BIP460: CISA for Taproot key path spends #36122

fjahr commented at 7:51 PM on August 29, 2026: contributor

Reference implementation of BIP460 Cross-Input Signature Aggregation for Taproot key path spends. Implements witness v2 outputs whose key path spends can be aggregated with BIP458 half-aggregation or BIP459 full-aggregation, or opt out with a plain BIP341 signature.

Draft to accompany the BIPs, not intended for merge:

BIP458: bitcoin/bips#2205
BIP459: bitcoin/bips#2210
BIP460: bitcoin/bips#2212

Further notes:

Depends on the unmerged secp256k1 modules from bitcoin-core/secp256k1#1566 (halfagg) and bitcoin-core/secp256k1#1754 (fullagg). The updated subtree here adds both.
Activation is regtest-only and there are no parameters set for other chains
BIP460 test vectors are vendored in src/test/data/ and run in src/test/cisa_tests.cpp. Additional functional tests cover relay and block validation.

Squashed 'src/secp256k1/' changes from 687155df6b7..a4aca78581b

a4aca78581b Merge bitcoin-core/secp256k1#1566: BIP458: Schnorr (Incremental) Half Aggregation
a548265ddce halfagg: Add docs
d959734fd5e halfagg: Add example
fa2a660f771 halfagg: Add benchmarks
3e67c93ea5e Experimental: Add BIP 458 half-aggregation for Schnorr signatures
65e57481c4c TBD: Sharing common code between fullagg and musig
cfbb70d3880 fullagg: Add ctime tests
f1f6604d3ce fullagg: Add benchmarks
3af59d5bac2 fullagg: Add docs
07776ea7f0a fullagg: Add to build system
22099f77de3 fullagg: Add to CI
5060640320d fullagg: Add example
a43d452401b fullagg: Add include file
8722f9ea4fa fullagg: Add module
bae6b89a203 Merge bitcoin-core/secp256k1#1908: refactor: replace `_get_hash_context` with direct `->hash_ctx` access
c8745f6b3ad refactor: replace `_get_hash_context` with direct `->hash_ctx` access
3397f3cb281 Merge bitcoin-core/secp256k1#1878: field: correct `_fe_half` docs (output is not normalized, input requires magnitude <= 31)
86c7cbaf5af Merge bitcoin-core/secp256k1#1915: refactor: Move (de)ser helpers from musig and eckey to group
bfd40bd0ce0 refactor: Rename privkey to seckey in eckey helpers
d8ee6e6cf67 refactor: Move parsing helpers from musig to group
a37d7cc064a Merge bitcoin-core/secp256k1#1916: ecdh/ellswift: simplify seckey loading with `_scalar_set_b32_seckey`
3d69f4ce1c7 Merge bitcoin-core/secp256k1#1911: refactor: rename `ctx` param to `ecmult_gen_ctx` where applicable
c00dc818105 ecdh/ellswift: simplify seckey loading with `_scalar_set_b32_seckey`
81a5a7567d1 refactor: rename `ctx` param to `ecmult_gen_ctx` where applicable
2577fb1888c refactor: Move pubkey parsing and serialization from eckey to group
439278a649d Merge bitcoin-core/secp256k1#1910: scratch: reject sizes that overflow when added to header
3d4340d1732 scratch: reject sizes that overflow when added to header
56e031a1482 field: correct `_fe_half` docs (output is not normalized, input requires magnitude <= 31)

git-subtree-dir: src/secp256k1
git-subtree-split: a4aca78581b69f7bc277fdf856b41d1c9377207d

b45f40c03b

DrahtBot commented at 7:51 PM on August 29, 2026: contributor

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

Code Coverage & Benchmarks

For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/36122.

Reviews

See the guideline and AI policy for information on the review process. A summary of reviews will appear here.

Conflicts

Reviewers, this pull request conflicts with the following ones:

