diff --git a/README.mediawiki b/README.mediawiki
index 140eed3076..cf438ba462 100644
--- a/README.mediawiki
+++ b/README.mediawiki
@@ -1513,6 +1513,13 @@ users (see also: [https://en.bitcoin.it/wiki/Economic_majority economic majority
| bubb1es, haris
| Specification
| Draft
+|-
+| [[bip-0460.mediawiki|460]]
+| Consensus (soft fork)
+| CISA for Taproot Key Path Spends in SegWit v2
+| Fabian Jahr
+| Specification
+| Draft
|}
diff --git a/bip-0460.mediawiki b/bip-0460.mediawiki
new file mode 100644
index 0000000000..19299356b7
--- /dev/null
+++ b/bip-0460.mediawiki
@@ -0,0 +1,576 @@
+
+ BIP: 460
+ Layer: Consensus (soft fork)
+ Title: CISA for Taproot Key Path Spends in SegWit v2
+ Authors: Fabian Jahr
+ Status: Draft
+ Type: Specification
+ Assigned: 2026-07-28
+ License: CC0-1.0 OR MIT
+ Discussion: 2026-07-18: https://groups.google.com/g/bitcoindev/c/1XH6sBLWZuA
+ Requires: 340, 341, 458, 459
+
+
+== Introduction ==
+
+=== Abstract ===
+
+This document proposes cross-input signature aggregation (CISA) for Bitcoin transactions.
+A new witness version (v2) enables Taproot-style key path spending with two Schnorr signature aggregation schemes: half-aggregation and full-aggregation.
+Half-aggregation non-interactively reduces ''n'' signatures from ''64*n'' bytes to ''(n+1)*32'' bytes, while full-aggregation reduces them to a constant 64 bytes but requires interactive signing.
+Aggregated inputs carry their share of the aggregate signature data and optionally a sighash type, with a marker byte indicating the aggregation mode (half-agg or full-agg) on the last input of each group, while opted-out inputs carry a plain BIP 341 signature.
+The opt-out mode exists for protocols that depend on a specific signature appearing on chain, such as some adaptor signature protocols.
+
+=== Copyright ===
+
+This document, along with the [[bip-0460/test-vectors.py|test vector generator]] and test vectors, is licensed under CC0-1.0 or the MIT License, at your option.
+The vendored copy of the secp256k1lab library in [[bip-0460/secp256k1lab/|bip-0460/secp256k1lab]] is licensed under the MIT License only, as stated in its [[bip-0460/secp256k1lab/COPYING|COPYING]] file.
+
+=== Motivation ===
+
+Signature data makes up a large share of Bitcoin transaction sizes.
+Each Taproot key path spend requires a 64-byte [[bip-0340.mediawiki|BIP 340]] Schnorr signature, so transactions with many inputs spend much of their weight on signatures.
+
+The linearity of Schnorr signatures allows combining multiple signatures into a more compact form.
+Cross-input signature aggregation applies this to the signatures of different inputs within one transaction.
+
+This provides:
+
+* '''Lower fees and smaller transactions''': Signature data shrinks with the number of aggregated inputs, reducing transaction weight and fees and freeing up block space
+* '''Reduced cost of privacy''': Aggregation reduces the signature cost of any batched transaction, and collaborative transactions such as CoinJoin and PayJoin benefit the most per participant because they batch the inputs of many users
+* '''Flexible usage''': Two aggregation schemes serve different use cases and individual inputs can opt out
+* '''Protocol compatibility''': The opt-out protects protocols that depend on a specific signature appearing on chain
+* '''Low initial adoption cost''': Opted-out spends are plain BIP 341 key path spends, so wallets that do not aggregate can adopt witness v2 outputs without new signing logic
+
+Use cases include:
+
+* '''CoinJoin/PayJoin transactions''': With CISA, the per-participant cost of CoinJoin and PayJoin transactions decreases as the number of participants increases, making privacy-enhancing usage cheaper
+* '''Consolidation and batching''': Businesses and users combining many small UTXOs into a single output or multiple payment outputs benefit from reduced transaction costs
+* '''Lightning channel opens and splices''': Dual funding and splicing combine inputs from both peers in a collaborative transaction, and the existing interactive negotiation between the peers can accommodate the signing rounds of full-aggregation
+
+Aside from these use cases, any transaction spending more than one witness v2 input benefits from CISA through fee savings.
+
+== Design ==
+
+This BIP introduces a new witness version (v2) that enables signature aggregation for Taproot-style key path spends.
+The design reuses the existing Taproot and tapscript machinery wherever possible and makes aggregation opt-in on a per-input basis, so witness v2 outputs can be adopted independently of whether aggregation is used.
+Both aggregation schemes are supported, inputs can opt out, and aggregation is limited to key path spends.
+The reasoning behind these decisions is covered in the [[#rationale|Rationale]] section.
+
+The main design decision is that every aggregated witness v2 key path input carries only its share of the aggregate signature data plus an optional sighash byte, while opted-out inputs carry a plain BIP 341 signature.
+The last input in each aggregation group completes the aggregate signature and tags it with a marker byte identifying the scheme.
+This design:
+
+* Shows which inputs participate in aggregation
+* Lets each input specify its own sighash type
+* Allows mixing aggregated, opted-out, and non-aggregated inputs in the same transaction
+* Commits to the aggregation mode in the signature message, protecting opted-out inputs from non-consensual aggregation by third parties
+* Supports half-aggregation and full-aggregation within the same transaction (as separate groups, one per scheme)
+
+== Specification ==
+
+=== Witness version 2 ===
+
+Witness version 2 outputs are created with a scriptPubKey of OP_2 <32-byte witness program> (or 0x5220{32-byte witness program}).
+
+Validation of witness v2 spends is identical to the witness version 1 rules of [[bip-0341.mediawiki|BIP 341]], with the following modifications for key path spends:
+
+* The single witness stack element remaining after removal of the optional annex is only interpreted as a signature if it is 64 bytes long, or 65 bytes long with a last byte that is not a marker byte. Otherwise its interpretation follows the aggregation forms defined below.
+* For inputs that participate in aggregation, the key path signature message and signature verification are replaced by the rules defined below.
+
+All other rules apply unchanged.
+In particular script path spending and its upgrade mechanisms, annex handling, and the treatment of witness programs that are not exactly 32 bytes long or are wrapped in P2SH follow BIP 341.
+Signatures inside script path spends are not aggregated under this BIP.
+
+=== Marker definitions ===
+
+This BIP defines two marker bytes for the final inputs of the aggregation groups:
+
+* 0xbc: '''Half-aggregation marker'''. The input completes the half-aggregation group.
+* 0xbd: '''Full-aggregation marker'''. The input completes the full-aggregation group.
+
+The marker is the last byte of the final input's witness element.
+The marker byte is not an opcode, since a key path witness element is not script.
+The only structural constraint is that markers must be disjoint from the valid sighash types, so that a 65-byte witness element ending in a marker can never be a valid BIP 341 signature.
+A 64-byte element is always an opted-out signature, since no marked form has that length.
+The chosen values fall into the range 0xbb to 0xfe, which is unassigned in legacy script and corresponds to OP_SUCCESS opcodes in tapscript, so they do not collide with opcodes commonly seen in scripts.
+
+Opted-out inputs and aggregation group members carry no marker.
+An opted-out witness element is a 64-byte or 65-byte BIP 341 signature, and member elements are identified by their length.
+A key path spend whose witness element is neither such a signature nor one of the aggregation forms defined below is invalid.
+Undefined marker values cannot serve as an upgrade hook because witness data is not committed to by the output.
+A marker value that validated unconditionally would make every witness v2 output spendable by anyone.
+Future aggregation modes are therefore expected to be introduced through new witness versions or new leaf versions instead of new marker values.
+
+=== Witness structure ===
+
+Aggregation changes only the content of the witness.
+The transaction format is unchanged.
+A transaction may contain at most two aggregation groups: one half-aggregation group and one full-aggregation group.
+Aggregated and non-aggregated inputs can be mixed in any order, with the constraint that all members of a group must appear before the input carrying the group's marker.
+The input carrying a group's marker is called the ''final input'' of the group, all other aggregated inputs are called ''members''.
+Only witness v2 key path spends can participate in aggregation groups.
+Inputs spending other output types, as well as witness v2 script path spends and opted-out key path spends, are validated independently under their own rules and can be combined freely with aggregated inputs in the same transaction.
+
+Each witness v2 key path spend uses a single witness element (plus optional annex).
+For opted-out inputs this element is a 64-byte or 65-byte BIP 341 signature.
+For aggregated inputs it consists of the input's share of the aggregate signature data, an optional sighash byte, and the marker on the final input:
+
+* '''Signature data''': The 32-byte nonce share for half-aggregation members, nothing for full-aggregation members, and the completion of the aggregate signature for final inputs
+* '''Sighash type''': Optional byte following the signature data. If absent, SIGHASH_DEFAULT (0x00) is used'''Why does the marker follow the sighash byte and the signature data?''' Traditionally the sighash byte is appended to the signature, as in the 65-byte signatures of BIP 341, and this BIP keeps that order. Placing the marker last, in the position of the sighash byte, is what allows opted-out inputs to use unchanged BIP 341 signatures. A 65-byte element ending in a valid sighash byte is an opted-out signature and one ending in a marker is an aggregation group final, and no marked form is 64 bytes long. With the marker in front, a 65-byte element could be either an opted-out signature with a sighash byte or a full-aggregation final without one.
+* '''Marker''': Last byte of the final input's element (0xbc or 0xbd)
+
+The marker and the length of the witness element together determine its interpretation:
+
+{| class="wikitable"
+|+ Valid witness element forms by marker and length
+|-
+! Marker !! Length !! Content !! Interpretation
+|-
+| none || 64 bytes || 64-byte signature || Opted-out, SIGHASH_DEFAULT
+|-
+| none || 65 bytes || 64-byte signature and sighash || Opted-out, explicit sighash
+|-
+| none || 0 bytes || none || Full-aggregation member, SIGHASH_DEFAULT
+|-
+| none || 1 byte || sighash || Full-aggregation member, explicit sighash
+|-
+| none || 32 bytes || nonce share || Half-aggregation member, SIGHASH_DEFAULT
+|-
+| none || 33 bytes || nonce share and sighash || Half-aggregation member, explicit sighash
+|-
+| 0xbc || 65 bytes || nonce share and 32-byte ''s'' value || Half-aggregation final, SIGHASH_DEFAULT
+|-
+| 0xbc || 66 bytes || nonce share, ''s'' value, and sighash || Half-aggregation final, explicit sighash
+|-
+| 0xbd || 65 bytes || 64-byte signature || Full-aggregation final, SIGHASH_DEFAULT
+|-
+| 0xbd || 66 bytes || 64-byte signature and sighash || Full-aggregation final, explicit sighash
+|}
+
+All forms have a fixed length.
+A witness element whose marker and length combination matches no row of this table is invalid.
+Opted-out elements have no marker, so a 64-byte element is an opted-out signature even if its last byte equals a marker value, and a 65-byte element is an opted-out signature unless its last byte is a marker.
+Only 65-byte and 66-byte elements are interpreted against the marker.
+In the 1-byte and 33-byte member forms the last byte is a sighash byte, so an element of those lengths ending in a marker value is a member with an invalid sighash type.
+
+In all forms with an explicit sighash byte the byte must not be 0x00.
+SIGHASH_DEFAULT can only be expressed by omitting the sighash byte.
+This mirrors the rule for 65-byte signatures in BIP 341 and ensures that every signature message has exactly one witness encoding, preventing third parties from malleating the wtxid by switching between equivalent encodings.
+
+=== Signature message ===
+
+The signature message of an aggregated input commits to the input's aggregation mode in addition to the transaction data.
+Let ''SigMsg(hash_type, ext_flag)'' be the common signature message function defined in BIP 341, including all of its failure conditions.
+For an aggregated witness v2 key path spend with sighash type ''hash_type'', the message is computed as:
+
+
+m = hash_TapSighash(0x01 || agg_mode || SigMsg(hash_type, 0))
+
+
+The first byte is the sighash epoch.
+BIP 341 messages use epoch 0x00 and reserve other values for signature algorithms that make invasive changes to how hashing is performed, such as this one.
+The ''agg_mode'' byte is the marker byte of the input's group (0xbc for half-aggregation, 0xbd for full-aggregation).
+Opted-out inputs use the unchanged BIP 341 message ''hash_TapSighash(0x00 || SigMsg(hash_type, 0))''.'''Why do opted-out inputs keep sighash epoch 0x00?''' The epoch identifies the message computation, not the witness version, and other values are reserved for algorithms that change how hashing is performed. Opted-out spends leave the computation unchanged, so a different epoch would force wallets that do not aggregate to implement a second signing code path without a security benefit. Replaying the resulting signatures across witness versions is not possible because SigMsg commits to the scriptPubKey of the output being spent. Keeping epoch 0x00 also means that a hypothetical witness v2 output type following the BIP 341 rules unchanged would produce the exact same key path spends as the opt-out mode of this BIP.
+
+Committing to the aggregation mode makes aggregation consensual.
+A signature created for an opted-out input is not valid as a member of an aggregation group and vice versa.
+Without this commitment any third party could fold an opted-out signature into the half-aggregation group unchanged, because half-aggregation of existing signatures is a public operation.
+See [[#why-no-opt-out-marker|Why no opt-out marker]] for details.
+
+Valid sighash types are:
+
+* 0x00: SIGHASH_DEFAULT (only expressible by omitting the sighash byte)
+* 0x01: SIGHASH_ALL
+* 0x02: SIGHASH_NONE
+* 0x03: SIGHASH_SINGLE
+* 0x81: SIGHASH_ALL | SIGHASH_ANYONECANPAY
+* 0x82: SIGHASH_NONE | SIGHASH_ANYONECANPAY
+* 0x83: SIGHASH_SINGLE | SIGHASH_ANYONECANPAY
+
+Note: SIGHASH_ANYONECANPAY composes with aggregation only partially, see [[#usage-of-anyonecanpay|Usage of ANYONECANPAY]].
+
+=== Opted-out key path spends ===
+
+An opted-out witness v2 key path spend has a witness stack containing:
+
+* '''Without annex''': [signature] (64 bytes) or [signature || sighash] (65 bytes)
+* '''With annex''': [signature] [0x50...] or [signature || sighash] [0x50...]
+
+Validation proceeds exactly as for a BIP 341 key path spend, using the BIP 341 signature message and BIP 340 signature verification against the output key.
+
+=== Aggregated key path spends ===
+
+The aggregate signature data of a group is split across the witness elements of its inputs.
+
+'''Half-aggregation members:'''
+
+* '''Without annex''': [nonce share] (32 bytes) or [nonce share || sighash] (33 bytes)
+* '''With annex''': [nonce share] [0x50...] or [nonce share || sighash] [0x50...]
+
+The nonce share of an input is the first 32 bytes of its individual BIP 340 signature, see [[#signing|Signing]].
+
+'''Half-aggregation final input:'''
+
+* '''Without annex''': [nonce share || s || 0xbc] (65 bytes) or [nonce share || s || sighash || 0xbc] (66 bytes)
+* '''With annex''': [nonce share || s || 0xbc] [0x50...] or [nonce share || s || sighash || 0xbc] [0x50...]
+
+The nonce shares of all group inputs in input order, followed by the ''s'' value from the final input, form the ''(n+1)*32''-byte aggregate signature of [[bip-0458.mediawiki|BIP 458]].
+
+'''Full-aggregation members:'''
+
+* '''Without annex''': [] (empty element) or [sighash] (1 byte)
+* '''With annex''': [] [0x50...] or [sighash] [0x50...]
+
+The empty element is a single witness stack item of length zero.
+A witness stack without any items remains invalid, see BIP 341.
+
+'''Full-aggregation final input:'''
+
+* '''Without annex''': [signature || 0xbd] (65 bytes) or [signature || sighash || 0xbd] (66 bytes)
+* '''With annex''': [signature || 0xbd] [0x50...] or [signature || sighash || 0xbd] [0x50...]
+
+The signature is the 64-byte aggregate signature of [[bip-0459.mediawiki|BIP 459]].
+
+An aggregation group may consist of a single input.
+In that case the group's only input is its final input.
+
+=== Validation rules ===
+
+Witness v2 key path spends are validated in three passes:
+
+'''Pass 1: Parse and collect aggregation information'''
+
+For each witness v2 key path spend:
+
+1. '''Extract annex if present''':
+* If the witness stack has at least two elements, and the first byte of the last element is 0x50, this last element is the annex and is removed from the witness stack
+
+2. '''Parse the witness element''':
+* If the element is 64 bytes long, or 65 bytes long and its last byte is not 0xbc or 0xbd, it is an opted-out signature and is parsed per BIP 341
+* Otherwise the length determines the structure per the table above, where 65-byte and 66-byte elements must end in a marker byte. Fail if the combination matches no defined structure
+* Extract ''hash_type'' and signature data if present
+* Verify ''hash_type'' is valid (0x01-0x03, 0x81-0x83 in explicit form). Fail on an explicit 0x00
+
+3. '''Classify input''':
+* '''64-byte or 65-byte signature''': Opted-out input
+* '''Empty, 1-byte, 32-byte, or 33-byte element''': Aggregation member
+* '''65-byte or 66-byte element ending in 0xbc or 0xbd''': Final input of that marker's group
+
+The structure table is exhaustive, so every witness element that parses successfully falls into exactly one class.
+
+'''Pass 2: Validate aggregation group structure'''
+
+Group formation rules:
+* The half-aggregation group consists of the 32-byte and 33-byte members and the 0xbc final input
+* The full-aggregation group consists of the empty and 1-byte members and the 0xbd final input
+* Fail if a group has members but no final input, or more than one final input
+* Fail if a member of a group appears after that group's final input
+* Opted-out inputs do not form groups
+
+'''Pass 3: Verify signatures'''
+
+1. '''For each opted-out input''':
+* Compute the message ''m = hash_TapSighash(0x00 || SigMsg(hash_type, 0))'' as in BIP 341
+* Verify the 64-byte signature using BIP 340 against the output key (the 32-byte witness program of the spent output)
+
+2. '''For each aggregation group''':
+* Collect the group's inputs, consisting of its members and its final input
+* Order the group's (pubkey, message) pairs by input index, where the pubkey of each pair is the 32-byte witness program of the spent output
+* For each aggregated input ''i'': compute ''mi = hash_TapSighash(0x01 || marker || SigMsg(hash_typei, 0))''
+* For half-agg: assemble the aggregate signature as the concatenation of the group's nonce shares in input order followed by the ''s'' value of the final input
+* For half-agg: verify the assembled aggregate signature with ''VerifyAggregate(aggsig, pm_aggd)'' as defined in [[bip-0458.mediawiki|BIP 458]], where ''pm_aggd'' is the ordered list of pairs
+* For full-agg: verify the final input's 64-byte signature with ''Verify'' as defined in [[bip-0459.mediawiki|BIP 459]] over the ordered pubkey and message lists
+
+=== Signing ===
+
+Signers of aggregated inputs compute the signature message defined above with the marker byte of their group as ''agg_mode''.
+The secret key is the Taproot tweaked private key corresponding to the 32-byte witness program, derived as in BIP 341.
+
+'''Opted-out inputs''':
+The signer creates a BIP 341 key path signature exactly as for a Taproot output.
+
+'''Half-aggregated inputs''':
+Each signer creates an ordinary BIP 340 signature over its message in a single stateless pass.
+The first 32 bytes of the signature are the input's nonce share, which can be placed in the member's witness element as soon as the signature exists.
+The ''s'' parts of the individual signatures do not appear on chain.
+Once all signatures of the group are available, any party can combine them with ''Aggregate'' or ''IncAggregate'' as defined in [[bip-0458.mediawiki|BIP 458]], over the group's pairs ordered by input index, and place the last 32 bytes of the result as the ''s'' value in the final input's witness element.
+The aggregating party should verify the individual signatures first.
+This identifies a disruptive signer and is necessary because ''Aggregate'' does not validate its inputs, see BIP 458.
+
+'''Full-aggregated inputs''':
+The group's signers run the interactive signing protocol of [[bip-0459.mediawiki|BIP 459]].
+The public key list of the session is the ordered list of the group's 32-byte witness programs and the message list contains the corresponding signature messages in the same order.
+Each signer uses its tweaked secret key, see the [[bip-0459.mediawiki#key-tweaking|Key Tweaking]] section of BIP 459.
+The 64-byte signature returned by ''SigAgg'' is placed in the final input's witness element.
+Any change that affects a group member's signature message or the group's ordered member list invalidates the session and requires a new one.
+Secret nonces must never be reused across signing sessions, see BIP 459.
+
+== Examples ==
+
+The final input of each aggregation group carries the marker and the completion of the aggregate signature and therefore more witness weight than the other group members.
+How this weight difference is accounted for between the participants of a collaborative transaction is a protocol level concern outside the scope of this BIP.
+
+'''Example 1: Three inputs, all half-aggregated with SIGHASH_DEFAULT'''
+
+Input 0 witness: [32-byte nonce share] # 32 bytes: half-agg member
+Input 1 witness: [32-byte nonce share] # 32 bytes: half-agg member
+Input 2 witness: [nonce share || s || 0xbc] # 65 bytes: half-agg final
+
+Total overhead: 1 marker byte
+Signature size reduction: 192 bytes → 129 bytes
+
+
+'''Example 2: Three inputs full-aggregated with SIGHASH_ALL'''
+
+Input 0 witness: [0x01] # 1 byte: full-agg member, SIGHASH_ALL
+Input 1 witness: [0x01] # 1 byte: full-agg member, SIGHASH_ALL
+Input 2 witness: [64-byte sig || 0x01 || 0xbd] # 66 bytes: full-agg final, SIGHASH_ALL
+
+Total overhead: 1 marker byte
+Signature size reduction: 192 bytes → 64 bytes
+
+
+'''Example 3: Witness v1 input alongside a witness v2 aggregation group'''
+
+Input 0 witness: [64-byte sig] # witness v1 (Taproot) key path spend
+Input 1 witness: [32-byte nonce share] # 32 bytes: half-agg member
+Input 2 witness: [nonce share || s || 0xbc] # 65 bytes: half-agg final
+
+Input 0 spends a Taproot output and does not participate in aggregation.
+Inputs 1 and 2 form the half-aggregation group.
+
+Total overhead: 1 marker byte
+Signature size reduction (v2 inputs): 128 bytes → 97 bytes
+
+
+'''Example 4: Mixed transaction'''
+
+Input 0 witness: [64-byte sig] # 64 bytes: opted-out, SIGHASH_DEFAULT
+Input 1 witness: [nonce share || 0x03] # 33 bytes: half-agg member, SIGHASH_SINGLE
+Input 2 witness: [] # empty: full-agg member
+Input 3 witness: [] # empty: full-agg member
+Input 4 witness: [nonce share || s || 0xbc] # 65 bytes: half-agg final
+Input 5 witness: [64-byte sig || 0x82] # 65 bytes: opted-out, SIGHASH_NONE|SIGHASH_ANYONECANPAY
+Input 6 witness: [64-byte sig || 0xbd] # 65 bytes: full-agg final
+
+This transaction has:
+- Two opted-out inputs (0, 5) with different sighash types
+- One half-aggregation group (inputs 1, 4)
+- One full-aggregation group (inputs 2, 3, 6)
+
+Total overhead: 2 marker bytes
+Signature size reduction: 448 bytes → 292 bytes
+
+
+== Security ==
+
+'''Non-consensual aggregation''':
+The signature message of aggregated inputs commits to the aggregation mode, so third parties cannot move signatures between opted-out witnesses and aggregation groups, see [[#why-no-opt-out-marker|Why no opt-out marker]].
+Signatures also cannot be replayed between witness versions because the signature message always commits to the scriptPubKey of the output being spent.
+
+'''Adaptor signature incompatibility''':
+Aggregation is incompatible with protocols that extract a secret from a specific signature appearing on chain, most notably some adaptor signature protocols.
+Adaptor protocols in which the final signature is delivered directly between the parties are not affected.
+Protocols that rely on on-chain extraction should use opted-out signatures for those inputs.
+
+'''Shared security of the three modes''':
+Every witness v2 output can be spent through any of the three key path modes, chosen by whoever produces the witness.
+The security of v2 outputs therefore rests on all three verification algorithms together, and a soundness failure in BIP 340, BIP 458, or BIP 459 would affect all v2 outputs regardless of the mode their owners intended to use.
+Both aggregation schemes come with security proofs that reduce to established assumptions in the same discrete logarithm setting as BIP 340, see the security discussions in BIP 458 and BIP 459.
+
+'''Witness malleability''':
+For key path spends every witness element size is fixed by consensus and the annex is committed by the signature message, so third parties cannot change the weight of a fully signed input.
+Given the nonce shares of a group, only one value of ''s'' satisfies the verification equation, and replacing a nonce share requires knowledge of the individual signatures.
+Third parties therefore cannot malleate witness v2 key path witness data.
+Opted-out inputs carry plain BIP 340 signatures, which are non-malleable.
+
+'''Transaction level verification''':
+Aggregated inputs add one transaction level verification step per aggregation group, while parsing, structure checks, opted-out inputs, and script path spends remain per-input operations.
+Implementations that parallelize script validation per input can schedule the group verification as one additional check.
+Existing wtxid based validation caches remain correct since any witness change alters the wtxid.
+Aggregate verification can also join verification batches together with individual BIP 340 signatures, so aggregation does not preclude batch validation.
+
+'''Computation limits''':
+Aggregation does not increase the worst-case signature verification cost of a block.
+Full-aggregation requires about half the elliptic curve multiplications per input of individual BIP 340 verification, while half-aggregation requires about the same number in a single batchable equation.
+The densest packing of signature verification work per weight unit remains tapscript under the BIP 342 validation weight budget, which this BIP does not change.A minimal Taproot key path input weighs 230 weight units, 164 for the input base data plus 66 for the witness element, and BIP 340 verification costs two elliptic curve multiplications per signature.
+Per member of a large group, full-aggregation accounts for 166 weight units and half-aggregation for 198 weight units including the member's 32-byte nonce share, ignoring small per-group constants.
+The BIP 459 verification equation costs ''n+1'' multiplications for a group of ''n'' inputs, while the BIP 458 equation costs about ''2n'' since the randomizers multiply both the nonce point and the challenge term of each member.
