diff --git a/half-aggregation.mediawiki b/half-aggregation.mediawiki index bb3ecec..c6ca7d5 100644 --- a/half-aggregation.mediawiki +++ b/half-aggregation.mediawiki @@ -62,7 +62,7 @@ Moreover, they came up with an elegant approach to incremental aggregation that * A half-aggregate signature of ''u'' BIP 340 input signatures is serialized as the ''(u+1)⋅32''-byte array ''r1 || ... || ru || bytes(s)'' where ''ri'' is a 32-byte array from input signature ''i'' and ''s'' is a scalar aggregate (see below for details). * This document does ''not'' specify the aggregation of multiple aggregate signatures (yet). It is possible, but requires changing the encoding of an aggregate signature. Since it is not possible to undo the aggregation of the s-values, when verifying of such an aggregate signature the randomizers need to be the same as when verifying the individual aggregate signature. Therefore, the aggregate signature needs to encode a tree that reveals how the individual signatures were aggregated and how the resulting aggregate signatures were reaggregated. * The first randomizer ''z0'' is fixed to the constant ''1'', which speeds up verification because ''z0⋅R0 = R0''. This optimization has been suggested and proven secure by [https://eprint.iacr.org/2022/222.pdf Chen and Zhao]. -* The maximum number of signatures that can be aggregated is ''216 - 1''. Having a maximum value is supposed to prevent integer overflows. This specific value was a conservative choice and may be raised in the future (TODO). +* In order to facilitate testing and prevent ressource exhaustion, the number of signatures that can be aggregated is limited to ''216 - 1''. The specific value was a conservative choice and may be raised in the future (TODO). Implementations may choose to enforce lower limits. Applications should enforce lower limits that suits their needs, taking into account that processing large aggregates may take a considerable amount of time. We note that there must be agreement over the limits in consensus-critical applications. == Description ==