CISA Part 2: Half Signature Aggregation (Half-Agg)

Let’s break down how it works and where it can be used — with diagrams 👇

CISA allows multiple Schnorr signatures from different inputs to be combined into one aggregated signature.

→ Full agg: Interactive
→ Half agg: Non-Interactive

In this post, we explain half-agg.

WITHOUT signers needing to interact
Each signer signs independently, and an aggregator compresses the result later.

– Each Schnorr sig = 64 bytes
– So for n inputs: n × 64 bytes

– Keep R values
– Combine all s values into one
➡️ New size: 32 × n + 32 bytes

Estimated savings using half-agg:

Let’s look at where it can actually be used 👇

Combine all input signatures within a single transaction.

Combine all input signatures across a whole block.

Used for things like Lightning gossip messages — no miner or soft fork required.

At the block level, half-agg can:
– Break adaptor sigs (e.g. DLCs, atomic swaps)
– Impact reorg recovery of transactions

We’ll explain more in the next post 👇