+Ignoring transaction overhead, a block filled with minimal full-aggregation members needs about 4,000,000 / 166 ≈ 24,100 multiplications and one filled with minimal half-aggregation members about 2 * 4,000,000 / 198 ≈ 40,400, compared to 2 * 4,000,000 / 230 ≈ 34,800 for minimal Taproot key path spends.
+The half-aggregation count is about 16 percent higher, but its per-input cost matches batch verified BIP 340 signatures and the whole group is verified as one multi-scalar multiplication, which is faster in practice than the same number of independent verifications.
+All of these remain far below the BIP 342 validation weight budget, which admits one tapscript signature verification per 50 weight units, or 80,000 verifications with about 160,000 multiplications per block.
+Aggregation also does not increase the maximum number of inputs per block, since an input spending an output that requires no signature, such as a bare OP_TRUE script, weighs only 164 weight units today.
+
+'''Mode fingerprinting''':
+The aggregation mode of every input is visible on chain from its witness element, so distinctive mode combinations can fingerprint the wallets or protocols that created a transaction.
+Participants of collaborative transactions should prefer one mode for all participating inputs if they want to avoid this.
+
+== Test vectors ==
+
+Wallet operation vectors covering scriptPubKey and address computation, signature message computation, and witness construction for both key path and script path spending can be found in [[bip-0460/wallet-test-vectors.json|wallet-test-vectors.json]].
+
+Transaction level validity cases, including marker parsing failures, group structure failures, annex handling, script path spending, and the aggregation mode commitment, can be found in [[bip-0460/consensus-test-vectors.json|consensus-test-vectors.json]].
+
+Both files are generated by [[bip-0460/test-vectors.py|test-vectors.py]], which builds on the reference code of BIP 458 and BIP 459.
+All vectors use deterministic test-only keys and nonces, and BIP 340 signatures are created with an all-zero auxiliary randomness array, except one vector that deterministically searches auxiliary randomness values to produce a signature ending in a marker byte.
+
+== Reference implementation ==
+
+A work in progress implementation for Bitcoin Core is available at https://github.com/fjahr/bitcoin/tree/bip460.
+It implements the validation rules of this BIP and validates all consensus test vectors.
+
+== Rationale ==
+
+=== Why a new witness version? ===
+
+A new witness version is necessary because BIP 341 completely specifies the validation rules for witness v1, fixing key path witnesses to 64-byte or 65-byte signatures.
+The aggregation witness forms used by this BIP are invalid under those rules, and a soft fork can only turn valid transactions into invalid ones, not the reverse.
+Aggregation therefore cannot be retrofitted onto existing Taproot outputs.
+
+=== Why the marker-based design? ===
+
+The primary alternative to markers is a design without them, where aggregated inputs carry only a 1-byte sighash placeholder and aggregation applies to all witness v2 inputs of a transaction or to none of them.
+Compared to that alternative the markers cost one byte per aggregation group.
+In exchange the marker provides three properties:
+
+'''Per-input consent''':
+An all-or-nothing design couples the choices of unrelated parties.
+In a CoinJoin a single participant that requires a plain on-chain signature, for example for an adaptor signature based protocol, would force every other participant to forgo aggregation.
+With markers this choice is local to the input, which matters most in exactly the multi-party transactions that CISA is designed to make cheaper.
+
+'''Self-describing witnesses''':
+Every input is classified locally by the length and last byte of its witness element instead of inferring a transaction-wide mode from the shape of all witnesses.
+This avoids inference edge cases.
+For example, in the placeholder design the final aggregated input's witness consists of a sighash byte followed by the aggregate signature as a separate element, and an aggregate signature whose first byte happens to be 0x50 is misparsed as an annex under the BIP 341 annex rule.
+Roughly one in 256 honestly generated aggregate signatures would hit this case and force the signers to start over.
+In this design the signature data of every input is part of its single witness element, which the annex rule never inspects, so no signature data can be misparsed as an annex.
+
+'''Two coexisting groups''':
+A transaction can contain one half-aggregation group and one full-aggregation group at the same time.
+This allows a tightly coordinated subset of signers, for example the inputs of a single wallet, to use full-aggregation while the remaining inputs of a collaborative transaction use half-aggregation.
+
+Group members carry no marker, since the member element lengths are disjoint from all other forms and the length alone classifies them.
+Half-aggregation members carry their nonce share directly instead of contributing to a growing aggregate signature on the final input.
+This makes every witness element form fixed-size and distributes the witness weight of the aggregate evenly across the group's inputs.
+Only the final inputs need a marker, because the completion of an aggregate signature is indistinguishable from a BIP 341 signature by content.
+
+A more flexible alternative with multiple aggregation groups per scheme, similar to the bucket concept from early aggregation discussions, was rejected.
+Multiple groups would only benefit full-aggregation, since half-aggregation groups can be merged by anyone after signing.
+They would allow several smaller signing sessions instead of one session spanning all aggregated inputs, for example through a group number encoded in the marker byte.
+However, with SIGHASH_DEFAULT the signers of every group still have to agree on the complete output list of the transaction before signing, making coordination across groups necessary.
+Decoupling the groups through SIGHASH_SINGLE with SIGHASH_ANYONECANPAY is limited to groups of signers with a single input and output each, reveals which input pays which output, and lets anyone split the merged transaction apart again.
+Half-aggregation already provides this flexibility without any joint signing session at a cost of 32 weight units per input, and a separate transaction per group provides it at the cost of repeating the transaction overhead.
+Group numbers would also reveal which inputs belong together, which has negative privacy implications.
+
+=== Why no opt-out marker? ===
+
+The main motivation for the unmarked opt-out is compatibility with BIP 341.
+Opted-out spends are byte-identical to BIP 341 key path spends, so wallets that do not aggregate can adopt the new output type without new signing logic.
+Leaving out the marker also saves one byte per opted-out input.
+
+Opted-out inputs still need protection from non-consensual aggregation.
+Half-aggregation of existing signatures is a public operation.
+Any third party in possession of valid BIP 340 signatures, such as a miner or a relaying node, can aggregate them without the signers' involvement.
+Some protocols depend on a specific signature appearing on chain.
+Most notably, some adaptor signature protocols extract a secret from the difference between an on-chain signature and a previously shared adaptor signature, and this extraction becomes impossible once the signature has been folded into an aggregate.
+
+For this protection the separation of the signature messages is sufficient.
+An opted-out signature is created over the BIP 341 message and is therefore useless as an aggregation group member, and vice versa.
+Aggregation is consensual for every input.
+
+An explicit opt-out marker would serve parsing rather than protection, distinguishing a 65-byte opted-out signature with a sighash byte from an aggregation group final without one.
+Markers in the position of the sighash byte resolve this ambiguity without marking opted-out inputs, since marker values are disjoint from valid sighash values.
+A small caveat is that a future witness version that keeps the witness v2 rules cannot use the marker values as sighash types.
+
+A consequence of the mode commitment is that the aggregation mode is chosen at signing time.
+A signature created for aggregation cannot later be used as a standalone opted-out signature either, so signers that want to keep both options open must produce two signatures.
+Planning for aggregation costs one weight unit if the group ends up with a single member, since the single-member group signature carries the marker.
+
+=== Why two aggregation schemes? ===
+
+Half-aggregation and full-aggregation serve different use cases:
+
+{| class="wikitable"
+|+ Comparison of aggregation schemes
+|-
+! Property !! Half-Aggregation !! Full-Aggregation
+|-
+| '''Signature size''' || ''(n+1)*32'' bytes || 64 bytes (constant)
+|-
+| '''Interactivity''' || Non-interactive || Interactive (2 rounds)
+|-
+| '''Use case''' || All transaction types || Interactive protocols such as CoinJoins, wallet consolidation
+|-
+| '''Incremental''' || Yes || No
+|}
+
+Full-aggregation offers roughly twice the savings of half-aggregation but requires all signers to run a stateful two-round protocol within one signing session.
+Mishandling the secret nonce state between the rounds can lead to key extraction, which makes supporting it on hardware signers and air-gapped devices demanding.
+The slow adoption of MuSig2 by signing devices illustrates this cost.
+
+Half-aggregation signers produce plain BIP 340 signatures in a single stateless pass, and the aggregation happens downstream of all signing.
+This fits existing asynchronous multi-party workflows, for example PSBT based signing ceremonies where cosigners are available at different times, or [[bip-0077.md|BIP 77]] Async Payjoin where sender and receiver are not required to be online at the same time.
+It also avoids giving every participant of a large collaborative transaction a second opportunity to stall the protocol between signing rounds.
+Finally, half-aggregation composes with workflows where the input set is still growing after signing has started, such as ANYONECANPAY based fee bumping, because aggregation can happen once the set is final.
+
+=== Why key path only? ===
+
+Key path spends have one signature per input that is visible from the witness structure alone, which makes their aggregation rules simple.
+The use cases motivating this BIP, collaborative transactions and consolidations, also typically use simple key path spends.
+Aggregating signatures from within scripts, in contrast, conflicts with the tapscript upgrade mechanisms.
+Whether a signature operation contributes to the transaction level aggregate depends on script execution, but a script containing an OP_SUCCESS opcode succeeds without being executed.
+A later soft fork redefining such an opcode would change which signatures the aggregate has to cover, so transactions valid under the new rules would be invalid for older nodes, turning the redefinition into a hard fork.
+This is a variant of the problem described in [https://gnusha.org/pi/bitcoindev/20180321040618.GA4494@erisian.com.au/ the 2018 aggregation discussion by Anthony Towns], whose mitigations rely on execution order, which the parse time OP_SUCCESS semantics of tapscript do not provide.
+Script execution raises further design questions, for example the BIP 342 sigops budget assumes 50 witness weight units per signature check and would be exhausted by short placeholder signatures, and the aggregate signature must be located before execution while group membership only becomes known during it.
+Solving these questions is left for a separate BIP with its own upgrade semantics.
+
+=== Usage of ANYONECANPAY ===
+
+This BIP permits all standard sighash types at the consensus level, including SIGHASH_ANYONECANPAY (0x80 flag).
+Whether to aggregate is an application level decision, not a consensus concern, so the consensus rules stay permissive.
+
+'''Full-aggregation''':
+The signing session of BIP 459 fixes the group's public key and message lists, so the membership of a full-aggregation group cannot grow after signing has started.
+ANYONECANPAY still composes with full-aggregation in one direction.
+Once the group members have signed with ANYONECANPAY, additional opted-out, half-aggregated, or non-v2 inputs can be appended to the transaction without invalidating the group, because the group's messages do not commit to those inputs.
+Only extending the full-aggregation group itself with later inputs is impossible.
+
+'''Half-aggregation''':
+Half-aggregation composes with ANYONECANPAY directly.
+Signers create their signatures over the half-aggregation flavored message at signing time, further inputs are added later, and once the input set is final anyone can aggregate the collected signatures without further involvement of the signers.
+
+=== Future considerations ===
+
+'''Block-wide aggregation''':
+Block-wide aggregation remains a potential future optimization and is not precluded by this design.
+Opted-out inputs do not necessarily signal that the signer needs the signature on chain unaggregated, since there may be other motivations such as simple adoption, so such a design would probably need its own explicit opt-out.
+
+'''Script path aggregation''':
+Script path aggregation can be specified in a separate BIP and added in the same or a future soft fork.
+
+== Deployment ==
+
+This BIP is to be deployed by a soft fork activation mechanism.
+The activation parameters are to be determined and will be specified in a future update of this document.
+Since other proposals also target witness version 2, the witness version is subject to coordination and may change in a future update as well.
+
+== Backward compatibility ==
+
+=== Non-upgraded nodes ===
+
+Nodes that have not upgraded to support witness v2 treat witness v2 outputs as anyone-can-spend, per the [[bip-0141.mediawiki|BIP 141]] unknown witness version rule.
+Depending on their policy settings, such nodes might not relay witness v2 transactions or include them in blocks.
+
+=== Non-upgraded wallets ===
+
+Wallets without witness v2 support cannot create or spend witness v2 outputs but can send to witness v2 addresses if they support Bech32m.
+
+== Acknowledgements ==
+
+Thanks to Vojtěch Strnad for feedback on early versions of this BIP, in particular for prompting a precise description of the script path aggregation obstacles and for streamlining the specification.
+Thanks to conduition for suggesting the distribution of the half-aggregation signature data across the group's witness elements.
+
+== Footnotes ==
+
+
diff --git a/bip-0460/consensus-test-vectors.json b/bip-0460/consensus-test-vectors.json
new file mode 100644
index 0000000000..d36044268d
--- /dev/null
+++ b/bip-0460/consensus-test-vectors.json
@@ -0,0 +1,950 @@
+{
+ "testCases": [
+ {
+ "id": "halfagg-valid",
+ "description": "Two-member half-aggregation group, SIGHASH_ALL",
+ "prevouts": [
+ {
+ "scriptPubKey": "52204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220cc93415eadd2ed34dc668b345ef49dd492eaaf5c0562482d393917966a6dbfd5",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "02000000000102375412079d92555f10368dc54e08189023c8a6bfe0318933dda280bb8c96e76a0000000000ffffffff2dea8db84ee1bcea688026b1bda8fea0667b8f3b24d914e2afe0f5dffae5086d0000000000ffffffff01c07fdc0b000000002252204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b0121571098a90a1077c7552282afd69f9cd0fa43a1de634b15761cbc10118ba51aee010142d3be7917478689bc10fec632019ff3c203d26df874171a8b934aa2e563ee98f1e2e326fc752b9402b509e3067a17b320c9c7687af7515eaa7fd3db60b8cc7f2601bc00000000",
+ "valid": true
+ },
+ {
+ "id": "fullagg-valid",
+ "description": "Two-member full-aggregation group, SIGHASH_ALL",
+ "prevouts": [
+ {
+ "scriptPubKey": "52208640c68f13b51a1e63dfc5cc41202cca21c18f1f9d7037c2cbec3f03f63e52e4",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "522018b6491469cc78b764b01669b0a5a4e892f57e8c1b20b89bc1ca6dce3e881b51",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "0200000000010254d36a0897340110cc34b526d73b206175ae4f5db4d25fe7bdeef3a8a5e89afd0000000000ffffffff835a02826d69e61b563ec713020bd2b7c3bc3848223cda2b3c52bbdcd3e6267a0000000000ffffffff01c07fdc0b000000002252208640c68f13b51a1e63dfc5cc41202cca21c18f1f9d7037c2cbec3f03f63e52e401010101424bce4f189f7e82eca1ebd747e8fb4199741522d94f6bccf62faa6a9bf5bc98092c7970476fa0c6d516c72b77fa772edd04cdbac879a42a6cf45f043720a07b7901bd00000000",
+ "valid": true
+ },
+ {
+ "id": "mixed-valid",
+ "description": "Opted-out input alongside a two-member half-aggregation group",
+ "prevouts": [
+ {
+ "scriptPubKey": "5220735471e81ea57222642f2198afe0c9753bcb9669beae68aa90a49c0dee85f6ce",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220d0d1709a7b6eef6e5309f9115b163b0a72295b837923a5251641352e5d6ae21f",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "52206bcb2a825ab91fa41da5f6cc1b51edf07ce6dc769e497d741c39ee4de7eb0966",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "0200000000010305a375e47ab8044473e9642b89e8d0e23c39e6dff3ebc3decd3a21e36df5c8f10000000000ffffffffa098dbe94bda678231b9b104eadb0afd61f44a955146c5518b039ffbdc54eee60000000000fffffffff861074487871c360c0a79a8a0520e6efea15cb031a2b249d5342c417a18d4710000000000ffffffff01c060d21100000000225220735471e81ea57222642f2198afe0c9753bcb9669beae68aa90a49c0dee85f6ce0140a27155234a9a9c718d3cf638f5caadcbf7d476d7a595aafc40059103773eac36aa44f9b62153b3322329e14d345bb8e5cbc654fcba2a55cda471aaa2f1524fcf0120b7f385ee1e8cee81cc4f5dd06cfa4471807f48aa61d6791c8d0851459a15cea501411587da1c10801778e65bb13619388ec6973f05fbb00c1ab88b1d51e5e60d5dc17b53fabdf09dab1b636008551933346a2a4ada059c8294640dc950bcc6e58213bc00000000",
+ "valid": true
+ },
+ {
+ "id": "marker-undefined",
+ "description": "65-byte witness element ending in the undefined marker value 0xbb",
+ "prevouts": [
+ {
+ "scriptPubKey": "5220735471e81ea57222642f2198afe0c9753bcb9669beae68aa90a49c0dee85f6ce",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220d0d1709a7b6eef6e5309f9115b163b0a72295b837923a5251641352e5d6ae21f",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "52206bcb2a825ab91fa41da5f6cc1b51edf07ce6dc769e497d741c39ee4de7eb0966",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "0200000000010305a375e47ab8044473e9642b89e8d0e23c39e6dff3ebc3decd3a21e36df5c8f10000000000ffffffffa098dbe94bda678231b9b104eadb0afd61f44a955146c5518b039ffbdc54eee60000000000fffffffff861074487871c360c0a79a8a0520e6efea15cb031a2b249d5342c417a18d4710000000000ffffffff01c060d21100000000225220735471e81ea57222642f2198afe0c9753bcb9669beae68aa90a49c0dee85f6ce0141a27155234a9a9c718d3cf638f5caadcbf7d476d7a595aafc40059103773eac36aa44f9b62153b3322329e14d345bb8e5cbc654fcba2a55cda471aaa2f1524fcfbb0120b7f385ee1e8cee81cc4f5dd06cfa4471807f48aa61d6791c8d0851459a15cea501411587da1c10801778e65bb13619388ec6973f05fbb00c1ab88b1d51e5e60d5dc17b53fabdf09dab1b636008551933346a2a4ada059c8294640dc950bcc6e58213bc00000000",
+ "valid": false,
+ "failureReason": "undefined marker byte"
+ },
+ {
+ "id": "member-explicit-default",
+ "description": "Half-aggregation member encodes SIGHASH_DEFAULT explicitly as a 0x00 sighash byte",
+ "prevouts": [
+ {
+ "scriptPubKey": "5220735471e81ea57222642f2198afe0c9753bcb9669beae68aa90a49c0dee85f6ce",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220d0d1709a7b6eef6e5309f9115b163b0a72295b837923a5251641352e5d6ae21f",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "52206bcb2a825ab91fa41da5f6cc1b51edf07ce6dc769e497d741c39ee4de7eb0966",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "0200000000010305a375e47ab8044473e9642b89e8d0e23c39e6dff3ebc3decd3a21e36df5c8f10000000000ffffffffa098dbe94bda678231b9b104eadb0afd61f44a955146c5518b039ffbdc54eee60000000000fffffffff861074487871c360c0a79a8a0520e6efea15cb031a2b249d5342c417a18d4710000000000ffffffff01c060d21100000000225220735471e81ea57222642f2198afe0c9753bcb9669beae68aa90a49c0dee85f6ce0140a27155234a9a9c718d3cf638f5caadcbf7d476d7a595aafc40059103773eac36aa44f9b62153b3322329e14d345bb8e5cbc654fcba2a55cda471aaa2f1524fcf0121b7f385ee1e8cee81cc4f5dd06cfa4471807f48aa61d6791c8d0851459a15cea50001411587da1c10801778e65bb13619388ec6973f05fbb00c1ab88b1d51e5e60d5dc17b53fabdf09dab1b636008551933346a2a4ada059c8294640dc950bcc6e58213bc00000000",
+ "valid": false,
+ "failureReason": "explicit 0x00 sighash byte"
+ },
+ {
+ "id": "group-no-final",
+ "description": "Half-aggregation members without an input carrying the marker and the s value",
+ "prevouts": [
+ {
+ "scriptPubKey": "52204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220cc93415eadd2ed34dc668b345ef49dd492eaaf5c0562482d393917966a6dbfd5",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "02000000000102375412079d92555f10368dc54e08189023c8a6bfe0318933dda280bb8c96e76a0000000000ffffffff2dea8db84ee1bcea688026b1bda8fea0667b8f3b24d914e2afe0f5dffae5086d0000000000ffffffff01c07fdc0b000000002252204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b0120571098a90a1077c7552282afd69f9cd0fa43a1de634b15761cbc10118ba51aee0120d3be7917478689bc10fec632019ff3c203d26df874171a8b934aa2e563ee98f100000000",
+ "valid": false,
+ "failureReason": "aggregation group has no final input"
+ },
+ {
+ "id": "member-after-final",
+ "description": "Half-aggregation member appears after the group's final input",
+ "prevouts": [
+ {
+ "scriptPubKey": "5220f4746153737986ea947e2d197427a62d01f251630de2be1c575124f0d932366b",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "52200a9deddd6e095811ffe5c061dbee3ba0c57d107d73ae1f5bd04ffaf851495e95",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "52202c8ed1bfdfdedf23b4a63a374a5a4b3c7575403f93c7bddb10be5011a2c6a471",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "0200000000010392ccaa54e5e62f3bd670417a6b572c92cccc3da6bc1cc66df5e503d40112a44f0000000000ffffffff5928ed52c21e87265486ae544e6415b381ee2914638c962c864564c5e0302a770000000000fffffffff0687ec7cc1986f69faeccca2bc20fec6290472ea48f384c8b830c656e4a3d6d0000000000ffffffff01c060d21100000000225220f4746153737986ea947e2d197427a62d01f251630de2be1c575124f0d932366b01200904e70d45681dd516e58aaf575e78f86c9cff6694a126b8de04aac5c919d16e01418676a78d02e381009db0547e06c6c7113fefa4dd1f00128ce38a83e9a3af77a8add351a099eb3fffc3aad5ac4d7c19ad545696b6c5c05bf9c308d02f0de96c87bc01208676a78d02e381009db0547e06c6c7113fefa4dd1f00128ce38a83e9a3af77a800000000",
+ "valid": false,
+ "failureReason": "member after group final"
+ },
+ {
+ "id": "element-length-undefined",
+ "description": "2-byte witness element ending in a marker byte, matching no defined structure",
+ "prevouts": [
+ {
+ "scriptPubKey": "52204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220cc93415eadd2ed34dc668b345ef49dd492eaaf5c0562482d393917966a6dbfd5",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "02000000000102375412079d92555f10368dc54e08189023c8a6bfe0318933dda280bb8c96e76a0000000000ffffffff2dea8db84ee1bcea688026b1bda8fea0667b8f3b24d914e2afe0f5dffae5086d0000000000ffffffff01c07fdc0b000000002252204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b010201bc0140804e6b660193e8886f9ff1fcd1818b359142c8bdcb433e8e5a4f4b26255ac53528b54f2fdec22401806cdd9519902f1278606d5db4c79ce4512bd2030a00f2f600000000",
+ "valid": false,
+ "failureReason": "marker and length match no defined structure"
+ },
+ {
+ "id": "cross-mode-fold",
+ "description": "Opted-out signatures folded into a half-aggregation group by a third party",
+ "prevouts": [
+ {
