<p>The adaptor signature <em>s'</em> is the <em>real</em> signature <em>s</em>, minus a secret tweak <em>t</em>: <em>s'=s-t</em></p>
<p>The adaptor signature is published together with the elliptic curve points <em>R</em> for the nonce and <em>T</em> for the tweak, which belong to their corresponding secrets <em>r</em> and <em>t</em>.</p>
<p>The Verifier can now do the verification and check that everything is valid. After this the Verifier has to wait for the <em>real</em> signature <em>s</em> to appear on-chain to calculate <em>t</em>: <em>t=s-s'</em>.</p>
<p>But in the case of block-wide signature aggregation, the <em>real</em> signature <em>s</em> never appears on-chain because it gets &quot;lost&quot; inside the aggregate signature. The aggregate signature <em>s_agg</em> is a sum of all the other signatures; in the case of Signature Half Aggregation it's a sum of all signatures, each multiplied by an unpredictable value z_i:</p>
<p><a href="https://i.sstatic.net/FZYL6.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/FZYL6.png" alt="Signature Half Aggregation" /></a></p>
<p><em>s_agg</em> is the only value to appear on-chain and it's useless for calculating <em>t</em>.</p>
<p>More in-depth info can be found here: <a href="https://www.gijsvandam.nl/post/why-does-signature-half-aggregation-break-adaptor-signatures/" rel="nofollow noreferrer">https://www.gijsvandam.nl/post/why-does-signature-half-aggregation-break-adaptor-signatures/</a></p>

CC BY-SA 4.0
2022-04-05T00:53:04.503Z
2022-04-05T00:53:04.503Z
gijswijs
<p>There is a simple information theoretic argument: when two parties produce an adaptor signature, one party will learn a secret tweak from the eventually published on-chain signature, by comparing it with the adaptor signature they had ahead of time.</p>
<p>In case of block-wide signature aggregation, there is just a single signature for the entire block. There is simply no space for that single signature to reveal multiple independent secrets to multiple independent parties.</p>

CC BY-SA 4.0
2022-01-27T05:15:14.733Z
But in theory, were a block to contain only one (1) adaptor signature, would it still work? Obviously that would be completely impractical and non-enforceable, but is it theoretically correct?
gijswijs
CC BY-SA 4.0
2021-06-23T06:00:09.647Z
2021-06-23T06:00:09.647Z
Pieter Wuille
<p>In a <a href="https://youtu.be/Dns_9jaNPNk" rel="nofollow noreferrer">recent video about half signatures</a>, Jonas Nick mentions that blockwide signature aggregation interferes with adaptor signatures and offering atomic swaps (I guess via PTLCs).</p>
<p>I am confused about what breaks in that case. Do I understand correctly that the main issue is that the signature depends on the adaptor secret? If so, the transaction (including its signature) would already be fixed in the block anyway. The only other intuition I have would be that it might hinder a non-interactive protocol for adaptor signatures, but that also doesn't seem obvious to me since, as far as I understand, blockwide aggregation would be done by the miners at the very end after all signatures are presented.</p>

<signature><message-signing><schnorr-signatures><atomic-swap>
Why does blockwide signature aggregation prevent adaptor signatures?
Rene Pickhardt
# Why does blockwide signature aggregation prevent adaptor signatures?

(Asked by: username_0 on 2021-06-23)

In a [recent video about half signatures](https://youtu.be/Dns_9jaNPNk), Jonas Nick mentions that blockwide signature aggregation interferes with adaptor signatures and offering atomic swaps (I guess via PTLCs).

I am confused about what breaks in that case. Do I understand correctly that the main issue is that the signature depends on the adaptor secret? If so, the transaction (including its signature) would already be fixed in the block anyway. The only other intuition I have would be that it might hinder a non-interactive protocol for adaptor signatures, but that also doesn't seem obvious to me since, as far as I understand, blockwide aggregation would be done by the miners at the very end after all signatures are presented.

**Tags:** signature, message-signing, schnorr-signatures, atomic-swap


---

## 2 answers

### Answer by username_2 on 2021-06-23. Score: 5 | Accepted answer

There is a simple information theoretic argument: when two parties produce an adaptor signature, one party will learn a secret tweak from the eventually published on-chain signature, by comparing it with the adaptor signature they had ahead of time.

In case of block-wide signature aggregation, there is just a single signature for the entire block. There is simply no space for that single signature to reveal multiple independent secrets to multiple independent parties.

> **Comments:**
> **username_1**: But in theory, were a block to contain only one (1) adaptor signature, would it still work? Obviously that would be completely impractical and non-enforceable, but is it theoretically correct?  

---

### Answer by username_1 on 2022-04-05. Score: 1

The adaptor signature *s'* is the *real* signature *s*, minus a secret tweak *t*: *s'=s-t*

The adaptor signature is published together with the elliptic curve points *R* for the nonce and *T* for the tweak, which belong to their corresponding secrets *r* and *t*.

The Verifier can now do the verification and check that everything is valid. After this the Verifier has to wait for the *real* signature *s* to appear on-chain to calculate *t*: *t=s-s'*.

But in the case of block-wide signature aggregation, the *real* signature *s* never appears on-chain because it gets "lost" inside the aggregate signature. The aggregate signature *s\_agg* is a sum of all the other signatures; in the case of Signature Half Aggregation it's a sum of all signatures, each multiplied by an unpredictable value z\_i:

[![Signature Half Aggregation](https://i.sstatic.net/FZYL6.png)](https://i.sstatic.net/FZYL6.png)

*s\_agg* is the only value to appear on-chain and it's useless for calculating *t*.

More in-depth info can be found here: <https://www.gijsvandam.nl/post/why-does-signature-half-aggregation-break-adaptor-signatures/>


---