#36188 (crypto: plug hardware optimized SHA256 into libsecp256k1's context by furszy)
#36167 ([RFC] Enable -Wunused by fanquake)
#36154 (wallet: fill PSBT_GLOBAL_XPUB for descriptors with more than one key by jeanpablojp)
#36133 (wallet: store multipath descriptor by Sjors)
#36114 (wallet: harden external signer psbt processing, revamp mock by Sjors)
#36091 (test: Add debug output to common tested types by rustaceanrob)
#36076 (psbt: preserve sighash type when merging inputs by thomasbuilds)
#36039 (psbt: classify missing Taproot script-path signatures as signer by btcpavao)
#35793 (Implement BIP 54 (Consensus Cleanup) without mainnet activation by darosior)
#35742 (descriptors: check duplicate keys in all multipath Miniscript branches by yashbhutwala)
#35713 (Remove boost as a unit test runner by rustaceanrob)
#35662 (script: prevent stale sighash caches across transactions by l0rinc)
#35569 (Encapsulation for CTransaction by purpleKarrot)
#35370 (rpc: add key-origin modes to PSBT processing RPCs by junbyjun1238)
#35301 (Silent Payments: Implement bip352 (take 2) by Eunovo)
#34520 (refactor: Add [[nodiscard]] to functions returning bool+mutable ref by maflcko)
#32857 (wallet: allow skipping script paths by Sjors)
#32575 (consensus: Remove special treatment for single threaded script checking by fjahr)
#30342 (kernel, logging: Pass Logger instances to kernel objects by ryanofsky)
#29843 (policy: Allow non-standard scripts with -acceptnonstdtxn=1 (test nets only) by ajtowns)
#29491 ([EXPERIMENTAL] Schnorr batch verification for blocks by fjahr)
#29247 (CAT in Tapscript (BIP-347) by arminsabouri)
#28690 (build: Introduce internal kernel library by sedited)

If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first.

DrahtBot added the label CI failed on Aug 29, 2026

fjahr force-pushed on Sep 7, 2026

fjahr commented at 7:54 PM on September 7, 2026: contributor

The latest commits, prefixed with draft-bip: go further than BIP460 itself. They implement two companion BIPs necessary for adoption that have not been reviewed and I don't think they are worth sharing on the mailing list yet either:

output script descriptors cisa() and rawcisa(): https://github.com/fjahr/cisa-playground/blob/main/bip_cisa_descriptor.mediawiki
PSBT fields and roles for aggregated inputs: https://github.com/fjahr/cisa-playground/blob/main/bip_cisa_psbt.mediawiki

They are included so that wallets and protocols, like payjoin or coinjoin for example, can build proofs of concept on top of this branch and exercise CISA end-to-end through the their already common descriptor, wallet and PSBT RPCs flows. Expect these commits to change as these drafts evolve. Review of the consensus and policy commits does not depend on them and I would prefer if review is focused on those unless you are building a PoC and depend on these later changes.

fjahr force-pushed on Sep 7, 2026

DrahtBot added the label Needs rebase on Sep 7, 2026

DrahtBot removed the label CI failed on Sep 7, 2026

Merge commit 'b45f40c03b0effe0ad53e49053b7a81923352afe' into bip460 239dba9b84

build: Enable secp halfagg and fullagg modules 067f8511dc

consensus: Add CISA deployment and script flag 7b9d10e289

script: Add witness v2 keypath signature message e99d6e105a

script: Add per-input witness v2 validation 7f9f8627b9

script: Add transaction-level CISA verification d74b4bec9c

validation: Add CISA check to the check queue 002355961c

policy: Make witness v2 transactions standard 639a2a7e6d

test: Add CISA unit tests with BIP460 test vectors 1b531fff1e

test: Add CISA functional test 4761d18cd5

draft-bip: descriptor: Add cisa() output script descriptor d25e2daba2

draft-bip: test: Add cisa() descriptor tests 01b437ae5c

draft-bip: cisa: Add half and full aggregation signing helpers 40d69a788b

draft-bip: psbt: Add CISA input fields 650c4df0ad

fjahr force-pushed on Sep 8, 2026

draft-bip: sign: Sign witness v2 inputs by aggregation mode 2c437f4967

draft-bip: psbt: Finalize CISA aggregation groups 695c09cdea

draft-bip: rpc: Add cisa_mode option to PSBT signing RPCs 1cfa826a7b

draft-bip: test: Add CISA PSBT tests 34eace4d37

draft-bip: cisa: Decouple full aggregation nonces from the signed message 421657c01b

draft-bip: wallet: Add reservecisanonce for pre-shared full aggregation nonces 41ea27e7ff

draft-bip: test: Test full aggregation with reserved nonces 224e15fd89

fjahr force-pushed on Sep 8, 2026

DrahtBot added the label CI failed on Sep 8, 2026

DrahtBot removed the label Needs rebase on Sep 8, 2026

DrahtBot removed the label CI failed on Sep 8, 2026

DrahtBot commented at 2:35 AM on September 9, 2026: contributor

🐙 This pull request conflicts with the target branch and needs rebase.

DrahtBot added the label Needs rebase on Sep 9, 2026