+ "scriptPubKey": "5220ca8344e759bfb6492d1ea6cfaafac886df066bc099ac3455632b2d3680dea261",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220c1253f68ccd5faf5e3dfa399bb499092ecd39384be321aee8ac476b0773569c8",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "02000000000102c0f4bc942ecfa2798ebbcc06bcbda200152e1d99c434d93c3f3b769e292a7fb10000000000ffffffff109ee50850f7dc5b6b5ece311830798e23b94f633f6afb62043d768fac7d24910000000000ffffffff01c07fdc0b00000000225220ca8344e759bfb6492d1ea6cfaafac886df066bc099ac3455632b2d3680dea261012095c0f5df0ba95b4b0d215407e79942b73e65eb6361a9a306035050ddbf5a807c01413626190b6b57950d8b24cd4c087efcf4893dc6a04d2e18d7db1bf0be74dfb92cba46abfc8dc2c8ee14c0b785afbde0301be1de190129f14371e72b737ee94e8fbc00000000",
+ "valid": false,
+ "failureReason": "aggregate signature invalid, messages commit to the aggregation mode"
+ },
+ {
+ "id": "empty-witness",
+ "description": "Witness v2 input with an empty witness",
+ "prevouts": [
+ {
+ "scriptPubKey": "52204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220cc93415eadd2ed34dc668b345ef49dd492eaaf5c0562482d393917966a6dbfd5",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "02000000000102375412079d92555f10368dc54e08189023c8a6bfe0318933dda280bb8c96e76a0000000000ffffffff2dea8db84ee1bcea688026b1bda8fea0667b8f3b24d914e2afe0f5dffae5086d0000000000ffffffff01c07fdc0b000000002252204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b000140804e6b660193e8886f9ff1fcd1818b359142c8bdcb433e8e5a4f4b26255ac53528b54f2fdec22401806cdd9519902f1278606d5db4c79ce4512bd2030a00f2f600000000",
+ "valid": false,
+ "failureReason": "empty witness"
+ },
+ {
+ "id": "optout-explicit-default",
+ "description": "Opted-out input encodes SIGHASH_DEFAULT explicitly as a 0x00 sighash byte",
+ "prevouts": [
+ {
+ "scriptPubKey": "52204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220cc93415eadd2ed34dc668b345ef49dd492eaaf5c0562482d393917966a6dbfd5",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "02000000000102375412079d92555f10368dc54e08189023c8a6bfe0318933dda280bb8c96e76a0000000000ffffffff2dea8db84ee1bcea688026b1bda8fea0667b8f3b24d914e2afe0f5dffae5086d0000000000ffffffff01c07fdc0b000000002252204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b0141a63e68a4f5ea6f759dc5bd22fbd8bb49001b72db053e3ae2fe2e352f905e92c960c47b7753174838713fa2ba7127e21c34493d416636376d94011f1eba75804f000140804e6b660193e8886f9ff1fcd1818b359142c8bdcb433e8e5a4f4b26255ac53528b54f2fdec22401806cdd9519902f1278606d5db4c79ce4512bd2030a00f2f600000000",
+ "valid": false,
+ "failureReason": "explicit 0x00 sighash byte"
+ },
+ {
+ "id": "optout-sig-ends-in-marker",
+ "description": "Opted-out 64-byte signature whose last byte equals the half-aggregation marker 0xbc",
+ "prevouts": [
+ {
+ "scriptPubKey": "52204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220cc93415eadd2ed34dc668b345ef49dd492eaaf5c0562482d393917966a6dbfd5",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "02000000000102375412079d92555f10368dc54e08189023c8a6bfe0318933dda280bb8c96e76a0000000000ffffffff2dea8db84ee1bcea688026b1bda8fea0667b8f3b24d914e2afe0f5dffae5086d0000000000ffffffff01c07fdc0b000000002252204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b014028efc4abb49aa3f2e279dacf06add426b4c07794d98b872e864a2c5523aa0fa6ba1f7b9c77190d6206b6027f6dfb16bb0615ada00cbf51f9b2d0441f47d715bc0140804e6b660193e8886f9ff1fcd1818b359142c8bdcb433e8e5a4f4b26255ac53528b54f2fdec22401806cdd9519902f1278606d5db4c79ce4512bd2030a00f2f600000000",
+ "valid": true
+ },
+ {
+ "id": "annex-committed-valid",
+ "description": "Half-aggregation group whose first member carries an annex that is committed in its signature message",
+ "prevouts": [
+ {
+ "scriptPubKey": "5220e3af94f2fb5e23a1967c1f4fad8914fec3505f1c7e735b795a62d0209e9a176c",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220af9693bcd26365ebb9fea91dfbfacf2b96a2e3c06dc2a16f706a15d8ee3a4cc5",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "020000000001022b72230eed37d5af4f7400a9eb61103cbbf1f9a4dd3b85e7231186ef9fa51fa80000000000ffffffffccadb04d02ec2ae661263fe6801aacf882ed7a01c6ac6aa2cce40f2b9ca16f780000000000ffffffff01c07fdc0b00000000225220e3af94f2fb5e23a1967c1f4fad8914fec3505f1c7e735b795a62d0209e9a176c02201d353f924fcde6d6f4a390c831b77ba5b8c54359a1d26c902e7f6d9ec670d6c310504349534120616e6e6578207465737401411cbc8db7b701dd35e61873370a2b0d32d42ffe3a223b448a0d39253dc93576757a70d81e6373ce859478226e7cd932892f23ef6cfbf2a9f8a597ef0b450a010fbc00000000",
+ "valid": true
+ },
+ {
+ "id": "annex-stripped",
+ "description": "Annex removed by a third party from the transaction of annex-committed-valid",
+ "prevouts": [
+ {
+ "scriptPubKey": "5220e3af94f2fb5e23a1967c1f4fad8914fec3505f1c7e735b795a62d0209e9a176c",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220af9693bcd26365ebb9fea91dfbfacf2b96a2e3c06dc2a16f706a15d8ee3a4cc5",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "020000000001022b72230eed37d5af4f7400a9eb61103cbbf1f9a4dd3b85e7231186ef9fa51fa80000000000ffffffffccadb04d02ec2ae661263fe6801aacf882ed7a01c6ac6aa2cce40f2b9ca16f780000000000ffffffff01c07fdc0b00000000225220e3af94f2fb5e23a1967c1f4fad8914fec3505f1c7e735b795a62d0209e9a176c01201d353f924fcde6d6f4a390c831b77ba5b8c54359a1d26c902e7f6d9ec670d6c301411cbc8db7b701dd35e61873370a2b0d32d42ffe3a223b448a0d39253dc93576757a70d81e6373ce859478226e7cd932892f23ef6cfbf2a9f8a597ef0b450a010fbc00000000",
+ "valid": false,
+ "failureReason": "signature message committed to the annex"
+ },
+ {
+ "id": "scriptpath-valid",
+ "description": "Witness v2 script path spend of a single CHECKSIG leaf under BIP 341/342 rules, alongside an opted-out key path input",
+ "prevouts": [
+ {
+ "scriptPubKey": "5220e8605ff15e754192a9d6c053969ae935932c82ceaeea0fed9a152f0c6b4b424b",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "522044fdf832ec12334a9c3316767eae801d4cc9fa26723267e58107cc4574e3b64d",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "020000000001027ce7215887dea171a102c5f9c3b5a9835ee098a1fe51a8e6f6bddedd0b173f400000000000ffffffff992524364c91d1d04d24dbf8ea0444e5d2ac69944c0f84ac48d0756abf1bfa1a0000000000ffffffff01c07fdc0b0000000022522084dba7b2063ea2384cada9c8a3b014659c51c9f79ab4e5a40fee826fd9a167790340d49a402de13f7d71177322ff53b56d0e6210e9aa9d902b4a91db9ab1892bc7ef7363cd73d75c09034dec2aa7e2044bc877b16e81e1ff3aa40282420559340aaf222038c01dda6433ce79606dda3f70ee5dd525104bbbba5b0fd96f56d6d634e92f71ac21c139920c3a54000624c1923187eebbbd3fcdc409302757139c1a1b003bc9276da40140e3c17568cbb14e170c60de5a2fbe0312d89a952ee8e42c8c51da647eafdddddd95bd482b3313c1dcca48463a40df23559361b0ae33d15ecdd8dd3065e8a51a3200000000",
+ "valid": true
+ },
+ {
+ "id": "cross-mode-fullagg",
+ "description": "Full-aggregation signature created over plain BIP 341 messages, placed in a full-aggregation group",
+ "prevouts": [
+ {
+ "scriptPubKey": "5220d8ce2162ebd4a65d21981113193e470a7605970928b5fcfe9636d0a2d4cecc4f",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220cd51647dde7739fd367ab5666c6b6b32ce728a456ca59621df488418abba93c6",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "0200000000010277580c79efee3a3be2056167eb3c5785e480b1bb86255389d32709d071d75fe80000000000ffffffff934ab77ec846c517e4f710c23f2b1cb8c6df84754287bea2c52cb2876260b33f0000000000ffffffff01c07fdc0b00000000225220d8ce2162ebd4a65d21981113193e470a7605970928b5fcfe9636d0a2d4cecc4f010001410d2d7ec50a77afb574d7f11177a47d60e8f53dbbb5a1eb598d0dc49d0609efba692a8e413a324979073f579a8fe858017664b824929505b21bdac238e3b5eef4bd00000000",
+ "valid": false,
+ "failureReason": "aggregate signature invalid, messages commit to the aggregation mode"
+ },
+ {
+ "id": "fullagg-size-mismatch",
+ "description": "Full-aggregation final input carries 96 bytes before the marker (97-byte 0xbd element, matches no defined witness structure)",
+ "prevouts": [
+ {
+ "scriptPubKey": "52208640c68f13b51a1e63dfc5cc41202cca21c18f1f9d7037c2cbec3f03f63e52e4",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "522018b6491469cc78b764b01669b0a5a4e892f57e8c1b20b89bc1ca6dce3e881b51",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "0200000000010254d36a0897340110cc34b526d73b206175ae4f5db4d25fe7bdeef3a8a5e89afd0000000000ffffffff835a02826d69e61b563ec713020bd2b7c3bc3848223cda2b3c52bbdcd3e6267a0000000000ffffffff01c07fdc0b000000002252208640c68f13b51a1e63dfc5cc41202cca21c18f1f9d7037c2cbec3f03f63e52e401010101614bce4f189f7e82eca1ebd747e8fb4199741522d94f6bccf62faa6a9bf5bc98092c7970476fa0c6d516c72b77fa772edd04cdbac879a42a6cf45f043720a07b790000000000000000000000000000000000000000000000000000000000000000bd00000000",
+ "valid": false,
+ "failureReason": "marker and length match no defined structure"
+ },
+ {
+ "id": "two-groups-valid",
+ "description": "Mixed transaction mirroring Example 4 of the BIP: two opted-out inputs, a half-aggregation group with a SIGHASH_SINGLE member, and a full-aggregation group, with interleaved input indices",
+ "prevouts": [
+ {
+ "scriptPubKey": "5220b3fd2ebe2399bee6b51828e7fcb82ae1752516c6866c058516a8d592f38b19e8",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "52209123086f2d8d878088ec611185f841658513af7f29a1359685eda09536d7dc5d",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "52201ce55104c3bd91d20b8d7702d4157bb5a70bc0b6e63cd73c3e7684b9c3156d70",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "522049875458881f78c4ed3d5fb0e95ee527a2dce487ebad7cc92bdf28a9017df888",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220fbfa11a63ffeff576f5d408c5618ed8761aeb5b6dc92ab36055b792c3cd8ceea",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "52207ae16cb88e80051ca988443009fde24fe4d6638f5870fa5cdc6689755bfa24a3",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220ad8f2c1d50a83478441fb5b5887dc53dcf5f342d63a4a1b0e848aef31f2d25b1",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "020000000001074dd302fda269f70608bc946098680dbfee25271c19d636ccc42076049f66d3850000000000ffffffff2b5f4f73da1e6ae2f7dbeddf95ceee3219ce7f4a14780bb957453015ad21c9840000000000ffffffffa43d649606b2b1ba5690d9e796f73f4ac8a4621594a29feb75f7313be68c2a2c0000000000ffffffff89bcd4114dfed0f70ab200fbcbad208d2a17cb23f4d582d34c280cb23ef00db20000000000ffffffff92fc75b30a6e897056ed31a32ea0785e9130fd04a2cdf38f8e8a80c9015c65d90000000000ffffffffba7b09c4178344c89056482bbb515c7dd45bccd7de7d6c9b766ee151490b63ff0000000000ffffffff10d992fa14c1f6bb3d82f31b9e8315cb0dd1caf5f631d9ce1c84f6d8762ebbb40000000000ffffffff028093dc1400000000225220b3fd2ebe2399bee6b51828e7fcb82ae1752516c6866c058516a8d592f38b19e84051cd14000000002252209123086f2d8d878088ec611185f841658513af7f29a1359685eda09536d7dc5d0140f06432774c5ec95fd300d85765721bcbbedc4b65c4aa2984eaa99db92d7547c7a20346fde48e7c769e0d18ff908cdb20e67637671e5b5130cf86e7612348e0c80121495cbe82aa8b5c134aaa6e482294108232706b1b9bc17ec6dd2a142921a27c3203010001000141ca82d465c5b280bc90d0724e3193d84a36df9761df5927ef7317b1109b692e1a974d0e1d0b807b6b52973ef5b9d0635a7bc8acdfef502068d0d9d4f78e774681bc0141b7f82c5f2d47916937286df6ca545e18a1250d6abec3a8b3636c2c8a7c53a565d8cee64cf0675d85f59020b6da547f694f6b981b1d51f6a1248716777f8b51be8201416efcc2fd173c5952fa7da7170f0eaaea7afff3454754f84f326e54ff905828e5a4b83305b72cdde0995d6cd4df4a2b5cf3508242cf821de0caf462ed1a1a3b3abd00000000",
+ "valid": true
+ },
+ {
+ "id": "sighash-single-no-output",
+ "description": "Opted-out input uses SIGHASH_SINGLE at input index 1 of a single-output transaction",
+ "prevouts": [
+ {
+ "scriptPubKey": "5220f082518f206f3be02e70d0b1eabd7152c6e4e3cd8c7df5517f198a049e1b5520",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "52207cef82518a7ac1c239b1e33a92197ea618f06ba71be021f59a73bb1f39d2acf2",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "0200000000010242df0f438abfad5a59cfa19d12c0a7954b04301830c63049f741c0ed73e591f00000000000ffffffffb354dc5ffad02a76b72e6d702aecd38161d43bc42c1de51dc4a62c5bcb4fe6ae0000000000ffffffff01c07fdc0b00000000225220f082518f206f3be02e70d0b1eabd7152c6e4e3cd8c7df5517f198a049e1b552001406308a21865e2cade24f94bc880f77a123cb791f88eedf9a49b63c01abf9e40347b8cbfd2fd230fbcea9be51ea1f8f0dd604e1ea847ed92c98fb3c13304c72efd0141fccbf16c8d49d14eb7b40bc9bf57a7ca416379a7f55d2693f4cac6895eaa9aba133876a6d20a5bd5ee2d37da3f3dd79119e00a0f0eea6509723f6ec08107acad0300000000",
+ "valid": false,
+ "failureReason": "SIGHASH_SINGLE input without corresponding output"
+ },
+ {
+ "id": "halfagg-two-finals",
+ "description": "Two inputs each carrying a 65-byte half-aggregation final element",
+ "prevouts": [
+ {
+ "scriptPubKey": "5220ba77666df5eb8e5c526acedd38d36fc5eaa66da3e26460b71fb7b164089aeb1d",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220379fd1c1e12519df482f6c99b464892f04f59418b20b5f65105a93e240e99013",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "020000000001025cb6b3fb7d3453d43f571a65d462f30f76bcf4a9cfe6bbd13b59ce601b8475cb0000000000ffffffff57b6ff1c4d459776ed587d8242d7d41c913c64b264eb1f72145489b677fadf4f0000000000ffffffff01c07fdc0b00000000225220ba77666df5eb8e5c526acedd38d36fc5eaa66da3e26460b71fb7b164089aeb1d01417607930ce963eb16ef197fafd0d91dc4ddae836d56745e49713f4d10d0a801e730acc481cbcc2797ddeebb575808191501821c634b2e9f628427d30e0a2876f5bc01415866fbabc10dd40c01e0945b2e414ba9bc509f36275ef21738483dda50a3f6019c35b81f37fbc4c98be423dc9f782ae71f835f5870495ae31519a8147c4b1b46bc00000000",
+ "valid": false,
+ "failureReason": "more than one final input in a group"
+ },
+ {
+ "id": "fullagg-two-finals",
+ "description": "Two inputs each carrying a 65-byte full-aggregation final element",
+ "prevouts": [
+ {
+ "scriptPubKey": "5220a0bb2d2ca5161c1c7bf13ba18767027e3c68e24a23e8fffce66f590c7990f2c1",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "522080fa96d74b89de3ae09becd3ab08a1f337471ec9a0104ef6571bdc24737826ba",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "02000000000102faf294804fe43f7dfec177b001477ea5227e47cfa71dc1e4aa60a84d94af0d0e0000000000ffffffff0056c298771ca89f13e7ce4d0b03a282f4803a332d6cf73050ed20cc4bf113b30000000000ffffffff01c07fdc0b00000000225220a0bb2d2ca5161c1c7bf13ba18767027e3c68e24a23e8fffce66f590c7990f2c101411b64cfc02599a4e76f31a16d29267089a4c050ae79565a65c0ff9ebe957c94ffdc46bfbdd07ff72ee3acfe94d943cdd9a0e8d83b757fd4a11abe17556a88fe39bd0141d2b090eab44e95dd388fe5fc98bb974fd83648cbd915c99736fe86c5a3a08efecaf04851dd56e1d664e4db4dbf8e11044946f1c2add16dc6d0b0ed45aaaf3c5bbd00000000",
+ "valid": false,
+ "failureReason": "more than one final input in a group"
+ },
+ {
+ "id": "fullagg-no-final",
+ "description": "Full-aggregation members without an input carrying the marker and the aggregate signature",
+ "prevouts": [
+ {
+ "scriptPubKey": "522014ef07b53514ff8cd94d4e6f4ae0fe246bed37e20c365679f404be89a84a941f",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220ce9d369fb59e92098b3e0389cb8d91a3e0807fe51b04dfb7f77a50312498bb02",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "02000000000102027c0bbee08a5b2b927eac3b88b8305a951fa546550f67a6c52b5542bab2f8ce0000000000ffffffffda74bc8dc984d4dcf61700d4e246a2b781c65d3583e4a99760ef88747fad4bf20000000000ffffffff01c07fdc0b0000000022522014ef07b53514ff8cd94d4e6f4ae0fe246bed37e20c365679f404be89a84a941f0100010000000000",
+ "valid": false,
+ "failureReason": "aggregation group has no final input"
+ },
+ {
+ "id": "fullagg-member-after-final",
+ "description": "Full-aggregation member appears after the group's final input",
+ "prevouts": [
+ {
+ "scriptPubKey": "5220f94afc4ad57d30e591c8c2e36c9f4436a4583a110048f909759dcc4afd1eca0a",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220029fb6b380929cdc76037e241819adbc7a27a14335a855d087bbe2e957a62110",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220130647b26b8fa4baf6e7974cc280be301ae0a186b5b43b36f8fb12b680281eec",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "0200000000010325af39ed72d725fdc2edcbfbeca5f24ace00352010e3e10de0d0792b6ed6d9500000000000ffffffff6e55f5fe52f5b4d3f707a20ac5cf6280acfca6b29bfd17c2249eac2b5799d2e70000000000ffffffff5875cf9e3bd9c121e935691bdc84c18daf7f3a9f697a525e59330829282857f90000000000ffffffff01c060d21100000000225220f94afc4ad57d30e591c8c2e36c9f4436a4583a110048f909759dcc4afd1eca0a01000141dbdac6879a53e194ed0fcc44df68a971f426186d06473488874b6b1761f0f19de74588d7784166ff63aa59f3717505d4da01066f2d1e22c81665fd374ce71bfbbd010000000000",
+ "valid": false,
+ "failureReason": "member after group final"
+ },
+ {
+ "id": "halfagg-single-member",
+ "description": "Half-aggregation group with a single member carrying a 64-byte aggregate in a 65-byte element",
+ "prevouts": [
+ {
+ "scriptPubKey": "5220efce560c8eaf170db44a9af7691f8807be52d8314c4575aa46ba4fce54c2b0c6",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "0200000000010187fea558630296d581abd8d24b147faeaa371a0d325edcf565b6719d8fd5ea310000000000ffffffff01c09ee60500000000225220efce560c8eaf170db44a9af7691f8807be52d8314c4575aa46ba4fce54c2b0c60141bf6915975cc9bf5ab48830c0f34026519f668d453624848298d9e17fbf1362792f96def59bbab5ae47ab790704392b1e456703ad14bf72c375e874fff750dd1abc00000000",
+ "valid": true
+ },
+ {
+ "id": "fullagg-single-member",
+ "description": "Full-aggregation group with a single member",
+ "prevouts": [
+ {
+ "scriptPubKey": "522009d2ff94dc12d14b0b63c95dcdc8cd2a77a3eecca3bbf2809d322dc8b6b5d62b",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "02000000000101787d107a893487240e835409c4cd5c68420bd6301ee936c2b201e90ad5bc8de60000000000ffffffff01c09ee6050000000022522009d2ff94dc12d14b0b63c95dcdc8cd2a77a3eecca3bbf2809d322dc8b6b5d62b0141918fef8d8d2d4312ea43c7aa3fa34f0827387318fe81fb1ad63b18d1f1e14c84e9bba54f4f81cb9d7bee3fcd0823a80af0c6608f54b83e935df1a632e2e03675bd00000000",
+ "valid": true
+ },
+ {
+ "id": "annex-lookalike",
+ "description": "Single witness element starting with the annex prefix 0x50",
+ "prevouts": [
+ {
+ "scriptPubKey": "5220c0354bcb3c4b096849967c23f7f424baa649b15777a1ed25d52770064a84be10",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "522000277756e6ec3da81b4854d52ecac45717fc3c5cc3b27ddcf6e3755b41fd87c9",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "02000000000102948f52623998b05a3ba6679673c6894c7b9a596869421be46b54c7db521a7a8d0000000000ffffffff31509114c2c60b92f3e6037bf52ad75bac26572a19178051fd1ee1e7ae08ead30000000000ffffffff01c07fdc0b00000000225220c0354bcb3c4b096849967c23f7f424baa649b15777a1ed25d52770064a84be100110504349534120616e6e65782074657374014019550ec646820ed9cda8f5c16bd3cae2f03338bf1115a540e2397a93436d88adf5fdd08e4deee93389d6bf9ee32425a4c0b17af78b83df55a62f42ff7cb3eb0a00000000",
+ "valid": false,
+ "failureReason": "matches no defined structure, a single element is never an annex"
+ },
+ {
+ "id": "annex-on-final",
+ "description": "Half-aggregation group whose final input carries an annex that is committed in its signature message",
+ "prevouts": [
+ {
+ "scriptPubKey": "52207dfc09f1e03f0d901bc2410833199965cb2a884891ad9889ff5352b29abb2922",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220f9744be4cd3ce7a2fd0b6a453f94e758db9b4abc47825460cfe48d41100f10e4",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "02000000000102395d48eb0b3ef75dd62014fffcff868fdea29bb830b9fe14e11ae84b22e0bc6d0000000000ffffffffeb44386a3268ac6fb39f78bc9d7023176bd027ff6d7cff7007facf4b98455b840000000000ffffffff01c07fdc0b000000002252207dfc09f1e03f0d901bc2410833199965cb2a884891ad9889ff5352b29abb29220120a6be4df7499feb83100032270c47f4e5e6170c46de0613bd7b75b94774505a960241076f82a2e92e4b6d2810850b5d8e645ea91fea52e6464873d22ad66e80cc9dfc2f916cba05be88bafa374a9a1db5451eeb0780365a6505986ab81af0bf038254bc10504349534120616e6e6578207465737400000000",
+ "valid": true
+ },
+ {
+ "id": "sighash-value-undefined",
+ "description": "Opted-out input with the undefined sighash value 0x04",
+ "prevouts": [
+ {
+ "scriptPubKey": "52207eab9a8cd328cf1ed6329998569ec6b195c368c02cf5c6108476fe95426d883e",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "522002d94ebbd12c91590497f89072b4c5b52a77f09f4f1e6f7da33ccccda240f6f7",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "020000000001029e94c92941217af1eae64bcfa170116a85cf01c1b0a68d61f4f12bdd09bfdbdc0000000000ffffffff0109ff9ad5f993dec28e407eced18a14380ef4f1d2fb5951f46e8a3506b605b50000000000ffffffff01c07fdc0b000000002252207eab9a8cd328cf1ed6329998569ec6b195c368c02cf5c6108476fe95426d883e01410bd36b3d03885f8c44c6839cf78002aab0312f44f8fcddb29b174a547f99e003a4a86d60331e155fbce9165ae116b16329ee8fbb4d467a839cc2df91ac71bc2a04014042034bf35d7f3faa9e96da927521ddc3cfa98bb4e7f645cad49a79a9eb2fe07546c0531e1f311957917899e8f1b1bcfdead805e101390c5b8ea83ff71c35c3a200000000",
+ "valid": false,
+ "failureReason": "undefined sighash type"
+ },
+ {
+ "id": "member-sighash-is-marker",
+ "description": "33-byte element ending in the marker 0xbc, a half-aggregation member with an invalid sighash byte",
+ "prevouts": [
+ {
+ "scriptPubKey": "5220525bedf0f14fdace49ed96c64c32603f79890443a3e97de56195e56c69b12820",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "522052448ca22a975f6526b124857f9cc09aab766848bc29fc8dae549688f2bd6bfb",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "020000000001021ae3614f251ce37d8a9514730e17068c60b46853d1bf515b825d1a51643067eb0000000000ffffffff49a39eef33a2b03cd9ac2ed493f1c19a67d269b499b728cd4d942bf119baf8840000000000ffffffff01c07fdc0b00000000225220525bedf0f14fdace49ed96c64c32603f79890443a3e97de56195e56c69b1282001400df5c1afc66e082e7812a648e8c7ae6274523d5742d3d93d15291e4ea75f1268dd98d2a1c579db4e9526b7bab0ef53868f532c722adf5deb569fe0f37ebde0c601212040ba76514a01b76d05a375a63122423b390bd68d9c11c9514353adb713991fbc00000000",
+ "valid": false,
+ "failureReason": "undefined sighash type"
+ },
+ {
+ "id": "program-not-32-bytes",
+ "description": "Witness v2 output with a 33-byte witness program spent with an arbitrary witness",
+ "prevouts": [
+ {
+ "scriptPubKey": "522185ea1c8b957e39246317d01dd5fba0526394b55775db91f32ffd6f983a64c0ec6d",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220e3c7e3c4b02437debd6e5ab4cf859378de04da3089be27fac7d7ee4143372075",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "020000000001028a2396376d580b848cc4b43d0b0bb2e3481c75ba80be547df52b6069714540960000000000ffffffff2d63ef4986cd3f7b7e7a30bfce4028fd7ee5ca2032f4c2150af17cca84e55edc0000000000ffffffff01c07fdc0b000000002252209e1284ba591f050e4b1475d050d0d54048a15caf983a56b488d25d59f7854cba0101be0140b5908ddb2af07120008e4ed258b694708e8716e8fb09f67ecbf515ed38d74a2a955b82f310611829d7fed544ff91caeedccd90830070d10d4e50b71d35ff514200000000",
+ "valid": true
+ },
+ {
+ "id": "program-offcurve-optout",
+ "description": "Opted-out input whose witness program is not a valid x-only public key",
+ "prevouts": [
+ {
+ "scriptPubKey": "522064c3ae43dac00d99f5ebf5ec074d41a5e4e4ddb7c715564755696b7499d5665c",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "52204a9fe450c24c111425a9dd4632f4fc94ed2714681717e369c059789e3751889e",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "020000000001024dbb065d92ed45586f93ce8fea4d58381e09c3cb1bc7ebabb40e6d7e3fd87c3a0000000000ffffffffd9aef3faf3ec7368e3932fc48ee1f50a233573ecb42a05c886598994956e8abb0000000000ffffffff01c07fdc0b000000002252202991591a0ebcde9e2fd143ea0bda8265a67659aeeb5396935b4025e1c633d03001404ec4690ce502a5f0ab5fab245db9be42ccc650780be0f3ecaa4082a3a68a69428c363b40db3cf86e4251d733a577f3c994982e2965eac7a892e392126a29fcfa0140dca8295008d071fb0474bc62e696c9ec02aeb069e7ac044d901e1035219ba32ef6c045961be0ae75a69ec5c4ce1405624bd07e4f396ebbc0aa05d6dfb1df907600000000",
+ "valid": false,
+ "failureReason": "witness program is not a valid x-only public key"
+ },
+ {
+ "id": "program-offcurve-in-group",
+ "description": "Half-aggregation group member whose witness program is not a valid x-only public key",
+ "prevouts": [
+ {
+ "scriptPubKey": "52202b57dcc98a4977eb9e5d9c7d2b8b6ea7eccad98ee1a40f77dc43f80c94be5829",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "52203ecbcb60ef10bbe471afc9317fda3ac61a26422688d9f9183484ea08b439ae94",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "0200000000010273d7bf0559f1173564708c1e2d0ebe6175b72f5adee692dc6bf9ce52b75f038b0000000000ffffffff6e048d65284060c05b39ed176a8998ea32e8dd730eb3933a60e755796031f4a50000000000ffffffff01c07fdc0b00000000225220aa5413f1dcbd6a3f50db0278bcba58570af3e0d845807b5bcdabd92245739d1f01207ad0b4a52df2eb8e61ebbcf7f318dee3a1b54679c8e4314827a60d368633adbc0141f6a577712f6ee97781d101525cf34d0eb31471f35c85a2624ab257461e1ffedebd29211b614cf25019cd4345df309889ef09078f21c470907cea39c813e0b727bc00000000",
