to design.