+ "valid": false,
+ "failureReason": "witness program is not a valid x-only public key"
+ },
+ {
+ "id": "scriptpath-unknown-leaf-version",
+ "description": "Witness v2 script path spend with unknown leaf version 0xc2, which succeeds unconditionally per BIP 341",
+ "prevouts": [
+ {
+ "scriptPubKey": "52203393a7b8c41d3c155cb9e1f9a49a76d1eef2c2de0b5fb76a693a7340001527d7",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "52204b87263c4be4747effe770027e7677d8ec6bb46522c50a101d6d43c468265194",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "02000000000102f9fba162f92dfd4eb91c55cdd8822a997bc4f4cce7e1dc7dd39debb837aa287a0000000000fffffffff82399ba5d5eaf6a581d7ac39883afc9e8f090134fea8afa3eb1c18b9b82c3c90000000000ffffffff01c07fdc0b00000000225220e524abd4c236566678fbb385b729120ef0e57b3ff78c055f807dc4a0ca615f6c02015121c3ab9432f842079557d76f597fdd75613784568e6d33b6a2ccb0cf7c442acf3e3e0140c37a2727f38a84eae22c1787d14dd7bb06b46f669014a13625247f5296d746431a21cfa521495a6c8e21de0354bec58ae96ab3bda0e70cce4b91fc4e6fe775a400000000",
+ "valid": true
+ },
+ {
+ "id": "scriptpath-op-success",
+ "description": "Witness v2 script path spend whose leaf script is OP_SUCCESS188 (byte 0xbc), which succeeds unconditionally per BIP 342",
+ "prevouts": [
+ {
+ "scriptPubKey": "52207696f7e30d71c62aa57ab70b23554a1084f6439b5163b07317f68986b71f0d24",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220f76f37ca6052b7292c8ad1572f57e33e106e04439d2dde833b8324c312bf46c3",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "02000000000102122000b6c37db73bea687e47db28ec20c7c593e2c294223968607d1b18e075610000000000ffffffff65c38e05ba06fb03830ff257c768e439cb21820683af5f970d17a4403794c9dc0000000000ffffffff01c07fdc0b00000000225220abcc959351c9c6d270152cdb3be1b64b1c7a0755c325603899b33154e3b1c19b0201bc21c10d59725454cf341d2b7bc31c95f1149903f64c33e4baedee3a5669a3cf44633b01401673f6a61cbd094c1cce7f84184ff0b7b3f668d6c62d0fda29a9d1de40a4d44df26c9b6a47ebb3dff8ddf8ac379c3c36d6b1efebd5a0085af9920fc18568061000000000",
+ "valid": true
+ },
+ {
+ "id": "v1-v2-mixed",
+ "description": "Witness v1 key path input alongside a two-member witness v2 half-aggregation group, mirroring Example 3 of the BIP",
+ "prevouts": [
+ {
+ "scriptPubKey": "5120a65a8d02e401105e9e68fd11af633b2135be019ccbf71bfc5fbdfb8e44ba2df7",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220f943a227ca855dd9d22cf25837122a0f0dc129d77b452d8b2c20b2bc709bb684",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "522015d5e4e64a5220c7d2c68f5b97454b29c08d6642720017e3ba8d1d133ce98cf6",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "0200000000010399d38299f14c13d666e271ff326cf8c5e43e21d70826e4f1749566a3e80610b90000000000ffffffffeaa41167c8b8ee495014701bc627f54734586036efed5912e68d96b8fe4fd48a0000000000ffffffff78d37d165ff26a505a04c1d645f1f1d393645c7ab1b2fd81aeb429537ebe81670000000000ffffffff01c060d21100000000225220a65a8d02e401105e9e68fd11af633b2135be019ccbf71bfc5fbdfb8e44ba2df70140f631a1ffd1cf8f1fc640dfecc5453aec039f4cef7f807d5821f5750f2ca44bef7c304c558dcc7ac49b22a247c5c9992121fc0796a8b73b7113fd23b25e6d82480120683645a000862a928c89d3982224214f40ee17daa20b826a4c4a102e91d644cc01418a1dfc706d15974f9ef5509eaf0cd521da02f01decafe69045a15273c8ec7579a9411147dfdff7a48a7f7f140e9ea2a798c75107f234ab3d662abd0839dfcdbfbc00000000",
+ "valid": true
+ },
+ {
+ "id": "sighash-byte-stripped",
+ "description": "Explicit SIGHASH_ALL byte removed from a group member by a third party",
+ "prevouts": [
+ {
+ "scriptPubKey": "52205f56c844151d6ded6024f0c30ab90e436e03c5f199f66d77553fc0b8eee66377",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220366b81b84d19c39f58c8769cbd2b1f996542266c400c8de7e3997a5c143d7847",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "02000000000102959f971cfdea5c89923108e7d2c9abf34a327ce3f0f1aa75e054f923b95b1cc20000000000ffffffff9e97d6493ed7423faad0636f6ba60f4a8eb6b26efa6e75513cf85da975c8c0eb0000000000ffffffff01c07fdc0b000000002252205f56c844151d6ded6024f0c30ab90e436e03c5f199f66d77553fc0b8eee663770120809b87ad64fd5246f69c246e81ef26c75323632c4016387b38efae7dd26155c501417699d8ab2d766b924d454eebadb25596d86b44d1895b713dd53f016cea6b9484086f137cb01dbbcfad2dcb2b787af3ad37644c2d366925a7ea9a7480e101ab19bc00000000",
+ "valid": false,
+ "failureReason": "signature message committed to the sighash type"
+ },
+ {
+ "id": "empty-element-no-final",
+ "description": "Witness v2 input whose only witness element is empty, a full-aggregation member without a final input",
+ "prevouts": [
+ {
+ "scriptPubKey": "522080348d8193f0b62e05f9614234c03965f9db14665f38523bfe4fa38bc9beb468",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220a6365e706c43c32a7382608828bf4d219302a520286b02487807e63e5765813d",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "020000000001027b29d1ac4cd5356006588f0d3622ee61a6fc29ad2d299f2f6eb69cba0d7f5caf0000000000ffffffff9e6158b3c5934a484c25e47bd4dbbb3ca36c773d97a421e842806660232f0a0a0000000000ffffffff01c07fdc0b0000000022522080348d8193f0b62e05f9614234c03965f9db14665f38523bfe4fa38bc9beb468010001405c5072e8a3148f5207b21446e920e443315ec741a4155131b71a7742e178368ebfb9d951a452e076a30e245519fc7a9b2770d86ac3b758893a6f24a5e57ea7ca00000000",
+ "valid": false,
+ "failureReason": "aggregation group has no final input"
+ },
+ {
+ "id": "sighash-single-no-output-group",
+ "description": "Half-aggregation group member uses SIGHASH_SINGLE at input index 1 of a single-output transaction",
+ "prevouts": [
+ {
+ "scriptPubKey": "5220c8ce4e6a6a0d34357827bb0fe91cfd76f4dd76178783ade19eebf9709aa849f2",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220238b9c1c5f0a8267a1407055ab4710d68b6f17c78cae61a26bfde011ad304676",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "0200000000010243255c54b0a85e8928e17b91f9f3f344372545f70a9c7e85450f4af1d2243cdd0000000000ffffffff45f25548efbd2113170e2c97cb5a2aecd9b0537956d766c60af33b54da9098320000000000ffffffff01c07fdc0b00000000225220c8ce4e6a6a0d34357827bb0fe91cfd76f4dd76178783ade19eebf9709aa849f20120ce3a7541d82797a2e57bc68ea3845186c806e3c73ec6655fa6c98c376df7ffc9014248021e012ca5c831276f4c79425029651ed38bf6082dd791094da491062fcbcb61cfd395216248969e859232af249893d8b277a805948efc56c13de102fffa6303bc00000000",
+ "valid": false,
+ "failureReason": "SIGHASH_SINGLE input without corresponding output"
+ },
+ {
+ "id": "two-elements-no-annex",
+ "description": "Keypath-looking element followed by a second element that is not an annex, making this a script path spend with an invalid control block",
+ "prevouts": [
+ {
+ "scriptPubKey": "52200391079747abc6405211bd3086ac8d0cfa8289c509120f63dfb37348df78178d",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "52201e6238ab9bd6b76360d86ec5263f6de69dbd2d2766634cc4fa7d814328436633",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "02000000000102796ded7d3a447a3c4a578f9535a9a52bf44b65d6bfd795fe142c0747df38c42c0000000000ffffffff679f42915303ad3f898d2b0bfee543aa568cb6478000e44e58c271f4b6e52f0a0000000000ffffffff01c07fdc0b000000002252200391079747abc6405211bd3086ac8d0cfa8289c509120f63dfb37348df78178d0240f0899cf64d99c1248b45e1a9978f13896fd52a7f2ba59fdbcc758795a455f34d90e892c51ca483cd2771e4bb2ca136dbfe0e95a5ee53bd80e71cdd6210dbbfa80160014068820e1acecedbb521e18d20bc0b7114fb391ce00e0b6e2eb1563b92cfcd9af64127a03b3cd230ed703e0cbf8a3fe1c6325ac9502db90c6278f11dd05c462d8f00000000",
+ "valid": false,
+ "failureReason": "invalid control block size"
+ },
+ {
+ "id": "agg-mode-sig-as-optout",
+ "description": "Signature created over the half-aggregation flavored message used as a bare opted-out signature",
+ "prevouts": [
+ {
+ "scriptPubKey": "5220f5550ce6e940cf53f9f175a7a81e18e4dd2dac375a4433ad15599979368aac14",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220d8846f187dc43f7a2df28b59753aad58bccbdb873fa0eb0dbc191edb6d322e12",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "0200000000010274f6fcc771690ea6f38fc9df6d221ea9e858787d79b2e192f91b03f4e5ec59720000000000ffffffff038baab567625964cdcf30d6bc337418829f2699b28f0d51d8ef861a77dca5260000000000ffffffff01c07fdc0b00000000225220f5550ce6e940cf53f9f175a7a81e18e4dd2dac375a4433ad15599979368aac140140c16866682e8b6c0e2b0bb7d4fce36df1cbbfd1b10f29aa936aca928abb203aa72a37caac1975ead54822b06561aba975c1ce14229b89f66ce407b9ae88816fbc014041b811190dff556d541619af4bf934e6f2e6aedbf8ec343db834435c06f6d2faffe3b560cc7bba0a6dbf68806999533673228a010627603a69a19c89203b7fb800000000",
+ "valid": false,
+ "failureReason": "signature invalid, message commits to the aggregation mode"
+ },
+ {
+ "id": "halfagg-large-group",
+ "description": "8-member half-aggregation group",
+ "prevouts": [
+ {
+ "scriptPubKey": "52207ca5a23b5d8253b092e5e7c2ef60167966781689ccc0d311f119759beba0fba7",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "52205eee9aada57d816a6cfbb21092b51b0e7fe93d2ee1f3dcd80e27343d419527f2",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "522064d00057948fa1890a464fc996a8588b0ea8c6d2abe4c786a4cbc47d0c1cdd3c",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "52201827c2d005bd8cb07201eee287ca25cd1e4b209e16fec42d3404fba65d68dc31",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220a8f1b32af980715b3538daa4af8da54ad9f5af4806855875ca955e85a8d807af",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "52200a0448560df8dbe5e36c3563e2a51b20f0f08fc2cba5f139822958261ce4ce0d",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220e4b368758dd3b238a1705b26cb07df8cb2a2521773701b64c3b573c499526fc0",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "52201bfa0b74a1992ae24806abbf2aac3c3f0fb77e2c64083cf2e70313d0214abd73",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "02000000000108b8efc85febd6bd845177a7171d06cfd52e3a3c688dcfa32a8e8584841e838f770000000000ffffffffe3ef25b266108d5200cfd923167e4dd7b18072994257b674191ceafbed9f8cbf0000000000fffffffff535b8fca7bd89438e9ba575bdd71f12ececd5e34a7fe622459721dd437c71be0000000000ffffffff6fca2aaffb88ae969bcc62522629bb4e2e31af406a8fac5e2701bb6c3bb4305e0000000000ffffffffa026937889ed804a415cd70c9509dc7edf20ef28278ef23e35e2249f73457b570000000000ffffffff81a4bfd409211d0a308c24c36ded78110f5f5f751f00476ce9e06d6871b2d5690000000000ffffffff527ed3cee5f9c269fa74ac92fb266c65e61208faeb6b0619000dddda32cd167c0000000000ffffffffbde7534ac2149e11a2ccf7e7cdcf01964d068ca662df3d60c42e0cac08011bb30000000000ffffffff01c0c59f2f000000002252207ca5a23b5d8253b092e5e7c2ef60167966781689ccc0d311f119759beba0fba701209ec9d9e7172f588efca57173d91f63738dd5a9e4f6f03274046ecdbd854a224501206b1cf84508ca880021423f40ffca58ff5d32455ab00d96f0a729e0a72bfcbc530120187a1b6ab9fa96226abb5b47c18c489112924940f0f809230a904591290be90b0120c61c05f70bd771e926752988d74ced3f8bfe57d279f0464d626a1c2acc8a9da701209f714ccf3230608d91695e954826083061c02cfcc6fd11f5aa706e54e5da4f8d0120724731033b468ad8c6c6f3b36f479963651e153041dad5a7b74284b418a808730120ad8004c0267a9d9ed8a725046b66b6de030f6ce0d0c6f3a40bf1c2d29e46abdb0141c9e636dcde7f5c28cd5e18be362e44ce2da1e4a85ba62c99c777be590ed54af28fead4ab41aaa6020ee08ceb6c8a6aa1047e702fa200682bb526b9c5cee13fbcbc00000000",
+ "valid": true
+ },
+ {
+ "id": "scriptpath-marker-lookalike",
+ "description": "Script path spend whose first stack element is a 1-byte 0xbc marker lookalike, which has no marker meaning outside key path spends",
+ "prevouts": [
+ {
+ "scriptPubKey": "522082ace6d1d7a138a915bc07569161b1b6484d7c800b5e2fab8b573aa3dce40175",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220ffaa7773252d946733d00cc9870e80add10e577893ee972332c910dfe0f0b61c",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "020000000001026c0780d0a76dc7e1f78a6fdcf25908625d50d37de0b055e4acd4198f23deb6a60000000000ffffffffd3c43fd83c79f225cf5208290086806fb0aab1111fcd10888aa972183b3c8fa10000000000ffffffff01c07fdc0b000000002252209895f077cf6760cdcdc729e244e345fe71f84d49bfd2958f01210a1737caf86e0301bc02755121c0c445296d4c0d625c2932df758a7f2a736d022bb6a55bb52c9eb52eb90ffea14f014014aa95ba5afcaaf375cb9515906433659f6e1157c49ee8cc43fab515753a3add50f5a25aeedc67bd8d079a66732d701700baec3143f45d859d41e2f75552284700000000",
+ "valid": true
+ },
+ {
+ "id": "duplicate-key-groups",
+ "description": "Half-aggregation and full-aggregation groups whose two members each spend outputs with the same witness program (address reuse)",
+ "prevouts": [
+ {
+ "scriptPubKey": "522098425d28f35f2da20c400f472183065fb5b221d6860962c68bb6d20bac20b081",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "522098425d28f35f2da20c400f472183065fb5b221d6860962c68bb6d20bac20b081",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "52206a0487f7f1b886fa757ea427cc370ff758c30e0e9ff194ebd20decb9a94eaa9d",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "52206a0487f7f1b886fa757ea427cc370ff758c30e0e9ff194ebd20decb9a94eaa9d",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "0200000000010491e7995af63730c1a6a372277b67a95dccb8610e91a99edfc1e91b227f7437830000000000ffffffff7ebcc3e7e23a3284bb376d66ed1e478a78d4c831e714adce963abd99630803360000000000ffffffff27f82605d137a2cda276cc7aec0e57862a1021b3ab26eb82202b14e50ab6fa5a0000000000ffffffffba4bce7307bda6108692c4b4e89eb98b7a0953ea26f798921557ffaac52b52120000000000ffffffff01c041c8170000000022522098425d28f35f2da20c400f472183065fb5b221d6860962c68bb6d20bac20b08101204134bd40de37fe40f669ede09cbdd10c8314072b79df64d1b1d5586fca61bad4014173b25c213b8dcc75caa9ae39e1dc8fd26f507f718c73ddf5cd387fbfafee290ef7d47987dfa68fc1e8ddf497a3f89e5c9bf7e18e47b7a6c0c723e2bb3bacaafebc01000141b0ce53001261d721870cc83f6db29306cef318174553b1a27539727596e64a597a3e78af413c287653f3bf8509e10fbf31330dea1df21d678e791b05e4050160bd00000000",
+ "valid": true
+ },
+ {
+ "id": "v1-replay",
+ "description": "BIP 341 key path signature created for a witness v1 output with the same output key, replayed on a witness v2 input",
+ "prevouts": [
+ {
+ "scriptPubKey": "52202cd9c8b80033c37a0fc7c1750bba8ef0237dde027d499b347f97243afba66cf8",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220223305cc0a35fa11e7df5671f3b486d54d50041e588279f354efb0363560ae1c",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "0200000000010270f88f7e0757494753b48ec02fbc696341c643f5fc01bcfda556265680409e930000000000ffffffffea9615452372ede28c74eb220add491d09010ed9c8377b0605364c874eceedbc0000000000ffffffff01c07fdc0b000000002252202cd9c8b80033c37a0fc7c1750bba8ef0237dde027d499b347f97243afba66cf8014191871e1b8537b9aa04e14895ecafbbcf707878f7934924c6ba0928dab831949504b9f95ea86e183b573af36b1bdd9303df87efce00f52e4b42a53eeede13bec9810140800c07f424c186961c554602d1f24b8c33f5c748d48ce41c6e7f414c3ad7cfca1831928c88657c9ef46ca6e8d55e86500592e747ac72070c5fab00a7cf6b4dcd00000000",
+ "valid": false,
+ "failureReason": "signature message commits to the spent scriptPubKey"
+ },
+ {
+ "id": "member-sighash-undefined",
+ "description": "Full-aggregation member with the undefined sighash value 0x04",
+ "prevouts": [
+ {
+ "scriptPubKey": "522042df539f730080e1ed2376f765c6f2143089e4be7ce4d9bbe63e21af8e0b327f",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "522059089c0a85019600c1a1bb48a48a6002bdcade4d7d3dd5040ad52358c6dbca8f",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "52207bd2a9b241b649fc595db97b178f10e9dba8da55fa85a2a37b11abc16dd4f8de",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "0200000000010382b704aa2b678bc8d052c0b677bc07167090116187ac01fd930a6b1eadc7b92b0000000000ffffffffc0d2d3ed02079c29fb00ba5ee6321e66dc9d50bd88deb26d5820d3246e31bd800000000000ffffffffdaac67e664466923982c4bef1018b5ae94a92b3fa10210b81c526c1e677dad5a0000000000ffffffff01c060d2110000000022522042df539f730080e1ed2376f765c6f2143089e4be7ce4d9bbe63e21af8e0b327f0140b0351faa8a03a5af239188bfd4fda857ccb3c1e00e24cb04d18e844eef2353c02f9e9f0e7de6f8348e004472073d7dc959729a174c5fa323160aefc4ced8a7d801010401417cbe8c2391b57f9ee9e8a5766efd036f137840e3ce5396e493b0f0477f7702ecda33c68372e0fee71579c9bf37230f2b2575bd4cb83c135afcee41b55a5f5289bd00000000",
+ "valid": false,
+ "failureReason": "undefined sighash type"
+ },
+ {
+ "id": "halfagg-final-old-format",
+ "description": "97-byte 0xbc element carrying the whole aggregate signature, the final input encoding of an earlier revision",
+ "prevouts": [
+ {
+ "scriptPubKey": "5220c3fdf588e2d9063fd7e49de5a97fbea45c7a4048430e88b23cda74997f8aa067",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220faddf6d6870b6ad1d3b6cc6af9e239764bc62363d2ca9e25d026447e06c7200a",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "02000000000102917db2c3462c9895bdfa343f317c9112851662a05f7b39f639e735571aa1a3f40000000000ffffffffdde095c91533108ac01227dc10df531d73b5f8293a3b9dff3a9db994ce03a6b90000000000ffffffff01c07fdc0b00000000225220c3fdf588e2d9063fd7e49de5a97fbea45c7a4048430e88b23cda74997f8aa0670120121d1d860389ff25088bd64d369e28a218f93497dbefc0c48af074954dbf51820161121d1d860389ff25088bd64d369e28a218f93497dbefc0c48af074954dbf5182a1080a725a9558ee46904299e5e6eba263191a8dc096be7404f53e2e0f748cbd89c0ad029b07b446cdb07adcb3683e3c12b4044c6c7f3ecc2983fb8c394d174abc00000000",
+ "valid": false,
+ "failureReason": "marker and length match no defined structure"
+ },
+ {
+ "id": "halfagg-acp-member",
+ "description": "Half-aggregation group with a SIGHASH_ALL|SIGHASH_ANYONECANPAY member",
+ "prevouts": [
+ {
+ "scriptPubKey": "522089547531e583aef85d429080a8f251e040414fbdf72500ab72dcb9569830b6ce",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "52206483a23467272265b2718d368b4b93d58f015c7d1b451f3e502ff90022bd6447",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "0200000000010237978a1b66b8b936d709511aad50fc9fcb57ffd6ba379d35c6eb146292088f650000000000ffffffff00005b631d87e8087e2e92eeee47007c1869c2da602a1cdb353c8e1d1a919ac50000000000ffffffff01c07fdc0b0000000022522089547531e583aef85d429080a8f251e040414fbdf72500ab72dcb9569830b6ce0121b42ac8ee08116c28e76afe2d7897e52d8bd246df7926ed532a041a2b39d1f51c81014151f322bf3ad2c82e3871672b5d7abd003d3d4ac0a9a9773cd272b4940c4f14d7e1ce7f986bc713e990e4ece1aca38c298d5d0e78498bb7660cae3e22758f932cbc00000000",
+ "valid": true
+ },
+ {
+ "id": "marker-swapped-fullagg",
+ "description": "Full-aggregation final of a single-member group mutated to carry the half-aggregation marker",
+ "prevouts": [
+ {
+ "scriptPubKey": "522009d2ff94dc12d14b0b63c95dcdc8cd2a77a3eecca3bbf2809d322dc8b6b5d62b",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "02000000000101787d107a893487240e835409c4cd5c68420bd6301ee936c2b201e90ad5bc8de60000000000ffffffff01c09ee6050000000022522009d2ff94dc12d14b0b63c95dcdc8cd2a77a3eecca3bbf2809d322dc8b6b5d62b0141918fef8d8d2d4312ea43c7aa3fa34f0827387318fe81fb1ad63b18d1f1e14c84e9bba54f4f81cb9d7bee3fcd0823a80af0c6608f54b83e935df1a632e2e03675bc00000000",
+ "valid": false,
+ "failureReason": "aggregate signature invalid, messages commit to the aggregation mode"
+ },
+ {
+ "id": "annex-on-empty-member",
+ "description": "Full-aggregation member carrying an annex on an empty witness element, committed in its signature message",
+ "prevouts": [
+ {
+ "scriptPubKey": "5220765b3ec5afb0323413e8493ed93c122a15ca3c48b88f1c2722db5247a5461c66",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220ace7e7d0e0a3391864ed53c0095c91b640015c66ee259c0112240609d03af626",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "02000000000102a7f83858dde67a2b773c9ed4fd0a7c25a514c7a9fa70e7eb7b9449332c39a78a0000000000ffffffff805671eb757aac19fa56a255acda78df1b532c5220d31e44a7867cf187580b7e0000000000ffffffff01c07fdc0b00000000225220765b3ec5afb0323413e8493ed93c122a15ca3c48b88f1c2722db5247a5461c66020010504349534120616e6e6578207465737401419006ce438cce4f8458e1db2841a33fe053498b9a80bcb4d96937e169644bb817724dac0032d00ec30700d41c5e970ef8a38f85de0c709cd7fa6f5433aa606661bd00000000",
+ "valid": true
+ },
+ {
+ "id": "nonce-shares-swapped",
+ "description": "Nonce shares of the two half-aggregation inputs swapped by a third party",
+ "prevouts": [
+ {
+ "scriptPubKey": "5220c8ee60d3a8a37700930aa95a2f154b73e085ee38f21342bd19bad5c0e8fdbb12",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220f0daee3e78b7614a469644b6b9874c3fe530dfec8b580b3460da45badee74a4b",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "02000000000102adfe07b3615f73ed6d91c6715e1640dc6520a75b9b7ef7423b0b681b1bef27fe0000000000ffffffff27fcd63dc25c409f3656d0c9d0f5fd700a53f1662cc135fa2033a1e16ede34d20000000000ffffffff01c07fdc0b00000000225220c8ee60d3a8a37700930aa95a2f154b73e085ee38f21342bd19bad5c0e8fdbb120120982c8e5359de318f5a83ccc2b269e56e10ea1d1f345cbc2e4c235f776f427d5701411a09701066a72dee917b725ecef1a881627254da5f4bc343ea799f92be885029dfead6af3b57c65f826607c045c13e268c94fa30c61dd2d47f500b2635e34ecebc00000000",
+ "valid": false,
+ "failureReason": "aggregate signature invalid, the randomizers commit to the shares in input order"
+ },
+ {
+ "id": "optout-too-long",
+ "description": "66-byte element ending in a valid sighash byte, one byte above the opted-out maximum",
+ "prevouts": [
+ {
+ "scriptPubKey": "522023bf6306a5bbd4682329b1f71463e8887beb5796e90a75f2cd20e14671bb3015",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "52205617de2e619bb3b360d9064287c2a285f7e79e6b67e7d8043122a7a1cbadaab5",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "020000000001020c775db8b13f8dc047a1eaa9411b3d62762e8a9c51d02a2d1e6c083078d2630a0000000000ffffffff91c615ac861c12ddbfe825e9e3cf5bd952b839ba5d23add6ea92ff8c62e01faf0000000000ffffffff01c07fdc0b0000000022522023bf6306a5bbd4682329b1f71463e8887beb5796e90a75f2cd20e14671bb30150142b3ca4c0ef8058fc55d7886524ed2442f05df5f7c695abb0bf7ec001e125ba75f0964727fd1769c2c3fc6be4b42c7c822029e5815f36b36b54a7e950d4f80a263010101407276cf33f106c7809dde5d1104ab3893bbdaf09d61371d50db20b3435c719fb7d9d75257b5ed3d02db02dd46b92a187ab269f1d8d4f48f6aaac230d00ffa52e000000000",
+ "valid": false,
+ "failureReason": "marker and length match no defined structure"
+ },
+ {
+ "id": "member-marker-only",
+ "description": "1-byte element containing only the marker value 0xbc, a full-aggregation member with an invalid sighash byte",
+ "prevouts": [
+ {
+ "scriptPubKey": "5220d0c828d9203c41f97971718aed433eb578828f313d03913710a359005b7ddc52",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220f0c19ee28bd77735331185eff795ca94fb69075a820f243d1c2eacd32fe17df8",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "02000000000102be96d771bfb90ce9b5fcf065da4f92446f4408b903f4c88e683728a45c8460080000000000ffffffff268e2af1032ee7d550b1345e9a43d03f0d0ca381b6f21dc1eb4988886107db8c0000000000ffffffff01c07fdc0b00000000225220d0c828d9203c41f97971718aed433eb578828f313d03913710a359005b7ddc520101bc0140a14a719ec76e7df2de4304059717acbff6e4daa7664213c5d129c03536725f31c13fe14b53a8a0043dec8d17efae3a21575ec120a0c6b6828d1691329646576900000000",
+ "valid": false,
+ "failureReason": "undefined sighash type"
+ },
+ {
+ "id": "marker-swapped-halfagg",
+ "description": "Half-aggregation final of a single-member group mutated to carry the full-aggregation marker",
+ "prevouts": [
+ {
+ "scriptPubKey": "5220efce560c8eaf170db44a9af7691f8807be52d8314c4575aa46ba4fce54c2b0c6",
+ "amountSats": 100000000
+ }
+ ],
+ "tx": "0200000000010187fea558630296d581abd8d24b147faeaa371a0d325edcf565b6719d8fd5ea310000000000ffffffff01c09ee60500000000225220efce560c8eaf170db44a9af7691f8807be52d8314c4575aa46ba4fce54c2b0c60141bf6915975cc9bf5ab48830c0f34026519f668d453624848298d9e17fbf1362792f96def59bbab5ae47ab790704392b1e456703ad14bf72c375e874fff750dd1abd00000000",
+ "valid": false,
+ "failureReason": "aggregate signature invalid, messages commit to the aggregation mode"
+ }
+ ]
+}
diff --git a/bip-0460/fullagg.py b/bip-0460/fullagg.py
new file mode 100644
index 0000000000..99fc1d8d8a
--- /dev/null
+++ b/bip-0460/fullagg.py
@@ -0,0 +1,196 @@
+#!/usr/bin/env python3
+"""
+Reference implementation of BIP 459 DahLIAS fully aggregated signatures
+for secp256k1.
+
+WARNING: This implementation is for demonstration purposes only and is not
+optimized for production use.
+"""
+
+from pathlib import Path
+from typing import List, Tuple, Optional
+import secrets
+import sys
+
+sys.path.insert(0, str(Path(__file__).parent / "secp256k1lab/src"))
+from secp256k1lab.secp256k1 import G, GE, Scalar
+from secp256k1lab.util import tagged_hash, xor_bytes
+
+n = GE.ORDER
+
+FULLAGG_TAG_AUX = "BIP0459/aux"
+FULLAGG_TAG_NONCE = "BIP0459/nonce"
+FULLAGG_TAG_NONCECOEF = "BIP0459/noncecoef"
+FULLAGG_TAG_SIG = "BIP0459/sig"
+
+
+#
+# Helpers
+#
+
+def has_even_y(P: GE) -> bool:
+ return P.has_even_y()
+
+
+def cbytes(P: GE) -> bytes:
+ return P.to_bytes_compressed()
+
+
+def xbytes(P: GE) -> bytes:
+ return P.to_bytes_xonly()
+
+
+#
+# Key Tweaking
+#
+
+def TweakSK(sk: Scalar, t: Scalar, is_xonly: bool) -> Scalar:
+ d = sk if (not is_xonly or has_even_y(sk * G)) else -sk
+ sk_out = d + t
+ assert sk_out != 0
+ return sk_out
+
+
+def TweakPK(pk: GE, t: Scalar, is_xonly: bool) -> GE:
+ P = pk if (not is_xonly or has_even_y(pk)) else -pk
+ Q = P + t * G
+ assert not Q.infinity
+ return Q
+
+
+#
+# Nonce Generation and Aggregation
+#
+
+def NonceGen(sk: Optional[Scalar] = None,
+ extra_in: bytes = b'') -> Tuple[Tuple[Scalar, Scalar], Tuple[GE, GE]]:
+ rand_prime = secrets.token_bytes(32)
+ if sk is not None:
+ rand = xor_bytes(sk.to_bytes(), tagged_hash(FULLAGG_TAG_AUX, rand_prime))
+ else:
+ rand = rand_prime
+ r1 = Scalar.from_bytes_wrapping(tagged_hash(FULLAGG_TAG_NONCE, rand + extra_in + b'\x00'))
+ r2 = Scalar.from_bytes_wrapping(tagged_hash(FULLAGG_TAG_NONCE, rand + extra_in + b'\x01'))
+ assert r1 != 0 and r2 != 0
+ R1, R2 = r1 * G, r2 * G
+ return (r1, r2), (R1, R2)
+
+
+def NonceAgg(pubnonces: List[Tuple[GE, GE]]) -> Tuple[GE, GE]:
+ u = len(pubnonces)
+ R1, R2 = pubnonces[0]
+ for i in range(1, u):
+ R1 = R1 + pubnonces[i][0]
+ R2 = R2 + pubnonces[i][1]
+ if R1.infinity or R2.infinity:
+ raise ValueError("aggregate nonce is the point at infinity")
+ return R1, R2
+
+
+#
+# Session Values
+#
+
+def GetSessionValues(aggnonce: Tuple[GE, GE], pks: List[GE], msgs: List[bytes],
+ pubnonces: List[Tuple[GE, GE]]) -> Tuple[GE, Scalar]:
+ R1, R2 = aggnonce
+ u = len(pks)
+ nonce_data = cbytes(R1) + cbytes(R2)
+ for i in range(u):
+ nonce_data += xbytes(pks[i]) + msgs[i] + cbytes(pubnonces[i][1])
+ b = Scalar.from_bytes_wrapping(tagged_hash(FULLAGG_TAG_NONCECOEF, nonce_data))
+ R = R1 + b * R2
+ assert not R.infinity
+ return R, b
+
+
+#
+# Signing
+#
+
+def Sign(secnonce: Tuple[Scalar, Scalar], sk: Scalar, m: bytes,
+ aggnonce: Tuple[GE, GE], pks: List[GE], msgs: List[bytes],
+ pubnonces: List[Tuple[GE, GE]]) -> Scalar:
+ assert len(pks) == len(msgs) == len(pubnonces) >= 1
+ assert len(m) == 32 and all(len(mi) == 32 for mi in msgs)
+ r1, r2 = secnonce
+ assert r1 != 0 and r2 != 0
+ assert sk != 0
+ P = sk * G
+ R2_local = r2 * G
+
+ # Index lookup and uniqueness check
+ matches = [j for j in range(len(pubnonces)) if pubnonces[j][1] == R2_local]
+ assert len(matches) == 1
+ j = matches[0]
+ assert xbytes(pks[j]) == xbytes(P) and msgs[j] == m
+
+ R, b = GetSessionValues(aggnonce, pks, msgs, pubnonces)
+ e = Scalar(1) if has_even_y(R) else -Scalar(1)
+ d_prime = sk if has_even_y(P) else -sk
+
+ L = b''
+ for i in range(len(pks)):
+ L += xbytes(pks[i]) + msgs[i]
+ c_j = Scalar.from_bytes_wrapping(tagged_hash(FULLAGG_TAG_SIG, L + xbytes(R) + xbytes(pks[j]) + msgs[j]))
+ s_j = e * (r1 + b * r2) + c_j * d_prime
+ return s_j
+
+
+#
+# Aggregation
+#
+
+def SigAgg(aggnonce: Tuple[GE, GE], pks: List[GE], msgs: List[bytes],
+ pubnonces: List[Tuple[GE, GE]], psigs: List[Scalar]) -> Tuple[GE, Scalar]:
+ assert len(pks) == len(msgs) == len(pubnonces) == len(psigs) >= 1
+ assert all(len(mi) == 32 for mi in msgs)
+ R, _ = GetSessionValues(aggnonce, pks, msgs, pubnonces)
+ s = Scalar.sum(*psigs)
+ return R, s
+
+
+#
+# Partial Signature Verification
+#
+
+def PartialSigVerify(psig: Scalar, pks: List[GE], msgs: List[bytes],
+ pubnonces: List[Tuple[GE, GE]], signer_index: int) -> bool:
+ if not (len(pks) == len(msgs) == len(pubnonces) >= 1) or any(len(mi) != 32 for mi in msgs):
+ return False
+ if not (0 <= signer_index < len(pks)):
+ return False
+ i = signer_index
+ R1_i, R2_i = pubnonces[i]
+ P_i = GE.from_bytes_xonly(xbytes(pks[i]))
+ R, b = GetSessionValues(NonceAgg(pubnonces), pks, msgs, pubnonces)
+ e = Scalar(1) if has_even_y(R) else -Scalar(1)
+
+ L = b''
+ for k in range(len(pks)):
+ L += xbytes(pks[k]) + msgs[k]
+ c_i = Scalar.from_bytes_wrapping(tagged_hash(FULLAGG_TAG_SIG, L + xbytes(R) + xbytes(pks[i]) + msgs[i]))
+ R_eff_i = R1_i + b * R2_i
+ return psig * G == e * R_eff_i + c_i * P_i
+
+
+#
+# Aggregate Signature Verification
+#
+
+def Verify(pks: List[GE], msgs: List[bytes], sig: Tuple[GE, Scalar]) -> bool:
+ R_point, s = sig
+ if not (len(pks) == len(msgs) >= 1) or any(len(mi) != 32 for mi in msgs):
+ return False
+ u = len(pks)
+ R = GE.from_bytes_xonly(xbytes(R_point))
+ Ps = [GE.from_bytes_xonly(xbytes(pks[i])) for i in range(u)]
+
+ L = b''
+ for i in range(u):
+ L += xbytes(pks[i]) + msgs[i]
+ rhs = R
+ for i in range(u):
+ c_i = Scalar.from_bytes_wrapping(tagged_hash(FULLAGG_TAG_SIG, L + xbytes(R) + xbytes(pks[i]) + msgs[i]))
+ rhs = rhs + c_i * Ps[i]
+ return s * G == rhs
diff --git a/bip-0460/halfagg.py b/bip-0460/halfagg.py
new file mode 100644
index 0000000000..aed42b6bde
--- /dev/null
+++ b/bip-0460/halfagg.py
@@ -0,0 +1,192 @@
+#!/usr/bin/env python3
+"""
+Schnorr signature half-aggregation reference implementation
+
+WARNING: This implementation is for demonstration purposes only and _not_ to
+be used in production environments.
+"""
+
+from pathlib import Path
+import sys
+
+sys.path.insert(0, str(Path(__file__).parent / "secp256k1lab/src"))
+from secp256k1lab.secp256k1 import (
+ G,
+ GE,
+ Scalar,
+)
+from secp256k1lab.util import (
+ tagged_hash,
+)
+
+
+def Aggregate(pms):
+ """
+ Aggregates an array of triples (public key, message, signature) into a single aggregate signature.
+
+ :param pms: An array of triples (public key, message, signature).
+ :return: The aggregate signature.
+ """
+
+ # Let aggsig = bytes(0)
+ aggsig = bytes([0] * 32)
+
+ pm_aggd = []
+
+ # Return IncAggregate(aggsig, pms0..u-1); fail if that fails.
+ return IncAggregate(aggsig, pm_aggd, pms)
+
+
+# IncAggregate(aggsig, pm_aggd0..v-1, pms_to_agg0..u-1)
+def IncAggregate(aggsig, pm_aggd, pms_to_agg):
+ """
+ Incrementally aggregates an additional array of triples (public key, message, signature)
+ into an existing aggregate signature.
+
+ :param aggsig: A byte array representing the aggregate signature.
+ :param pm_aggd: An array of tuples (public key, message).
+ :param pms_to_agg: An array of triples (public key, message, signature).
+ :return: The new aggregate signature.
+ """
+
+ v = len(pm_aggd)
+ u = len(pms_to_agg)
+
+ # Fail if len(aggsig) ≠ 32 * (v + 1)
+ if len(aggsig) != 32 * (v + 1):
+ raise ValueError("Length of aggsig must be 32 * (v + 1)")
+
+ r_values = []
+ pmr_to_agg = []
+
+ # For i = 0 .. v-1:
+ for i in range(v):
+ # Let (pki, mi) = pm_aggdi
+ (pki, mi) = pm_aggd[i]
+
+ # Let ri = aggsig[i⋅32:(i+1)⋅32]
+ ri = aggsig[i * 32:(i + 1) * 32]
+ r_values.append(ri)
+
+ pmr_to_agg.append((pki, mi, ri))
+
+ z_values = []
+ s_values = []
+
+ # For i = v .. v+u-1:
+ for i in range(v, v + u):
+ # Let (pki, mi, sigi) = pms_to_aggi-v
+ (pki, mi, sigi) = pms_to_agg[i - v]
+
+ # Let ri = sigi[0:32]
+ ri = sigi[0:32]
+ r_values.append(ri)
+
+ # Let si = int(sigi[32:64]); fail if si ≥ n
+ si = Scalar.from_bytes_checked(sigi[32:64])
+ s_values.append(si)
+
+ # If i = 0:
+ # Let zi = 1
+ # Else:
+ # Let zi = int(hashBIP0458/randomizer(r0 || pk0 || m0 || ... || ri || pki || mi)) mod n
+ pmr_to_agg += [(pki, mi, sigi[0:32]) for (pki, mi, sigi) in pms_to_agg]
+ z_values.append(hashHalfAgg_randomizer(pmr_to_agg, i))
+
+ # Let sagg = int(aggsig[v⋅32:(v+1)⋅32]); fail if sagg ≥ n
+ s = Scalar.from_bytes_checked(aggsig[v * 32:(v + 1) * 32])
+
+ # Let s = sagg + zv⋅sv + ... + zv+u-1⋅sv+u-1 mod n
+ for i in range(u):
+ s = s + z_values[i] * s_values[i]
+
+ # Return r0 || ... || rv+u-1 || bytes(s)
+ return b''.join(r_values) + s.to_bytes()
+
+
+# VerifyAggregate(aggsig, pm_aggd0..u-1)
+def VerifyAggregate(aggsig, pm_aggd):
+ """
+ Verifies an aggregate signature against an array of public key and message tuples.
+
+ :param aggsig: A byte array representing the aggregate signature.
+ :param pm_aggd: An array of tuples (public key, message).
+ :return: Boolean indicating whether the verification is successful.
+ """
+
+ u = len(pm_aggd)
+
+ # Fail if len(aggsig) ≠ 32 * (u + 1)
+ if len(aggsig) != 32 * (u + 1):
+ raise ValueError("Length of aggsig must be 32 * (u + 1)")
+
+ z_values = []
+ R_values = []
+ P_values = []
+ e_values = []
+ r_values = []
+
+ # For i = 0 .. u-1:
+ for i in range(u):
+ # Let (pki, mi) = pm_aggdi
+ (pki, mi) = pm_aggd[i]
+
+ # Let Pi = lift_x(int(pki)); fail if that fails
+ try:
+ Pi = GE.from_bytes_xonly(pki)
+ except ValueError:
+ return False
+ P_values.append(Pi)
+
+ # Let ri = aggsig[i⋅32:(i+1)⋅32]
+ ri = aggsig[i * 32:(i + 1) * 32]
+ # Let Ri = lift_x(int(ri)); fail if that fails
+ try:
+ Ri = GE.from_bytes_xonly(ri)
+ except ValueError:
+ return False
+ R_values.append(Ri)
+ r_values.append(ri)
+
+ # Let ei = int(hashBIP0340/challenge(ri || pki || mi)) mod n
+ ei = Scalar.from_bytes_wrapping(hashBIP0340_challenge(ri, pki, mi))
+ e_values.append(ei)
+
+ # If i = 0:
+ # Let zi = 1
+ # Else:
+ # Let zi = int(hashBIP0458/randomizer(r0 || pk0 || m0 || ... || ri || pki || mi)) mod n
+ pmr = [(pki, mi, ri) for (pki, mi), ri in zip(pm_aggd, r_values)]
+ z_values.append(hashHalfAgg_randomizer(pmr, i))
+
+ # Let s = int(aggsig[u⋅32:(u+1)⋅32]); fail if s ≥ n
+ try:
+ s = Scalar.from_bytes_checked(aggsig[u * 32:(u + 1) * 32])
+ except ValueError:
+ return False
+
+ # Fail if s⋅G ≠ z0⋅(R0 + e0⋅P0) + ... + zu-1⋅(Ru-1 + eu-1⋅Pu-1)
+ lhs = s * G
+ rhs = GE()
+ for i in range(u):
+ rhs += z_values[i] * (R_values[i] + e_values[i] * P_values[i])
+
+ return lhs == rhs
+
+
+def hashBIP0340_challenge(sig, pubkey, msg):
+ return tagged_hash("BIP0340/challenge", sig + pubkey + msg)
+
+
+def hashHalfAgg_randomizer(pmr, index):
+ if index == 0:
+ return Scalar(1)
+
+ random_input = bytes()
+ for i in range(index + 1):
+ (pki, mi, ri) = pmr[i]
+ random_input += ri
+ random_input += pki
+ random_input += mi
+
+ return Scalar.from_bytes_wrapping(tagged_hash("BIP0458/randomizer", random_input))
diff --git a/bip-0460/secp256k1lab/.github/workflows/main.yml b/bip-0460/secp256k1lab/.github/workflows/main.yml
new file mode 100644
index 0000000000..fb05230b3c
--- /dev/null
+++ b/bip-0460/secp256k1lab/.github/workflows/main.yml
@@ -0,0 +1,34 @@
+name: Tests
+on: [push, pull_request]
+jobs:
+ ruff:
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@v4
+ - name: Install the latest version of uv
+ uses: astral-sh/setup-uv@v5
+ - run: uvx ruff check .
+ mypy:
+ runs-on: ubuntu-latest
+ strategy:
+ matrix:
+ python-version: ["3.11", "3.12", "3.13", "3.14"]
+ steps:
+ - uses: actions/checkout@v4
+ - name: Install the latest version of uv, setup Python ${{ matrix.python-version }}
+ uses: astral-sh/setup-uv@v5
+ with:
+ python-version: ${{ matrix.python-version }}
+ - run: uvx mypy .
+ unittest:
+ runs-on: ubuntu-latest
+ strategy:
+ matrix:
+ python-version: ["3.11", "3.12", "3.13", "3.14"]
+ steps:
+ - uses: actions/checkout@v4
+ - name: Setup Python ${{ matrix.python-version }}
+ uses: actions/setup-python@v5
+ with:
+ python-version: ${{ matrix.python-version }}
+ - run: python3 -m unittest
diff --git a/bip-0460/secp256k1lab/.gitignore b/bip-0460/secp256k1lab/.gitignore
new file mode 100644
index 0000000000..505a3b1ca2
--- /dev/null
+++ b/bip-0460/secp256k1lab/.gitignore
@@ -0,0 +1,10 @@
+# Python-generated files
+__pycache__/
+*.py[oc]
+build/
+dist/
+wheels/
+*.egg-info
+
+# Virtual environments
+.venv
diff --git a/bip-0460/secp256k1lab/.python-version b/bip-0460/secp256k1lab/.python-version
new file mode 100644
index 0000000000..2c0733315e
--- /dev/null
+++ b/bip-0460/secp256k1lab/.python-version
@@ -0,0 +1 @@
+3.11
diff --git a/bip-0460/secp256k1lab/CHANGELOG.md b/bip-0460/secp256k1lab/CHANGELOG.md
new file mode 100644
index 0000000000..4c756d3695
--- /dev/null
+++ b/bip-0460/secp256k1lab/CHANGELOG.md
@@ -0,0 +1,25 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+#### Added
+ - Added new methods `Scalar.from_int_nonzero_checked` and `Scalar.from_bytes_nonzero_checked`
+ that ensure a constructed scalar is in the range `0 < s < N` (i.e. is non-zero and within the
+ group order) and throw a `ValueError` otherwise. This is e.g. useful for ensuring that newly
+ generated secret keys or nonces are valid without having to do the non-zero check manually.
+ The already existing methods `Scalar.from_int_checked` and `Scalar.from_bytes_checked` error
+ on overflow, but not on zero, i.e. they only ensure `0 <= s < N`.
+
+ - Added a new method `GE.from_bytes_compressed_with_infinity` to parse a compressed
+ public key (33 bytes) to a group element, where the all-zeros bytestring maps to the
+ point at infinity. This is the counterpart to the already existing serialization
+ method `GE.to_bytes_compressed_with_infinity`.
+
+## [1.0.0] - 2025-03-31
+
+Initial release.
diff --git a/bip-0460/secp256k1lab/COPYING b/bip-0460/secp256k1lab/COPYING
new file mode 100644
index 0000000000..e8f2163641
--- /dev/null
+++ b/bip-0460/secp256k1lab/COPYING
@@ -0,0 +1,23 @@
+The MIT License (MIT)
+
+Copyright (c) 2009-2024 The Bitcoin Core developers
+Copyright (c) 2009-2024 Bitcoin Developers
+Copyright (c) 2025- The secp256k1lab Developers
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
diff --git a/bip-0460/secp256k1lab/README.md b/bip-0460/secp256k1lab/README.md
new file mode 100644
index 0000000000..dbc9dbd04c
--- /dev/null
+++ b/bip-0460/secp256k1lab/README.md
@@ -0,0 +1,13 @@
+secp256k1lab
+============
+
+
+
+An INSECURE implementation of the secp256k1 elliptic curve and related cryptographic schemes written in Python, intended for prototyping, experimentation and education.
+
+Features:
+* Low-level secp256k1 field and group arithmetic.
+* Schnorr signing/verification and key generation according to [BIP-340](https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki).
+* ECDH key exchange.
+
+WARNING: The code in this library is slow and trivially vulnerable to side channel attacks.
diff --git a/bip-0460/secp256k1lab/pyproject.toml b/bip-0460/secp256k1lab/pyproject.toml
new file mode 100644
index 0000000000..68b927b384
--- /dev/null
+++ b/bip-0460/secp256k1lab/pyproject.toml
@@ -0,0 +1,34 @@
+[project]
+name = "secp256k1lab"
+version = "1.0.0"
+description = "An INSECURE implementation of the secp256k1 elliptic curve and related cryptographic schemes, intended for prototyping, experimentation and education"
+readme = "README.md"
+authors = [
+ { name = "Pieter Wuille", email = "pieter@wuille.net" },
+ { name = "Tim Ruffing", email = "me@real-or-random.org" },
+ { name = "Jonas Nick", email = "jonasd.nick@gmail.com" },
+ { name = "Sebastian Falbesoner", email = "sebastian.falbesoner@gmail.com" }
+]
+maintainers = [
+ { name = "Tim Ruffing", email = "me@real-or-random.org" },
+ { name = "Jonas Nick", email = "jonasd.nick@gmail.com" },
+ { name = "Sebastian Falbesoner", email = "sebastian.falbesoner@gmail.com" }
+]
+requires-python = ">=3.11"
+license = "MIT"
+license-files = ["COPYING"]
+keywords = ["secp256k1", "elliptic curves", "cryptography", "Bitcoin"]
+classifiers = [
+ "Development Status :: 5 - Production/Stable",
+ "Intended Audience :: Developers",
+ "Intended Audience :: Education",
+ "Intended Audience :: Science/Research",
+ "License :: OSI Approved :: MIT License",
+ "Programming Language :: Python",
+ "Topic :: Security :: Cryptography",
+]
+dependencies = []
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
diff --git a/bip-0460/secp256k1lab/src/secp256k1lab/__init__.py b/bip-0460/secp256k1lab/src/secp256k1lab/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/bip-0460/secp256k1lab/src/secp256k1lab/bip340.py b/bip-0460/secp256k1lab/src/secp256k1lab/bip340.py
new file mode 100644
index 0000000000..ba839d16e1
--- /dev/null
+++ b/bip-0460/secp256k1lab/src/secp256k1lab/bip340.py
@@ -0,0 +1,73 @@
+# The following functions are based on the BIP 340 reference implementation:
+# https://github.com/bitcoin/bips/blob/master/bip-0340/reference.py
+
+from .secp256k1 import FE, GE, G
+from .util import int_from_bytes, bytes_from_int, xor_bytes, tagged_hash
+
+
+def pubkey_gen(seckey: bytes) -> bytes:
+ d0 = int_from_bytes(seckey)
+ if not (1 <= d0 <= GE.ORDER - 1):
+ raise ValueError("The secret key must be an integer in the range 1..n-1.")
+ P = d0 * G
+ assert not P.infinity
+ return P.to_bytes_xonly()
+
+
+def schnorr_sign(
+ msg: bytes, seckey: bytes, aux_rand: bytes, tag_prefix: str = "BIP0340"
+) -> bytes:
+ d0 = int_from_bytes(seckey)
+ if not (1 <= d0 <= GE.ORDER - 1):
+ raise ValueError("The secret key must be an integer in the range 1..n-1.")
+ if len(aux_rand) != 32:
+ raise ValueError("aux_rand must be 32 bytes instead of %i." % len(aux_rand))
+ P = d0 * G
+ assert not P.infinity
+ d = d0 if P.has_even_y() else GE.ORDER - d0
+ t = xor_bytes(bytes_from_int(d), tagged_hash(tag_prefix + "/aux", aux_rand))
+ k0 = (
+ int_from_bytes(tagged_hash(tag_prefix + "/nonce", t + P.to_bytes_xonly() + msg))
+ % GE.ORDER
+ )
+ if k0 == 0:
+ raise RuntimeError("Failure. This happens only with negligible probability.")
+ R = k0 * G
+ assert not R.infinity
+ k = k0 if R.has_even_y() else GE.ORDER - k0
+ e = (
+ int_from_bytes(
+ tagged_hash(
+ tag_prefix + "/challenge", R.to_bytes_xonly() + P.to_bytes_xonly() + msg
+ )
+ )
+ % GE.ORDER
+ )
+ sig = R.to_bytes_xonly() + bytes_from_int((k + e * d) % GE.ORDER)
+ assert schnorr_verify(msg, P.to_bytes_xonly(), sig, tag_prefix=tag_prefix)
+ return sig
+
+
+def schnorr_verify(
+ msg: bytes, pubkey: bytes, sig: bytes, tag_prefix: str = "BIP0340"
+) -> bool:
+ if len(pubkey) != 32:
+ raise ValueError("The public key must be a 32-byte array.")
+ if len(sig) != 64:
+ raise ValueError("The signature must be a 64-byte array.")
+ try:
+ P = GE.from_bytes_xonly(pubkey)
+ except ValueError:
+ return False
+ r = int_from_bytes(sig[0:32])
+ s = int_from_bytes(sig[32:64])
+ if (r >= FE.SIZE) or (s >= GE.ORDER):
+ return False
+ e = (
+ int_from_bytes(tagged_hash(tag_prefix + "/challenge", sig[0:32] + pubkey + msg))
+ % GE.ORDER
+ )
+ R = s * G - e * P
+ if R.infinity or (not R.has_even_y()) or (R.x != r):
+ return False
+ return True
diff --git a/bip-0460/secp256k1lab/src/secp256k1lab/ecdh.py b/bip-0460/secp256k1lab/src/secp256k1lab/ecdh.py
new file mode 100644
index 0000000000..73f47fa1a7
--- /dev/null
+++ b/bip-0460/secp256k1lab/src/secp256k1lab/ecdh.py
@@ -0,0 +1,16 @@
+import hashlib
+
+from .secp256k1 import GE, Scalar
+
+
+def ecdh_compressed_in_raw_out(seckey: bytes, pubkey: bytes) -> GE:
+ """TODO"""
+ shared_secret = Scalar.from_bytes_checked(seckey) * GE.from_bytes_compressed(pubkey)
+ assert not shared_secret.infinity # prime-order group
+ return shared_secret
+
+
+def ecdh_libsecp256k1(seckey: bytes, pubkey: bytes) -> bytes:
+ """TODO"""
+ shared_secret = ecdh_compressed_in_raw_out(seckey, pubkey)
+ return hashlib.sha256(shared_secret.to_bytes_compressed()).digest()
diff --git a/bip-0460/secp256k1lab/src/secp256k1lab/keys.py b/bip-0460/secp256k1lab/src/secp256k1lab/keys.py
new file mode 100644
index 0000000000..3e28897e99
--- /dev/null
+++ b/bip-0460/secp256k1lab/src/secp256k1lab/keys.py
@@ -0,0 +1,15 @@
+from .secp256k1 import GE, G
+from .util import int_from_bytes
+
+# The following function is based on the BIP 327 reference implementation
+# https://github.com/bitcoin/bips/blob/master/bip-0327/reference.py
+
+
+# Return the plain public key corresponding to a given secret key
+def pubkey_gen_plain(seckey: bytes) -> bytes:
+ d0 = int_from_bytes(seckey)
+ if not (1 <= d0 <= GE.ORDER - 1):
+ raise ValueError("The secret key must be an integer in the range 1..n-1.")
+ P = d0 * G
+ assert not P.infinity
+ return P.to_bytes_compressed()
diff --git a/bip-0460/secp256k1lab/src/secp256k1lab/py.typed b/bip-0460/secp256k1lab/src/secp256k1lab/py.typed
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/bip-0460/secp256k1lab/src/secp256k1lab/secp256k1.py b/bip-0460/secp256k1lab/src/secp256k1lab/secp256k1.py
new file mode 100644
index 0000000000..0526878d91
--- /dev/null
+++ b/bip-0460/secp256k1lab/src/secp256k1lab/secp256k1.py
@@ -0,0 +1,483 @@
+# Copyright (c) 2022-2023 The Bitcoin Core developers
+# Distributed under the MIT software license, see the accompanying
+# file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+"""Test-only implementation of low-level secp256k1 field and group arithmetic
+
+It is designed for ease of understanding, not performance.
+
+WARNING: This code is slow and trivially vulnerable to side channel attacks. Do not use for
+anything but tests.
+
+Exports:
+* FE: class for secp256k1 field elements
+* GE: class for secp256k1 group elements
+* G: the secp256k1 generator point
+"""
+
+from __future__ import annotations
+from typing import Self
+
+# TODO Docstrings of methods still say "field element"
+class APrimeFE:
+ """Objects of this class represent elements of a prime field.
+
+ They are represented internally in numerator / denominator form, in order to delay inversions.
+ """
+
+ # The size of the field (also its modulus and characteristic).
+ SIZE: int
+
+ def __init__(self, a: int | Self = 0, b: int | Self = 1) -> None:
+ """Initialize a field element a/b; both a and b can be ints or field elements."""
+ if isinstance(a, type(self)):
+ num = a._num
+ den = a._den
+ else:
+ assert isinstance(a, int)
+ num = a % self.SIZE
+ den = 1
+ if isinstance(b, type(self)):
+ den = (den * b._num) % self.SIZE
+ num = (num * b._den) % self.SIZE
+ else:
+ assert isinstance(b, int)
+ den = (den * b) % self.SIZE
+ assert den != 0
+ if num == 0:
+ den = 1
+ self._num: int = num
+ self._den: int = den
+
+ def __add__(self, a: int | Self) -> Self:
+ """Compute the sum of two field elements (second may be int)."""
+ if isinstance(a, type(self)):
+ return type(self)(self._num * a._den + self._den * a._num, self._den * a._den)
+ if isinstance(a, int):
+ return type(self)(self._num + self._den * a, self._den)
+ return NotImplemented
+
+ def __radd__(self, a: int) -> Self:
+ """Compute the sum of an integer and a field element."""
+ return type(self)(a) + self
+
+ @classmethod
+ def sum(cls, *es: Self) -> Self:
+ """Compute the sum of field elements.
+
+ sum(a, b, c, ...) is identical to (0 + a + b + c + ...)."""
+ return sum(es, start=cls(0))
+
+ def __sub__(self, a: int | Self) -> Self:
+ """Compute the difference of two field elements (second may be int)."""
+ if isinstance(a, type(self)):
+ return type(self)(self._num * a._den - self._den * a._num, self._den * a._den)
+ if isinstance(a, int):
+ return type(self)(self._num - self._den * a, self._den)
+ return NotImplemented
+
+ def __rsub__(self, a: int) -> Self:
+ """Compute the difference of an integer and a field element."""
+ return type(self)(a) - self
+
+ def __mul__(self, a: int | Self) -> Self:
+ """Compute the product of two field elements (second may be int)."""
+ if isinstance(a, type(self)):
+ return type(self)(self._num * a._num, self._den * a._den)
+ if isinstance(a, int):
+ return type(self)(self._num * a, self._den)
+ return NotImplemented
+
+ def __rmul__(self, a: int) -> Self:
+ """Compute the product of an integer with a field element."""
+ return type(self)(a) * self
+
+ def __truediv__(self, a: int | Self) -> Self:
+ """Compute the ratio of two field elements (second may be int)."""
+ if isinstance(a, type(self)) or isinstance(a, int):
+ return type(self)(self, a)
+ return NotImplemented
+
+ def __pow__(self, a: int) -> Self:
+ """Raise a field element to an integer power."""
+ return type(self)(pow(self._num, a, self.SIZE), pow(self._den, a, self.SIZE))
+
+ def __neg__(self) -> Self:
+ """Negate a field element."""
+ return type(self)(-self._num, self._den)
+
+ def __int__(self) -> int:
+ """Convert a field element to an integer in range 0..SIZE-1. The result is cached."""
+ if self._den != 1:
+ self._num = (self._num * pow(self._den, -1, self.SIZE)) % self.SIZE
+ self._den = 1
+ return self._num
+
+ def sqrt(self) -> Self | None:
+ """Compute the square root of a field element if it exists (None otherwise)."""
+ raise NotImplementedError
+
+ def is_square(self) -> bool:
+ """Determine if this field element has a square root."""
+ # A more efficient algorithm is possible here (Jacobi symbol).
+ return self.sqrt() is not None
+
+ def is_even(self) -> bool:
+ """Determine whether this field element, represented as integer in 0..SIZE-1, is even."""
+ return int(self) & 1 == 0
+
+ def __eq__(self, a: object) -> bool:
+ """Check whether two field elements are equal (second may be an int)."""
+ if isinstance(a, type(self)):
+ return (self._num * a._den - self._den * a._num) % self.SIZE == 0
+ elif isinstance(a, int):
+ return (self._num - self._den * a) % self.SIZE == 0
+ return False # for other types
+
+ def to_bytes(self) -> bytes:
+ """Convert a field element to a 32-byte array (BE byte order)."""
+ return int(self).to_bytes(32, 'big')
+
+ @classmethod
+ def from_int_checked(cls, v: int) -> Self:
+ """Convert an integer to a field element (no overflow allowed)."""
+ if v >= cls.SIZE:
+ raise ValueError
+ return cls(v)
+
+ @classmethod
+ def from_int_wrapping(cls, v: int) -> Self:
+ """Convert an integer to a field element (reduced modulo SIZE)."""
+ return cls(v % cls.SIZE)
+
+ @classmethod
+ def from_bytes_checked(cls, b: bytes) -> Self:
+ """Convert a 32-byte array to a field element (BE byte order, no overflow allowed)."""
+ v = int.from_bytes(b, 'big')
+ return cls.from_int_checked(v)
+
+ @classmethod
+ def from_bytes_wrapping(cls, b: bytes) -> Self:
+ """Convert a 32-byte array to a field element (BE byte order, reduced modulo SIZE)."""
+ v = int.from_bytes(b, 'big')
+ return cls.from_int_wrapping(v)
+
+ def __str__(self) -> str:
+ """Convert this field element to a 64 character hex string."""
+ return f"{int(self):064x}"
+
+ def __repr__(self) -> str:
+ """Get a string representation of this field element."""
+ return f"{type(self).__qualname__}(0x{int(self):x})"
+
+
+class FE(APrimeFE):
+ SIZE = 2**256 - 2**32 - 977
+
+ def sqrt(self) -> Self | None:
+ # Due to the fact that our modulus p is of the form (p % 4) == 3, the Tonelli-Shanks
+ # algorithm (https://en.wikipedia.org/wiki/Tonelli-Shanks_algorithm) is simply
+ # raising the argument to the power (p + 1) / 4.
+
+ # To see why: (p-1) % 2 = 0, so 2 divides the order of the multiplicative group,
+ # and thus only half of the non-zero field elements are squares. An element a is
+ # a (nonzero) square when Euler's criterion, a^((p-1)/2) = 1 (mod p), holds. We're
+ # looking for x such that x^2 = a (mod p). Given a^((p-1)/2) = 1, that is equivalent
+ # to x^2 = a^(1 + (p-1)/2) mod p. As (1 + (p-1)/2) is even, this is equivalent to
+ # x = a^((1 + (p-1)/2)/2) mod p, or x = a^((p+1)/4) mod p.
+ v = int(self)
+ s = pow(v, (self.SIZE + 1) // 4, self.SIZE)
+ if s**2 % self.SIZE == v:
+ return type(self)(s)
+ return None
+
+
+class Scalar(APrimeFE):
+ """TODO Docstring"""
+ SIZE = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141
+
+ @classmethod
+ def from_int_nonzero_checked(cls, v: int) -> Self:
+ """Convert an integer to a scalar (no zero or overflow allowed)."""
+ if not (0 < v < cls.SIZE):
+ raise ValueError
+ return cls(v)
+
+ @classmethod
+ def from_bytes_nonzero_checked(cls, b: bytes) -> Self:
+ """Convert a 32-byte array to a scalar (BE byte order, no zero or overflow allowed)."""
+ v = int.from_bytes(b, 'big')
+ return cls.from_int_nonzero_checked(v)
+
+
+class GE:
+ """Objects of this class represent secp256k1 group elements (curve points or infinity)
+
+ GE objects are immutable.
+
+ Normal points on the curve have fields:
+ * x: the x coordinate (a field element)
+ * y: the y coordinate (a field element, satisfying y^2 = x^3 + 7)
+ * infinity: False
+
+ The point at infinity has field:
+ * infinity: True
+ """
+
+ # TODO The following two class attributes should probably be just getters as
+ # classmethods to enforce immutability. Unfortunately Python makes it hard
+ # to create "classproperties". `G` could then also be just a classmethod.
+
+ # Order of the group (number of points on the curve, plus 1 for infinity)
+ ORDER = Scalar.SIZE
+
+ # Number of valid distinct x coordinates on the curve.
+ ORDER_HALF = ORDER // 2
+
+ @property
+ def infinity(self) -> bool:
+ """Whether the group element is the point at infinity."""
+ return self._infinity
+
+ @property
+ def x(self) -> FE:
+ """The x coordinate (a field element) of a non-infinite group element."""
+ assert not self.infinity
+ return self._x
+
+ @property
+ def y(self) -> FE:
+ """The y coordinate (a field element) of a non-infinite group element."""
+ assert not self.infinity
+ return self._y
+
+ def __init__(self, x: int | FE | None = None, y: int | FE | None = None) -> None:
+ """Initialize a group element with specified x and y coordinates, or infinity."""
+ if x is None:
+ # Initialize as infinity.
+ assert y is None
+ self._infinity = True
+ else:
+ # Initialize as point on the curve (and check that it is).
+ assert x is not None
+ assert y is not None
+ fx = FE(x)
+ fy = FE(y)
+ assert fy**2 == fx**3 + 7
+ self._infinity = False
+ self._x = fx
+ self._y = fy
+
+ def __add__(self, a: GE) -> GE:
+ """Add two group elements together."""
+ # Deal with infinity: a + infinity == infinity + a == a.
+ if self.infinity:
+ return a
+ if a.infinity:
+ return self
+ if self.x == a.x:
+ if self.y != a.y:
+ # A point added to its own negation is infinity.
+ assert self.y + a.y == 0
+ return GE()
+ else:
+ # For identical inputs, use the tangent (doubling formula).
+ lam = (3 * self.x**2) / (2 * self.y)
+ else:
+ # For distinct inputs, use the line through both points (adding formula).
+ lam = (self.y - a.y) / (self.x - a.x)
+ # Determine point opposite to the intersection of that line with the curve.
+ x = lam**2 - (self.x + a.x)
+ y = lam * (self.x - x) - self.y
+ return GE(x, y)
+
+ @staticmethod
+ def sum(*ps: GE) -> GE:
+ """Compute the sum of group elements.
+
+ GE.sum(a, b, c, ...) is identical to (GE() + a + b + c + ...)."""
+ return sum(ps, start=GE())
+
+ @staticmethod
+ def batch_mul(*aps: tuple[Scalar, GE]) -> GE:
+ """Compute a (batch) scalar group element multiplication.
+
+ GE.batch_mul((a1, p1), (a2, p2), (a3, p3)) is identical to a1*p1 + a2*p2 + a3*p3,
+ but more efficient."""
+ # Reduce all the scalars modulo order first (so we can deal with negatives etc).
+ naps = [(int(a), p) for a, p in aps]
+ # Start with point at infinity.
+ r = GE()
+ # Iterate over all bit positions, from high to low.
+ for i in range(255, -1, -1):
+ # Double what we have so far.
+ r = r + r
+ # Add then add the points for which the corresponding scalar bit is set.
+ for (a, p) in naps:
+ if (a >> i) & 1:
+ r += p
+ return r
+
+ def __rmul__(self, a: int | Scalar) -> GE:
+ """Multiply an integer or scalar with a group element."""
+ if self == G:
+ return FAST_G.mul(Scalar(a))
+ return GE.batch_mul((Scalar(a), self))
+
+ def __neg__(self) -> GE:
+ """Compute the negation of a group element."""
+ if self.infinity:
+ return self
+ return GE(self.x, -self.y)
+
+ def __sub__(self, a: GE) -> GE:
+ """Subtract a group element from another."""
+ return self + (-a)
+
+ def __eq__(self, a: object) -> bool:
+ """Check if two group elements are equal."""
+ if not isinstance(a, type(self)):
+ return False
+ return (self - a).infinity
+
+ def has_even_y(self) -> bool:
+ """Determine whether a non-infinity group element has an even y coordinate."""
+ assert not self.infinity
+ return self.y.is_even()
+
+ def to_bytes_compressed(self) -> bytes:
+ """Convert a non-infinite group element to 33-byte compressed encoding."""
+ assert not self.infinity
+ return bytes([3 - self.y.is_even()]) + self.x.to_bytes()
+
+ def to_bytes_compressed_with_infinity(self) -> bytes:
+ """Convert a group element to 33-byte compressed encoding, mapping infinity to zeros."""
+ if self.infinity:
+ return 33 * b"\x00"
+ return self.to_bytes_compressed()
+
+ def to_bytes_uncompressed(self) -> bytes:
+ """Convert a non-infinite group element to 65-byte uncompressed encoding."""
+ assert not self.infinity
+ return b'\x04' + self.x.to_bytes() + self.y.to_bytes()
+
+ def to_bytes_xonly(self) -> bytes:
+ """Convert (the x coordinate of) a non-infinite group element to 32-byte xonly encoding."""
+ assert not self.infinity
+ return self.x.to_bytes()
+
+ @staticmethod
+ def lift_x(x: int | FE) -> GE:
+ """Return group element with specified field element as x coordinate (and even y)."""
+ y = (FE(x)**3 + 7).sqrt()
+ if y is None:
+ raise ValueError
+ if not y.is_even():
+ y = -y
+ return GE(x, y)
+
+ @staticmethod
+ def from_bytes_compressed(b: bytes) -> GE:
+ """Convert a compressed to a group element."""
+ assert len(b) == 33
+ if b[0] != 2 and b[0] != 3:
+ raise ValueError
+ x = FE.from_bytes_checked(b[1:])
+ r = GE.lift_x(x)
+ if b[0] == 3:
+ r = -r
+ return r
+
+ @staticmethod
+ def from_bytes_compressed_with_infinity(b: bytes) -> GE:
+ """Convert a compressed to a group element, mapping zeros to infinity."""
+ if b == 33 * b"\x00":
+ return GE()
+ else:
+ return GE.from_bytes_compressed(b)
+
+ @staticmethod
+ def from_bytes_uncompressed(b: bytes) -> GE:
+ """Convert an uncompressed to a group element."""
+ assert len(b) == 65
+ if b[0] != 4:
+ raise ValueError
+ x = FE.from_bytes_checked(b[1:33])
+ y = FE.from_bytes_checked(b[33:])
+ if y**2 != x**3 + 7:
+ raise ValueError
+ return GE(x, y)
+
+ @staticmethod
+ def from_bytes(b: bytes) -> GE:
+ """Convert a compressed or uncompressed encoding to a group element."""
+ assert len(b) in (33, 65)
+ if len(b) == 33:
+ return GE.from_bytes_compressed(b)
+ else:
+ return GE.from_bytes_uncompressed(b)
+
+ @staticmethod
+ def from_bytes_xonly(b: bytes) -> GE:
+ """Convert a point given in xonly encoding to a group element."""
+ assert len(b) == 32
+ x = FE.from_bytes_checked(b)
+ r = GE.lift_x(x)
+ return r
+
+ @staticmethod
+ def is_valid_x(x: int | FE) -> bool:
+ """Determine whether the provided field element is a valid X coordinate."""
+ return (FE(x)**3 + 7).is_square()
+
+ def __str__(self) -> str:
+ """Convert this group element to a string."""
+ if self.infinity:
+ return "(inf)"
+ return f"({self.x},{self.y})"
+
+ def __repr__(self) -> str:
+ """Get a string representation for this group element."""
+ if self.infinity:
+ return "GE()"
+ return f"GE(0x{int(self.x):x},0x{int(self.y):x})"
+
+ def __hash__(self) -> int:
+ """Compute a non-cryptographic hash of the group element."""
+ if self.infinity:
+ return 0 # 0 is not a valid x coordinate
+ return int(self.x)
+
+
+# The secp256k1 generator point
+G = GE.lift_x(0x79BE667EF9DCBBAC55A06295CE870B07029BFCDB2DCE28D959F2815B16F81798)
+
+
+class FastGEMul:
+ """Table for fast multiplication with a constant group element.
+
+ Speed up scalar multiplication with a fixed point P by using a precomputed lookup table with
+ its powers of 2:
+
+ table = [P, 2*P, 4*P, (2^3)*P, (2^4)*P, ..., (2^255)*P]
+
+ During multiplication, the points corresponding to each bit set in the scalar are added up,
+ i.e. on average ~128 point additions take place.
+ """
+
+ def __init__(self, p: GE) -> None:
+ self.table: list[GE] = [p] # table[i] = (2^i) * p
+ for _ in range(255):
+ p = p + p
+ self.table.append(p)
+
+ def mul(self, a: Scalar | int) -> GE:
+ result = GE()
+ a_ = int(a)
+ for bit in range(a_.bit_length()):
+ if a_ & (1 << bit):
+ result += self.table[bit]
+ return result
+
+# Precomputed table with multiples of G for fast multiplication
+FAST_G = FastGEMul(G)
diff --git a/bip-0460/secp256k1lab/src/secp256k1lab/util.py b/bip-0460/secp256k1lab/src/secp256k1lab/util.py
new file mode 100644
index 0000000000..d8c744b795
--- /dev/null
+++ b/bip-0460/secp256k1lab/src/secp256k1lab/util.py
@@ -0,0 +1,24 @@
+import hashlib
+
+
+# This implementation can be sped up by storing the midstate after hashing
+# tag_hash instead of rehashing it all the time.
+def tagged_hash(tag: str, msg: bytes) -> bytes:
+ tag_hash = hashlib.sha256(tag.encode()).digest()
+ return hashlib.sha256(tag_hash + tag_hash + msg).digest()
+
+
+def bytes_from_int(x: int) -> bytes:
+ return x.to_bytes(32, byteorder="big")
+
+
+def xor_bytes(b0: bytes, b1: bytes) -> bytes:
+ return bytes(x ^ y for (x, y) in zip(b0, b1))
+
+
+def int_from_bytes(b: bytes) -> int:
+ return int.from_bytes(b, byteorder="big")
+
+
+def hash_sha256(b: bytes) -> bytes:
+ return hashlib.sha256(b).digest()
diff --git a/bip-0460/secp256k1lab/test/__init__.py b/bip-0460/secp256k1lab/test/__init__.py
new file mode 100644
index 0000000000..862ed6e21c
--- /dev/null
+++ b/bip-0460/secp256k1lab/test/__init__.py
@@ -0,0 +1,5 @@
+from pathlib import Path
+import sys
+
+# Ensure secp256k1lab is found and can be imported directly
+sys.path.insert(0, str(Path(__file__).parent / "../src/"))
diff --git a/bip-0460/secp256k1lab/test/test_bip340.py b/bip-0460/secp256k1lab/test/test_bip340.py
new file mode 100644
index 0000000000..7fafad54bd
--- /dev/null
+++ b/bip-0460/secp256k1lab/test/test_bip340.py
@@ -0,0 +1,51 @@
+import csv
+from pathlib import Path
+from random import randbytes
+import unittest
+
+from secp256k1lab.bip340 import pubkey_gen, schnorr_sign, schnorr_verify
+
+
+class BIP340Tests(unittest.TestCase):
+ """Test schnorr signatures (BIP 340)."""
+
+ def test_correctness(self):
+ seckey = randbytes(32)
+ pubkey_xonly = pubkey_gen(seckey)
+ aux_rand = randbytes(32)
+ message = b'this is some arbitrary message'
+ signature = schnorr_sign(message, seckey, aux_rand)
+ success = schnorr_verify(message, pubkey_xonly, signature)
+ self.assertTrue(success)
+
+ def test_vectors(self):
+ # Test against vectors from the BIPs repository
+ # [https://github.com/bitcoin/bips/blob/master/bip-0340/test-vectors.csv]
+ vectors_file = Path(__file__).parent / "vectors" / "bip340.csv"
+ with open(vectors_file, encoding='utf8') as csvfile:
+ reader = csv.DictReader(csvfile)
+ for row in reader:
+ with self.subTest(i=int(row['index'])):
+ self.subtest_vectors_case(row)
+
+ def subtest_vectors_case(self, row):
+ seckey = bytes.fromhex(row['secret key'])
+ pubkey_xonly = bytes.fromhex(row['public key'])
+ aux_rand = bytes.fromhex(row['aux_rand'])
+ msg = bytes.fromhex(row['message'])
+ sig = bytes.fromhex(row['signature'])
+ result_str = row['verification result']
+ comment = row['comment']
+
+ result = result_str == 'TRUE'
+ assert result or result_str == 'FALSE'
+ if seckey != b'':
+ pubkey_xonly_actual = pubkey_gen(seckey)
+ self.assertEqual(pubkey_xonly.hex(), pubkey_xonly_actual.hex(), f"BIP340 test vector ({comment}): pubkey mismatch")
+ sig_actual = schnorr_sign(msg, seckey, aux_rand)
+ self.assertEqual(sig.hex(), sig_actual.hex(), f"BIP340 test vector ({comment}): sig mismatch")
+ result_actual = schnorr_verify(msg, pubkey_xonly, sig)
+ if result:
+ self.assertEqual(result, result_actual, f"BIP340 test vector ({comment}): verification failed unexpectedly")
+ else:
+ self.assertEqual(result, result_actual, f"BIP340 test vector ({comment}): verification succeeded unexpectedly")
diff --git a/bip-0460/secp256k1lab/test/test_ecdh.py b/bip-0460/secp256k1lab/test/test_ecdh.py
new file mode 100644
index 0000000000..63c9da7a1b
--- /dev/null
+++ b/bip-0460/secp256k1lab/test/test_ecdh.py
@@ -0,0 +1,18 @@
+from random import randbytes
+import unittest
+
+from secp256k1lab.ecdh import ecdh_libsecp256k1
+from secp256k1lab.keys import pubkey_gen_plain
+
+
+class ECDHTests(unittest.TestCase):
+ """Test ECDH module."""
+
+ def test_correctness(self):
+ seckey_alice = randbytes(32)
+ pubkey_alice = pubkey_gen_plain(seckey_alice)
+ seckey_bob = randbytes(32)
+ pubkey_bob = pubkey_gen_plain(seckey_bob)
+ shared_secret1 = ecdh_libsecp256k1(seckey_alice, pubkey_bob)
+ shared_secret2 = ecdh_libsecp256k1(seckey_bob, pubkey_alice)
+ self.assertEqual(shared_secret1, shared_secret2)
diff --git a/bip-0460/secp256k1lab/test/test_secp256k1.py b/bip-0460/secp256k1lab/test/test_secp256k1.py
new file mode 100644
index 0000000000..c6aee19a0a
--- /dev/null
+++ b/bip-0460/secp256k1lab/test/test_secp256k1.py
@@ -0,0 +1,180 @@
+"""Test low-level secp256k1 field and group arithmetic classes."""
+from random import randint
+import unittest
+
+from secp256k1lab.secp256k1 import FE, G, GE, Scalar
+
+
+class PrimeFieldTests(unittest.TestCase):
+ def test_fe_constructors(self):
+ P = FE.SIZE
+ random_fe_valid = randint(0, P-1)
+ random_fe_overflowing = randint(P, 2**256-1)
+
+ # wrapping constructors
+ for init_value in [0, P-1, P, P+1, random_fe_valid, random_fe_overflowing]:
+ fe1 = FE(init_value)
+ fe2 = FE.from_int_wrapping(init_value)
+ fe3 = FE.from_bytes_wrapping(init_value.to_bytes(32, 'big'))
+ reduced_value = init_value % P
+ self.assertEqual(int(fe1), reduced_value)
+ self.assertEqual(int(fe1), int(fe2))
+ self.assertEqual(int(fe2), int(fe3))
+
+ # checking constructors (should throw on overflow)
+ for valid_value in [0, P-1, random_fe_valid]:
+ fe1 = FE.from_int_checked(valid_value)
+ fe2 = FE.from_bytes_checked(valid_value.to_bytes(32, 'big'))
+ self.assertEqual(int(fe1), valid_value)
+ self.assertEqual(int(fe1), int(fe2))
+
+ for overflow_value in [P, P+1, random_fe_overflowing]:
+ with self.assertRaises(ValueError):
+ _ = FE.from_int_checked(overflow_value)
+ with self.assertRaises(ValueError):
+ _ = FE.from_bytes_checked(overflow_value.to_bytes(32, 'big'))
+
+ def test_scalar_constructors(self):
+ N = Scalar.SIZE
+ random_scalar_valid = randint(0, N-1)
+ random_scalar_overflowing = randint(N, 2**256-1)
+
+ # wrapping constructors
+ for init_value in [0, N-1, N, N+1, random_scalar_valid, random_scalar_overflowing]:
+ s1 = Scalar(init_value)
+ s2 = Scalar.from_int_wrapping(init_value)
+ s3 = Scalar.from_bytes_wrapping(init_value.to_bytes(32, 'big'))
+ reduced_value = init_value % N
+ self.assertEqual(int(s1), reduced_value)
+ self.assertEqual(int(s1), int(s2))
+ self.assertEqual(int(s2), int(s3))
+
+ # checking constructors (should throw on overflow)
+ for valid_value in [0, N-1, random_scalar_valid]:
+ s1 = Scalar.from_int_checked(valid_value)
+ s2 = Scalar.from_bytes_checked(valid_value.to_bytes(32, 'big'))
+ self.assertEqual(int(s1), valid_value)
+ self.assertEqual(int(s1), int(s2))
+
+ for overflow_value in [N, N+1, random_scalar_overflowing]:
+ with self.assertRaises(ValueError):
+ _ = Scalar.from_int_checked(overflow_value)
+ with self.assertRaises(ValueError):
+ _ = Scalar.from_bytes_checked(overflow_value.to_bytes(32, 'big'))
+
+ # non-zero checking constructors (should throw on zero or overflow, only for Scalar)
+ random_nonzero_scalar_valid = randint(1, N-1)
+ for valid_value in [1, N-1, random_nonzero_scalar_valid]:
+ s1 = Scalar.from_int_nonzero_checked(valid_value)
+ s2 = Scalar.from_bytes_nonzero_checked(valid_value.to_bytes(32, 'big'))
+ self.assertEqual(int(s1), valid_value)
+ self.assertEqual(int(s1), int(s2))
+
+ for invalid_value in [0, N, random_scalar_overflowing]:
+ with self.assertRaises(ValueError):
+ _ = Scalar.from_int_nonzero_checked(invalid_value)
+ with self.assertRaises(ValueError):
+ _ = Scalar.from_bytes_nonzero_checked(invalid_value.to_bytes(32, 'big'))
+
+
+class GeSerializationTests(unittest.TestCase):
+ @classmethod
+ def setUpClass(cls):
+ cls.point_at_infinity = GE()
+ cls.group_elements_on_curve = [
+ # generator point
+ G,
+ # Bitcoin genesis block public key
+ GE(0x678afdb0fe5548271967f1a67130b7105cd6a828e03909a67962e0ea1f61deb6,
+ 0x49f6bc3f4cef38c4f35504e51ec112de5c384df7ba0b8d578a4c702b6bf11d5f),
+ ]
+ # generate a few random points, to likely cover both even/odd y polarity
+ cls.group_elements_on_curve.extend([randint(1, Scalar.SIZE-1) * G for _ in range(8)])
+ # generate x coordinates that don't have a valid point on the curve
+ # (note that ~50% of all x coordinates are valid, so finding one needs two loop iterations on average)
+ cls.x_coords_not_on_curve = []
+ while len(cls.x_coords_not_on_curve) < 8:
+ x = randint(0, FE.SIZE-1)
+ if not GE.is_valid_x(x):
+ cls.x_coords_not_on_curve.append(x)
+
+ cls.group_elements = [cls.point_at_infinity] + cls.group_elements_on_curve
+
+ def test_infinity_raises(self):
+ with self.assertRaises(AssertionError):
+ _ = self.point_at_infinity.to_bytes_uncompressed()
+ with self.assertRaises(AssertionError):
+ _ = self.point_at_infinity.to_bytes_compressed()
+ with self.assertRaises(AssertionError):
+ _ = self.point_at_infinity.to_bytes_xonly()
+
+ def test_not_on_curve_raises(self):
+ # for compressed and x-only GE deserialization, test with invalid x coordinate
+ for x in self.x_coords_not_on_curve:
+ x_bytes = x.to_bytes(32, 'big')
+ with self.assertRaises(ValueError):
+ _ = GE.from_bytes_compressed(b'\x02' + x_bytes)
+ with self.assertRaises(ValueError):
+ _ = GE.from_bytes_compressed(b'\x03' + x_bytes)
+ with self.assertRaises(ValueError):
+ _ = GE.from_bytes_compressed_with_infinity(b'\x02' + x_bytes)
+ with self.assertRaises(ValueError):
+ _ = GE.from_bytes_compressed_with_infinity(b'\x03' + x_bytes)
+ with self.assertRaises(ValueError):
+ _ = GE.from_bytes_xonly(x_bytes)
+
+ # for uncompressed GE serialization, test by invalidating either coordinate
+ for ge in self.group_elements_on_curve:
+ valid_x = ge.x
+ valid_y = ge.y
+ invalid_x = ge.x + 1
+ invalid_y = ge.y + 1
+
+ # valid cases (if point (x,y) is on the curve, then point(x,-y) is on the curve as well)
+ _ = GE.from_bytes_uncompressed(b'\x04' + valid_x.to_bytes() + valid_y.to_bytes())
+ _ = GE.from_bytes_uncompressed(b'\x04' + valid_x.to_bytes() + (-valid_y).to_bytes())
+ # invalid cases (curve equation y**2 = x**3 + 7 doesn't hold)
+ self.assertNotEqual(invalid_y**2, valid_x**3 + 7)
+ with self.assertRaises(ValueError):
+ _ = GE.from_bytes_uncompressed(b'\x04' + valid_x.to_bytes() + invalid_y.to_bytes())
+ self.assertNotEqual(valid_y**2, invalid_x**3 + 7)
+ with self.assertRaises(ValueError):
+ _ = GE.from_bytes_uncompressed(b'\x04' + invalid_x.to_bytes() + valid_y.to_bytes())
+
+ def test_affine(self):
+ # GE serialization and parsing round-trip (variants that only support serializing points on the curve)
+ for ge_orig in self.group_elements_on_curve:
+ # uncompressed serialization: 65 bytes, starts with 0x04
+ ge_ser = ge_orig.to_bytes_uncompressed()
+ self.assertEqual(len(ge_ser), 65)
+ self.assertEqual(ge_ser[0], 0x04)
+ ge_deser = GE.from_bytes_uncompressed(ge_ser)
+ self.assertEqual(ge_deser, ge_orig)
+
+ # compressed serialization: 33 bytes, starts with 0x02 (if y is even) or 0x03 (if y is odd)
+ ge_ser = ge_orig.to_bytes_compressed()
+ self.assertEqual(len(ge_ser), 33)
+ self.assertEqual(ge_ser[0], 0x02 if ge_orig.has_even_y() else 0x03)
+ ge_deser = GE.from_bytes_compressed(ge_ser)
+ self.assertEqual(ge_deser, ge_orig)
+
+ # x-only serialization: 32 bytes
+ ge_ser = ge_orig.to_bytes_xonly()
+ self.assertEqual(len(ge_ser), 32)
+ ge_deser = GE.from_bytes_xonly(ge_ser)
+ if not ge_orig.has_even_y(): # x-only implies even y, so flip if necessary
+ ge_deser = -ge_deser
+ self.assertEqual(ge_deser, ge_orig)
+
+ def test_affine_with_infinity(self):
+ # GE serialization and parsing round-trip (variants that also support serializing the point at infinity)
+ for ge_orig in self.group_elements:
+ # compressed serialization: 33 bytes, all-zeros for point at infinity
+ ge_ser = ge_orig.to_bytes_compressed_with_infinity()
+ self.assertEqual(len(ge_ser), 33)
+ if ge_orig.infinity:
+ self.assertEqual(ge_ser, b'\x00'*33)
+ else:
+ self.assertEqual(ge_ser[0], 0x02 if ge_orig.has_even_y() else 0x03)
+ ge_deser = GE.from_bytes_compressed_with_infinity(ge_ser)
+ self.assertEqual(ge_deser, ge_orig)
diff --git a/bip-0460/secp256k1lab/test/vectors/bip340.csv b/bip-0460/secp256k1lab/test/vectors/bip340.csv
new file mode 100644
index 0000000000..aa317a3b3d
--- /dev/null
+++ b/bip-0460/secp256k1lab/test/vectors/bip340.csv
@@ -0,0 +1,20 @@
+index,secret key,public key,aux_rand,message,signature,verification result,comment
+0,0000000000000000000000000000000000000000000000000000000000000003,F9308A019258C31049344F85F89D5229B531C845836F99B08601F113BCE036F9,0000000000000000000000000000000000000000000000000000000000000000,0000000000000000000000000000000000000000000000000000000000000000,E907831F80848D1069A5371B402410364BDF1C5F8307B0084C55F1CE2DCA821525F66A4A85EA8B71E482A74F382D2CE5EBEEE8FDB2172F477DF4900D310536C0,TRUE,
+1,B7E151628AED2A6ABF7158809CF4F3C762E7160F38B4DA56A784D9045190CFEF,DFF1D77F2A671C5F36183726DB2341BE58FEAE1DA2DECED843240F7B502BA659,0000000000000000000000000000000000000000000000000000000000000001,243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89,6896BD60EEAE296DB48A229FF71DFE071BDE413E6D43F917DC8DCF8C78DE33418906D11AC976ABCCB20B091292BFF4EA897EFCB639EA871CFA95F6DE339E4B0A,TRUE,
+2,C90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B14E5C9,DD308AFEC5777E13121FA72B9CC1B7CC0139715309B086C960E18FD969774EB8,C87AA53824B4D7AE2EB035A2B5BBBCCC080E76CDC6D1692C4B0B62D798E6D906,7E2D58D8B3BCDF1ABADEC7829054F90DDA9805AAB56C77333024B9D0A508B75C,5831AAEED7B44BB74E5EAB94BA9D4294C49BCF2A60728D8B4C200F50DD313C1BAB745879A5AD954A72C45A91C3A51D3C7ADEA98D82F8481E0E1E03674A6F3FB7,TRUE,
+3,0B432B2677937381AEF05BB02A66ECD012773062CF3FA2549E44F58ED2401710,25D1DFF95105F5253C4022F628A996AD3A0D95FBF21D468A1B33F8C160D8F517,FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF,FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF,7EB0509757E246F19449885651611CB965ECC1A187DD51B64FDA1EDC9637D5EC97582B9CB13DB3933705B32BA982AF5AF25FD78881EBB32771FC5922EFC66EA3,TRUE,test fails if msg is reduced modulo p or n
+4,,D69C3509BB99E412E68B0FE8544E72837DFA30746D8BE2AA65975F29D22DC7B9,,4DF3C3F68FCC83B27E9D42C90431A72499F17875C81A599B566C9889B9696703,00000000000000000000003B78CE563F89A0ED9414F5AA28AD0D96D6795F9C6376AFB1548AF603B3EB45C9F8207DEE1060CB71C04E80F593060B07D28308D7F4,TRUE,
+5,,EEFDEA4CDB677750A420FEE807EACF21EB9898AE79B9768766E4FAA04A2D4A34,,243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89,6CFF5C3BA86C69EA4B7376F31A9BCB4F74C1976089B2D9963DA2E5543E17776969E89B4C5564D00349106B8497785DD7D1D713A8AE82B32FA79D5F7FC407D39B,FALSE,public key not on the curve
+6,,DFF1D77F2A671C5F36183726DB2341BE58FEAE1DA2DECED843240F7B502BA659,,243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89,FFF97BD5755EEEA420453A14355235D382F6472F8568A18B2F057A14602975563CC27944640AC607CD107AE10923D9EF7A73C643E166BE5EBEAFA34B1AC553E2,FALSE,has_even_y(R) is false
+7,,DFF1D77F2A671C5F36183726DB2341BE58FEAE1DA2DECED843240F7B502BA659,,243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89,1FA62E331EDBC21C394792D2AB1100A7B432B013DF3F6FF4F99FCB33E0E1515F28890B3EDB6E7189B630448B515CE4F8622A954CFE545735AAEA5134FCCDB2BD,FALSE,negated message
+8,,DFF1D77F2A671C5F36183726DB2341BE58FEAE1DA2DECED843240F7B502BA659,,243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89,6CFF5C3BA86C69EA4B7376F31A9BCB4F74C1976089B2D9963DA2E5543E177769961764B3AA9B2FFCB6EF947B6887A226E8D7C93E00C5ED0C1834FF0D0C2E6DA6,FALSE,negated s value
+9,,DFF1D77F2A671C5F36183726DB2341BE58FEAE1DA2DECED843240F7B502BA659,,243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89,0000000000000000000000000000000000000000000000000000000000000000123DDA8328AF9C23A94C1FEECFD123BA4FB73476F0D594DCB65C6425BD186051,FALSE,sG - eP is infinite. Test fails in single verification if has_even_y(inf) is defined as true and x(inf) as 0
+10,,DFF1D77F2A671C5F36183726DB2341BE58FEAE1DA2DECED843240F7B502BA659,,243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89,00000000000000000000000000000000000000000000000000000000000000017615FBAF5AE28864013C099742DEADB4DBA87F11AC6754F93780D5A1837CF197,FALSE,sG - eP is infinite. Test fails in single verification if has_even_y(inf) is defined as true and x(inf) as 1
+11,,DFF1D77F2A671C5F36183726DB2341BE58FEAE1DA2DECED843240F7B502BA659,,243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89,4A298DACAE57395A15D0795DDBFD1DCB564DA82B0F269BC70A74F8220429BA1D69E89B4C5564D00349106B8497785DD7D1D713A8AE82B32FA79D5F7FC407D39B,FALSE,sig[0:32] is not an X coordinate on the curve
+12,,DFF1D77F2A671C5F36183726DB2341BE58FEAE1DA2DECED843240F7B502BA659,,243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89,FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC2F69E89B4C5564D00349106B8497785DD7D1D713A8AE82B32FA79D5F7FC407D39B,FALSE,sig[0:32] is equal to field size
+13,,DFF1D77F2A671C5F36183726DB2341BE58FEAE1DA2DECED843240F7B502BA659,,243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89,6CFF5C3BA86C69EA4B7376F31A9BCB4F74C1976089B2D9963DA2E5543E177769FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141,FALSE,sig[32:64] is equal to curve order
+14,,FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEFFFFFC30,,243F6A8885A308D313198A2E03707344A4093822299F31D0082EFA98EC4E6C89,6CFF5C3BA86C69EA4B7376F31A9BCB4F74C1976089B2D9963DA2E5543E17776969E89B4C5564D00349106B8497785DD7D1D713A8AE82B32FA79D5F7FC407D39B,FALSE,public key is not a valid X coordinate because it exceeds the field size
+15,0340034003400340034003400340034003400340034003400340034003400340,778CAA53B4393AC467774D09497A87224BF9FAB6F6E68B23086497324D6FD117,0000000000000000000000000000000000000000000000000000000000000000,,71535DB165ECD9FBBC046E5FFAEA61186BB6AD436732FCCC25291A55895464CF6069CE26BF03466228F19A3A62DB8A649F2D560FAC652827D1AF0574E427AB63,TRUE,message of size 0 (added 2022-12)
+16,0340034003400340034003400340034003400340034003400340034003400340,778CAA53B4393AC467774D09497A87224BF9FAB6F6E68B23086497324D6FD117,0000000000000000000000000000000000000000000000000000000000000000,11,08A20A0AFEF64124649232E0693C583AB1B9934AE63B4C3511F3AE1134C6A303EA3173BFEA6683BD101FA5AA5DBC1996FE7CACFC5A577D33EC14564CEC2BACBF,TRUE,message of size 1 (added 2022-12)
+17,0340034003400340034003400340034003400340034003400340034003400340,778CAA53B4393AC467774D09497A87224BF9FAB6F6E68B23086497324D6FD117,0000000000000000000000000000000000000000000000000000000000000000,0102030405060708090A0B0C0D0E0F1011,5130F39A4059B43BC7CAC09A19ECE52B5D8699D1A71E3C52DA9AFDB6B50AC370C4A482B77BF960F8681540E25B6771ECE1E5A37FD80E5A51897C5566A97EA5A5,TRUE,message of size 17 (added 2022-12)
+18,0340034003400340034003400340034003400340034003400340034003400340,778CAA53B4393AC467774D09497A87224BF9FAB6F6E68B23086497324D6FD117,0000000000000000000000000000000000000000000000000000000000000000,99999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999,403B12B0D8555A344175EA7EC746566303321E5DBFA8BE6F091635163ECA79A8585ED3E3170807E7C03B720FC54C7B23897FCBA0E9D0B4A06894CFD249F22367,TRUE,message of size 100 (added 2022-12)
diff --git a/bip-0460/test-vectors.py b/bip-0460/test-vectors.py
new file mode 100644
index 0000000000..4602d5d99b
--- /dev/null
+++ b/bip-0460/test-vectors.py
@@ -0,0 +1,1452 @@
+#!/usr/bin/env python3
+"""
+Test vector generator for the CISA Taproot key path BIP (witness v2).
+
+Generates two files:
+ wallet-test-vectors.json scriptPubKey/address derivation, sighash
+ computation, and witness construction
+ consensus-test-vectors.json transaction level valid/invalid cases
+
+WARNING: All keys and nonces in this file are deterministic and publicly
+known. They exist only to make the vectors reproducible. Never use this
+code or these values in production.
+"""
+
+import hashlib
+import json
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).parent / "secp256k1lab/src"))
+sys.path.insert(0, str(Path(__file__).parent))
+
+from secp256k1lab.secp256k1 import G, GE, Scalar
+from secp256k1lab.bip340 import schnorr_sign, schnorr_verify
+from secp256k1lab.util import tagged_hash
+
+import halfagg
+import fullagg
+
+# Marker bytes
+MARKER_HALFAGG = 0xBC
+MARKER_FULLAGG = 0xBD
+
+# Sighash epoch for aggregated witness v2 signature messages
+SIGHASH_EPOCH = 0x01
+
+SIGHASH_DEFAULT = 0x00
+SIGHASH_ALL = 0x01
+SIGHASH_NONE = 0x02
+SIGHASH_SINGLE = 0x03
+SIGHASH_ANYONECANPAY = 0x80
+
+AUX_ZERO = bytes(32)
+
+
+# ---------------------------------------------------------------------------
+# Serialization helpers
+# ---------------------------------------------------------------------------
+
+def sha256(b):
+ return hashlib.sha256(b).digest()
+
+
+def ser_compact_size(n):
+ if n < 253:
+ return bytes([n])
+ if n < 0x10000:
+ return b"\xfd" + n.to_bytes(2, "little")
+ if n < 0x100000000:
+ return b"\xfe" + n.to_bytes(4, "little")
+ return b"\xff" + n.to_bytes(8, "little")
+
+
+class TxIn:
+ def __init__(self, txid, vout, sequence=0xFFFFFFFF):
+ self.txid = txid # 32 bytes, internal byte order
+ self.vout = vout
+ self.sequence = sequence
+
+ def outpoint(self):
+ return self.txid + self.vout.to_bytes(4, "little")
+
+
+class TxOut:
+ def __init__(self, amount, script_pubkey):
+ self.amount = amount
+ self.script_pubkey = script_pubkey
+
+ def serialize(self):
+ return self.amount.to_bytes(8, "little") + ser_compact_size(
+ len(self.script_pubkey)
+ ) + self.script_pubkey
+
+
+class Tx:
+ def __init__(self, vin, vout, version=2, locktime=0):
+ self.version = version
+ self.locktime = locktime
+ self.vin = vin
+ self.vout = vout
+ self.witnesses = [[] for _ in vin]
+
+ def serialize_unsigned(self):
+ out = self.version.to_bytes(4, "little")
+ out += ser_compact_size(len(self.vin))
+ for txin in self.vin:
+ out += txin.outpoint() + b"\x00" + txin.sequence.to_bytes(4, "little")
+ out += ser_compact_size(len(self.vout))
+ for txout in self.vout:
+ out += txout.serialize()
+ out += self.locktime.to_bytes(4, "little")
+ return out
+
+ def serialize_signed(self):
+ out = self.version.to_bytes(4, "little")
+ out += b"\x00\x01"
+ out += ser_compact_size(len(self.vin))
+ for txin in self.vin:
+ out += txin.outpoint() + b"\x00" + txin.sequence.to_bytes(4, "little")
+ out += ser_compact_size(len(self.vout))
+ for txout in self.vout:
+ out += txout.serialize()
+ for witness in self.witnesses:
+ out += ser_compact_size(len(witness))
+ for element in witness:
+ out += ser_compact_size(len(element)) + element
+ out += self.locktime.to_bytes(4, "little")
+ return out
+
+
+# ---------------------------------------------------------------------------
+# Taproot style key derivation
+# ---------------------------------------------------------------------------
+
+def tweak_keypair(seckey32):
+ d0 = Scalar.from_bytes_checked(seckey32)
+ P = d0 * G
+ d = d0 if P.has_even_y() else -d0
+ internal_pubkey = P.to_bytes_xonly()
+ t = Scalar.from_bytes_checked(tagged_hash("TapTweak", internal_pubkey))
+ Q = (d + t) * G
+ tweaked_seckey = (d + t).to_bytes()
+ return internal_pubkey, t.to_bytes(), tweaked_seckey, Q.to_bytes_xonly()
+
+
+def v2_script_pubkey(output_key32):
+ return bytes([0x52, 0x20]) + output_key32
+
+
+# ---------------------------------------------------------------------------
+# Bech32m (adapted from the BIP 350 reference implementation)
+# ---------------------------------------------------------------------------
+
+CHARSET = "qpzry9x8gf2tvdw0s3jn54khce6mua7l"
+BECH32M_CONST = 0x2BC830A3
+
+
+def bech32_polymod(values):
+ generator = [0x3B6A57B2, 0x26508E6D, 0x1EA119FA, 0x3D4233DD, 0x2A1462B3]
+ chk = 1
+ for value in values:
+ top = chk >> 25
+ chk = (chk & 0x1FFFFFF) << 5 ^ value
+ for i in range(5):
+ chk ^= generator[i] if ((top >> i) & 1) else 0
+ return chk
+
+
+def bech32_hrp_expand(hrp):
+ return [ord(x) >> 5 for x in hrp] + [0] + [ord(x) & 31 for x in hrp]
+
+
+def bech32m_create_checksum(hrp, data):
+ values = bech32_hrp_expand(hrp) + data
+ polymod = bech32_polymod(values + [0, 0, 0, 0, 0, 0]) ^ BECH32M_CONST
+ return [(polymod >> 5 * (5 - i)) & 31 for i in range(6)]
+
+
+def convertbits(data, frombits, tobits, pad=True):
+ acc = 0
+ bits = 0
+ ret = []
+ maxv = (1 << tobits) - 1
+ for value in data:
+ acc = (acc << frombits) | value
+ bits += frombits
+ while bits >= tobits:
+ bits -= tobits
+ ret.append((acc >> bits) & maxv)
+ if pad and bits:
+ ret.append((acc << (tobits - bits)) & maxv)
+ return ret
+
+
+def v2_address(output_key32, hrp="bc"):
+ data = [2] + convertbits(output_key32, 8, 5)
+ combined = data + bech32m_create_checksum(hrp, data)
+ return hrp + "1" + "".join([CHARSET[d] for d in combined])
+
+
+# ---------------------------------------------------------------------------
+# Witness v2 common signature message
+# ---------------------------------------------------------------------------
+
+def sigmsg_common(tx, spent_utxos, input_index, hash_type, ext_flag, annex=None):
+ """Compute SigMsg(hash_type, ext_flag) as defined in BIP 341."""
+ assert len(spent_utxos) == len(tx.vin)
+ anyonecanpay = bool(hash_type & SIGHASH_ANYONECANPAY)
+ base_type = hash_type & 3
+
+ msg = bytes([hash_type])
+ msg += tx.version.to_bytes(4, "little")
+ msg += tx.locktime.to_bytes(4, "little")
+ if not anyonecanpay:
+ msg += sha256(b"".join(txin.outpoint() for txin in tx.vin))
+ msg += sha256(b"".join(u.amount.to_bytes(8, "little") for u in spent_utxos))
+ msg += sha256(
+ b"".join(
+ ser_compact_size(len(u.script_pubkey)) + u.script_pubkey
+ for u in spent_utxos
+ )
+ )
+ msg += sha256(
+ b"".join(txin.sequence.to_bytes(4, "little") for txin in tx.vin)
+ )
+ if base_type not in (SIGHASH_NONE, SIGHASH_SINGLE):
+ msg += sha256(b"".join(txout.serialize() for txout in tx.vout))
+ spend_type = 2 * ext_flag + (1 if annex is not None else 0)
+ msg += bytes([spend_type])
+ if anyonecanpay:
+ txin = tx.vin[input_index]
+ utxo = spent_utxos[input_index]
+ msg += txin.outpoint()
+ msg += utxo.amount.to_bytes(8, "little")
+ msg += ser_compact_size(len(utxo.script_pubkey)) + utxo.script_pubkey
+ msg += txin.sequence.to_bytes(4, "little")
+ else:
+ msg += input_index.to_bytes(4, "little")
+ if annex is not None:
+ msg += sha256(ser_compact_size(len(annex)) + annex)
+ if base_type == SIGHASH_SINGLE:
+ msg += sha256(tx.vout[input_index].serialize())
+ return msg
+
+
+def sigmsg_v2(tx, spent_utxos, input_index, hash_type, agg_mode, annex=None):
+ """Compute hash_TapSighash(0x01 || agg_mode || SigMsg(hash_type, 0))."""
+ msg = sigmsg_common(tx, spent_utxos, input_index, hash_type, 0, annex)
+ return tagged_hash("TapSighash", bytes([SIGHASH_EPOCH, agg_mode]) + msg)
+
+
+def sigmsg_tapscript(tx, spent_utxos, input_index, hash_type, tapleaf_hash,
+ annex=None):
+ """Compute the unchanged BIP 342 tapscript signature message,
+ hash_TapSighash(0x00 || SigMsg(hash_type, 1) || ext)."""
+ msg = sigmsg_common(tx, spent_utxos, input_index, hash_type, 1, annex)
+ ext = tapleaf_hash + b"\x00" + b"\xff\xff\xff\xff"
+ return tagged_hash("TapSighash", bytes([0x00]) + msg + ext)
+
+
+def sigmsg_v1(tx, spent_utxos, input_index, hash_type, annex=None):
+ """Compute the unchanged BIP 341 key path signature message,
+ hash_TapSighash(0x00 || SigMsg(hash_type, 0))."""
+ msg = sigmsg_common(tx, spent_utxos, input_index, hash_type, 0, annex)
+ return tagged_hash("TapSighash", bytes([0x00]) + msg)
+
+
+# ---------------------------------------------------------------------------
+# Witness element construction
+# ---------------------------------------------------------------------------
+
+def marker_element(marker, hash_type=SIGHASH_DEFAULT, sig=b""):
+ element = sig
+ if hash_type != SIGHASH_DEFAULT:
+ element += bytes([hash_type])
+ return element + bytes([marker])
+
+
+def optout_element(sig, hash_type=SIGHASH_DEFAULT):
+ if hash_type == SIGHASH_DEFAULT:
+ return sig
+ return sig + bytes([hash_type])
+
+
+def halfagg_member(nonce_share, hash_type=SIGHASH_DEFAULT):
+ if hash_type == SIGHASH_DEFAULT:
+ return nonce_share
+ return nonce_share + bytes([hash_type])
+
+
+def fullagg_member(hash_type=SIGHASH_DEFAULT):
+ if hash_type == SIGHASH_DEFAULT:
+ return b""
+ return bytes([hash_type])
+
+
+def halfagg_final(aggsig, hash_type=SIGHASH_DEFAULT):
+ return marker_element(MARKER_HALFAGG, hash_type, aggsig[-64:])
+
+
+# ---------------------------------------------------------------------------
+# Deterministic test data
+# ---------------------------------------------------------------------------
+
+def test_seckey(i):
+ return tagged_hash("CISA/test/key", bytes([i]))
+
+
+def test_prevout_txid(i):
+ return sha256(b"CISA vector prevout " + bytes([i]))
+
+
+def test_fullagg_secnonce(i):
+ # Test-only deterministic nonces. Nonces must be fresh uniform
+ # randomness in any real signing session.
+ r1 = Scalar.from_bytes_wrapping(tagged_hash("CISA/test/nonce", bytes([i, 0])))
+ r2 = Scalar.from_bytes_wrapping(tagged_hash("CISA/test/nonce", bytes([i, 1])))
+ return (r1, r2), (r1 * G, r2 * G)
+
+
+def test_garbage(label, length=32):
+ out = b""
+ i = 0
+ while len(out) < length:
+ out += tagged_hash("CISA/test/garbage", label + bytes([i]))
+ i += 1
+ return out[:length]
+
+
+def test_offcurve_x(label):
+ # Deterministically find 32 bytes that are not a valid x coordinate.
+ i = 0
+ while True:
+ cand = tagged_hash("CISA/test/offcurve", label + bytes([i]))
+ try:
+ GE.from_bytes_xonly(cand)
+ except ValueError:
+ return cand
+ i += 1
+
+
+# ---------------------------------------------------------------------------
+# Signing helpers
+# ---------------------------------------------------------------------------
+
+def sign_optout(tx, utxos, idx, tweaked_seckey, hash_type):
+ m = sigmsg_v1(tx, utxos, idx, hash_type)
+ sig = schnorr_sign(m, tweaked_seckey, AUX_ZERO)
+ return m, sig
+
+
+def sign_halfagg_group(tx, utxos, members):
+ """members: list of (input_index, tweaked_seckey, hash_type).
+ Returns (msgs, plain_sigs, aggsig)."""
+ triples = []
+ msgs = []
+ for idx, sk, ht in members:
+ m = sigmsg_v2(tx, utxos, idx, ht, MARKER_HALFAGG)
+ sig = schnorr_sign(m, sk, AUX_ZERO)
+ pk = utxos[idx].script_pubkey[2:]
+ triples.append((pk, m, sig))
+ msgs.append(m)
+ aggsig = halfagg.Aggregate(triples)
+ assert halfagg.VerifyAggregate(aggsig, [(pk, m) for pk, m, _ in triples])
+ return msgs, [t[2] for t in triples], aggsig
+
+
+def sign_fullagg_group(tx, utxos, members, msg_mode=MARKER_FULLAGG,
+ nonce_offset=0, annexes=None):
+ """members: list of (input_index, tweaked_seckey, hash_type).
+ msg_mode overrides the marker committed in the signature messages,
+ with None selecting the plain BIP 341 message, used by negative
+ vectors exercising the mode commitment.
+ nonce_offset varies the deterministic test nonces between sessions.
+ annexes optionally maps input indices to their annex.
+ Returns (msgs, secnonces, pubnonces, sig64)."""
+ pks = []
+ msgs = []
+ secnonces = []
+ pubnonces = []
+ for i, (idx, sk, ht) in enumerate(members):
+ annex = annexes.get(idx) if annexes else None
+ if msg_mode is None:
+ m = sigmsg_v1(tx, utxos, idx, ht, annex=annex)
+ else:
+ m = sigmsg_v2(tx, utxos, idx, ht, msg_mode, annex=annex)
+ msgs.append(m)
+ pks.append(GE.from_bytes_xonly(utxos[idx].script_pubkey[2:]))
+ secnonce, pubnonce = test_fullagg_secnonce(i + nonce_offset)
+ secnonces.append(secnonce)
+ pubnonces.append(pubnonce)
+ aggnonce = fullagg.NonceAgg(pubnonces)
+ psigs = []
+ for i, (idx, sk, ht) in enumerate(members):
+ d = Scalar.from_bytes_checked(sk)
+ psig = fullagg.Sign(secnonces[i], d, msgs[i], aggnonce, pks, msgs, pubnonces)
+ psigs.append(psig)
+ R, s = fullagg.SigAgg(aggnonce, pks, msgs, pubnonces, psigs)
+ assert fullagg.Verify(pks, msgs, (R, s))
+ sig64 = R.to_bytes_xonly() + s.to_bytes()
+ return msgs, secnonces, pubnonces, sig64
+
+
+# ---------------------------------------------------------------------------
+# Vector construction
+# ---------------------------------------------------------------------------
+
+def hexlify(b):
+ return b.hex()
+
+
+def make_wallet_vectors():
+ vectors = {"scriptPubKey": [], "keyPathSpending": []}
+
+ # scriptPubKey and address derivation
+ for i in range(2):
+ seckey = test_seckey(i)
+ internal_pubkey, tweak, tweaked_seckey, output_key = tweak_keypair(seckey)
+ spk = v2_script_pubkey(output_key)
+ vectors["scriptPubKey"].append(
+ {
+ "given": {"internalPubkey": hexlify(internal_pubkey)},
+ "intermediary": {
+ "tweak": hexlify(tweak),
+ "tweakedPubkey": hexlify(output_key),
+ },
+ "expected": {
+ "scriptPubKey": hexlify(spk),
+ "address": v2_address(output_key),
+ },
+ }
+ )
+
+ # Case 1: opted-out input plus a two-member half-aggregation group
+ keys = [tweak_keypair(test_seckey(i)) for i in range(3)]
+ utxos = [
+ TxOut(100_000_000 + i * 1_000_000, v2_script_pubkey(k[3]))
+ for i, k in enumerate(keys)
+ ]
+ tx = Tx(
+ vin=[TxIn(test_prevout_txid(i), 0) for i in range(3)],
+ vout=[TxOut(299_000_000, v2_script_pubkey(keys[0][3]))],
+ )
+ m0, sig0 = sign_optout(tx, utxos, 0, keys[0][2], SIGHASH_ALL)
+ msgs, sigs, aggsig = sign_halfagg_group(
+ tx, utxos, [(1, keys[1][2], SIGHASH_DEFAULT), (2, keys[2][2], SIGHASH_DEFAULT)]
+ )
+ tx.witnesses[0] = [optout_element(sig0, SIGHASH_ALL)]
+ tx.witnesses[1] = [halfagg_member(sigs[0][:32])]
+ tx.witnesses[2] = [halfagg_final(aggsig)]
+
+ case1 = {
+ "description": "Opted-out input with SIGHASH_ALL alongside a "
+ "two-member half-aggregation group with SIGHASH_DEFAULT",
+ "given": {
+ "rawUnsignedTx": hexlify(tx.serialize_unsigned()),
+ "utxosSpent": [
+ {"scriptPubKey": hexlify(u.script_pubkey), "amountSats": u.amount}
+ for u in utxos
+ ],
+ },
+ "inputSpending": [],
+ "auxiliary": {"aggregateSignature": hexlify(aggsig)},
+ "expected": {"rawSignedTx": hexlify(tx.serialize_signed())},
+ }
+ input_data = [
+ (0, None, SIGHASH_ALL, m0),
+ (1, MARKER_HALFAGG, SIGHASH_DEFAULT, msgs[0]),
+ (2, MARKER_HALFAGG, SIGHASH_DEFAULT, msgs[1]),
+ ]
+ for idx, marker, ht, m in input_data:
+ case1["inputSpending"].append(
+ {
+ "given": {
+ "txinIndex": idx,
+ "internalPrivkey": hexlify(test_seckey(idx)),
+ "aggMode": None if marker is None else f"0x{marker:02x}",
+ "hashType": ht,
+ },
+ "intermediary": {
+ "internalPubkey": hexlify(keys[idx][0]),
+ "tweak": hexlify(keys[idx][1]),
+ "tweakedPrivkey": hexlify(keys[idx][2]),
+ "sigHash": hexlify(m),
+ },
+ "expected": {"witness": [hexlify(e) for e in tx.witnesses[idx]]},
+ }
+ )
+ vectors["keyPathSpending"].append(case1)
+
+ # Case 2: two-member full-aggregation group
+ keys = [tweak_keypair(test_seckey(i + 3)) for i in range(2)]
+ utxos = [
+ TxOut(50_000_000, v2_script_pubkey(keys[0][3])),
+ TxOut(70_000_000, v2_script_pubkey(keys[1][3])),
+ ]
+ tx = Tx(
+ vin=[TxIn(test_prevout_txid(i + 3), 1) for i in range(2)],
+ vout=[TxOut(119_000_000, v2_script_pubkey(keys[0][3]))],
+ )
+ msgs, secnonces, pubnonces, sig64 = sign_fullagg_group(
+ tx, utxos, [(0, keys[0][2], SIGHASH_ALL), (1, keys[1][2], SIGHASH_ALL)]
+ )
+ tx.witnesses[0] = [fullagg_member(SIGHASH_ALL)]
+ tx.witnesses[1] = [marker_element(MARKER_FULLAGG, SIGHASH_ALL, sig64)]
+
+ case2 = {
+ "description": "Two-member full-aggregation group with SIGHASH_ALL "
+ "(using deterministic nonces)",
+ "given": {
+ "rawUnsignedTx": hexlify(tx.serialize_unsigned()),
+ "utxosSpent": [
+ {"scriptPubKey": hexlify(u.script_pubkey), "amountSats": u.amount}
+ for u in utxos
+ ],
+ },
+ "inputSpending": [],
+ "auxiliary": {
+ "secnonces": [
+ hexlify(r1.to_bytes() + r2.to_bytes()) for r1, r2 in secnonces
+ ],
+ "pubnonces": [
+ hexlify(R1.to_bytes_compressed() + R2.to_bytes_compressed())
+ for R1, R2 in pubnonces
+ ],
+ "aggregateSignature": hexlify(sig64),
+ },
+ "expected": {"rawSignedTx": hexlify(tx.serialize_signed())},
+ }
+ for idx in range(2):
+ case2["inputSpending"].append(
+ {
+ "given": {
+ "txinIndex": idx,
+ "internalPrivkey": hexlify(test_seckey(idx + 3)),
+ "aggMode": f"0x{MARKER_FULLAGG:02x}",
+ "hashType": SIGHASH_ALL,
+ },
+ "intermediary": {
+ "internalPubkey": hexlify(keys[idx][0]),
+ "tweak": hexlify(keys[idx][1]),
+ "tweakedPrivkey": hexlify(keys[idx][2]),
+ "sigHash": hexlify(msgs[idx]),
+ },
+ "expected": {"witness": [hexlify(e) for e in tx.witnesses[idx]]},
+ }
+ )
+ vectors["keyPathSpending"].append(case2)
+
+ # Case 3: script path spend of a witness v2 output (BIP 341/342 rules
+ # unchanged). Same leaf and keys as the consensus scriptpath-valid
+ # case, so the two files cross-check.
+ script_seckey = test_seckey(20)
+ script_pk = (Scalar.from_bytes_checked(script_seckey) * G).to_bytes_xonly()
+ script = bytes([0x20]) + script_pk + bytes([0xAC]) # OP_CHECKSIG
+ tapleaf_hash = tagged_hash(
+ "TapLeaf", bytes([0xC0]) + ser_compact_size(len(script)) + script
+ )
+ internal_seckey = test_seckey(21)
+ internal_x = (Scalar.from_bytes_checked(internal_seckey) * G).to_bytes_xonly()
+ t = Scalar.from_bytes_checked(tagged_hash("TapTweak", internal_x + tapleaf_hash))
+ Q = GE.from_bytes_xonly(internal_x) + t * G
+ control = bytes([0xC0 | (0 if Q.has_even_y() else 1)]) + internal_x
+ spk = v2_script_pubkey(Q.to_bytes_xonly())
+ utxos = [TxOut(100_000_000, spk)]
+ dest_key = tweak_keypair(test_seckey(0))[3]
+ tx = Tx(
+ vin=[TxIn(test_prevout_txid(33), 0)],
+ vout=[TxOut(99_000_000, v2_script_pubkey(dest_key))],
+ )
+ m_script = sigmsg_tapscript(tx, utxos, 0, SIGHASH_DEFAULT, tapleaf_hash)
+ sig_script = schnorr_sign(m_script, script_seckey, AUX_ZERO)
+ assert schnorr_verify(m_script, script_pk, sig_script)
+ tx.witnesses[0] = [sig_script, script, control]
+
+ vectors["scriptPathSpending"] = [
+ {
+ "description": "Script path spend of a witness v2 output with a "
+ "single CHECKSIG leaf, following BIP 341/342 unchanged",
+ "given": {
+ "rawUnsignedTx": hexlify(tx.serialize_unsigned()),
+ "utxosSpent": [
+ {"scriptPubKey": hexlify(u.script_pubkey),
+ "amountSats": u.amount}
+ for u in utxos
+ ],
+ "internalPubkey": hexlify(internal_x),
+ "script": hexlify(script),
+ "leafVersion": "0xc0",
+ "hashType": SIGHASH_DEFAULT,
+ },
+ "intermediary": {
+ "leafHash": hexlify(tapleaf_hash),
+ "tweak": hexlify(t.to_bytes()),
+ "tweakedPubkey": hexlify(Q.to_bytes_xonly()),
+ "controlBlock": hexlify(control),
+ "sigHash": hexlify(m_script),
+ },
+ "expected": {
+ "scriptPubKey": hexlify(spk),
+ "address": v2_address(Q.to_bytes_xonly()),
+ "witness": [hexlify(e) for e in tx.witnesses[0]],
+ "rawSignedTx": hexlify(tx.serialize_signed()),
+ },
+ }
+ ]
+
+ return vectors
+
+
+def make_consensus_vectors():
+ cases = []
+
+ def add_case(case_id, description, tx, utxos, valid, failure_reason=None):
+ case = {
+ "id": case_id,
+ "description": description,
+ "prevouts": [
+ {"scriptPubKey": hexlify(u.script_pubkey), "amountSats": u.amount}
+ for u in utxos
+ ],
+ "tx": hexlify(tx.serialize_signed()),
+ "valid": valid,
+ }
+ if failure_reason is not None:
+ case["failureReason"] = failure_reason
+ cases.append(case)
+
+ def fresh_setup(num_inputs, key_offset=0):
+ keys = [tweak_keypair(test_seckey(i + key_offset)) for i in range(num_inputs)]
+ utxos = [
+ TxOut(100_000_000, v2_script_pubkey(k[3])) for k in keys
+ ]
+ tx = Tx(
+ vin=[TxIn(test_prevout_txid(i + key_offset), 0) for i in range(num_inputs)],
+ vout=[TxOut(num_inputs * 100_000_000 - 1_000_000,
+ v2_script_pubkey(keys[0][3]))],
+ )
+ return keys, utxos, tx
+
+ # 1: valid two-member half-aggregation group with explicit sighash
+ # forms
+ keys, utxos, tx = fresh_setup(2)
+ _, sigs1, aggsig = sign_halfagg_group(
+ tx, utxos, [(0, keys[0][2], SIGHASH_ALL), (1, keys[1][2], SIGHASH_ALL)]
+ )
+ tx.witnesses[0] = [halfagg_member(sigs1[0][:32], SIGHASH_ALL)]
+ tx.witnesses[1] = [halfagg_final(aggsig, SIGHASH_ALL)]
+ add_case("halfagg-valid", "Two-member half-aggregation group, SIGHASH_ALL",
+ tx, utxos, True)
+
+ # 2: valid two-member full-aggregation group
+ keys, utxos, tx = fresh_setup(2, key_offset=3)
+ _, _, _, sig64 = sign_fullagg_group(
+ tx, utxos, [(0, keys[0][2], SIGHASH_ALL), (1, keys[1][2], SIGHASH_ALL)]
+ )
+ tx.witnesses[0] = [fullagg_member(SIGHASH_ALL)]
+ tx.witnesses[1] = [marker_element(MARKER_FULLAGG, SIGHASH_ALL, sig64)]
+ add_case("fullagg-valid", "Two-member full-aggregation group, SIGHASH_ALL",
+ tx, utxos, True)
+ fullagg_base = (keys, utxos, tx, sig64)
+
+ # 3: valid mix of opted-out input and half-aggregation group
+ keys, utxos, tx = fresh_setup(3, key_offset=6)
+ _, sig0 = sign_optout(tx, utxos, 0, keys[0][2], SIGHASH_DEFAULT)
+ _, sigs3, aggsig3 = sign_halfagg_group(
+ tx, utxos, [(1, keys[1][2], SIGHASH_DEFAULT), (2, keys[2][2], SIGHASH_DEFAULT)]
+ )
+ tx.witnesses[0] = [optout_element(sig0)]
+ tx.witnesses[1] = [halfagg_member(sigs3[0][:32])]
+ tx.witnesses[2] = [halfagg_final(aggsig3)]
+ add_case("mixed-valid",
+ "Opted-out input alongside a two-member half-aggregation group",
+ tx, utxos, True)
+
+ # 4: invalid, undefined marker byte
+ keys, utxos, tx = fresh_setup(3, key_offset=6)
+ tx.witnesses[0] = [sig0 + bytes([0xBB])]
+ tx.witnesses[1] = [halfagg_member(sigs3[0][:32])]
+ tx.witnesses[2] = [halfagg_final(aggsig3)]
+ add_case("marker-undefined", "65-byte witness element ending in the "
+ "undefined marker value 0xbb", tx, utxos, False,
+ "undefined marker byte")
+
+ # 5: invalid, explicit 0x00 sighash byte on a group member
+ keys, utxos, tx = fresh_setup(3, key_offset=6)
+ tx.witnesses[0] = [optout_element(sig0)]
+ tx.witnesses[1] = [sigs3[0][:32] + bytes([0x00])]
+ tx.witnesses[2] = [halfagg_final(aggsig3)]
+ add_case("member-explicit-default", "Half-aggregation member encodes "
+ "SIGHASH_DEFAULT explicitly as a 0x00 sighash byte",
+ tx, utxos, False, "explicit 0x00 sighash byte")
+
+ # 6: invalid, aggregation group without a final input
+ keys, utxos, tx = fresh_setup(2)
+ tx.witnesses[0] = [halfagg_member(sigs1[0][:32])]
+ tx.witnesses[1] = [halfagg_member(sigs1[1][:32])]
+ add_case("group-no-final", "Half-aggregation members without an input "
+ "carrying the marker and the s value", tx, utxos, False,
+ "aggregation group has no final input")
+
+ # 7: invalid, member after the group final
+ keys, utxos, tx = fresh_setup(3, key_offset=9)
+ _, sigs7, aggsig7 = sign_halfagg_group(
+ tx, utxos, [(0, keys[0][2], SIGHASH_DEFAULT), (1, keys[1][2], SIGHASH_DEFAULT)]
+ )
+ tx.witnesses[0] = [halfagg_member(sigs7[0][:32])]
+ tx.witnesses[1] = [halfagg_final(aggsig7)]
+ tx.witnesses[2] = [halfagg_member(sigs7[1][:32])]
+ add_case("member-after-final", "Half-aggregation member appears after "
+ "the group's final input", tx, utxos, False,
+ "member after group final")
+
+ # 8: invalid, 2-byte element. No defined form has two bytes.
+ keys, utxos, tx = fresh_setup(2)
+ _, sig1_8 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT)
+ tx.witnesses[0] = [bytes([SIGHASH_ALL, MARKER_HALFAGG])]
+ tx.witnesses[1] = [optout_element(sig1_8)]
+ add_case("element-length-undefined", "2-byte witness element ending in "
+ "a marker byte, matching no defined structure", tx, utxos,
+ False, "marker and length match no defined structure")
+
+ # 9: invalid, cross-mode fold (mode commitment)
+ # Opted-out signatures over the plain BIP 341 message are packaged
+ # as a half-aggregation group. The group structure is well formed
+ # but aggregate verification fails because the group messages commit
+ # to the aggregation mode.
+ keys, utxos, tx = fresh_setup(2, key_offset=12)
+ triples = []
+ for idx in range(2):
+ m_optout = sigmsg_v1(tx, utxos, idx, SIGHASH_DEFAULT)
+ sig = schnorr_sign(m_optout, keys[idx][2], AUX_ZERO)
+ pk = utxos[idx].script_pubkey[2:]
+ triples.append((pk, m_optout, sig))
+ aggsig9 = halfagg.Aggregate(triples)
+ consensus_msgs = [
+ (utxos[i].script_pubkey[2:],
+ sigmsg_v2(tx, utxos, i, SIGHASH_DEFAULT, MARKER_HALFAGG))
+ for i in range(2)
+ ]
+ assert not halfagg.VerifyAggregate(aggsig9, consensus_msgs)
+ tx.witnesses[0] = [halfagg_member(triples[0][2][:32])]
+ tx.witnesses[1] = [halfagg_final(aggsig9)]
+ add_case("cross-mode-fold", "Opted-out signatures folded into a "
+ "half-aggregation group by a third party", tx, utxos, False,
+ "aggregate signature invalid, messages commit to the "
+ "aggregation mode")
+
+ # 10: invalid, empty witness
+ keys, utxos, tx = fresh_setup(2)
+ _, sig1 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT)
+ tx.witnesses[0] = []
+ tx.witnesses[1] = [optout_element(sig1)]
+ add_case("empty-witness", "Witness v2 input with an empty witness",
+ tx, utxos, False, "empty witness")
+
+ # 11: invalid, explicit 0x00 sighash byte on an opted-out signature.
+ # Complements case 5, which covers the marked form.
+ keys, utxos, tx = fresh_setup(2)
+ _, sig0 = sign_optout(tx, utxos, 0, keys[0][2], SIGHASH_DEFAULT)
+ _, sig1 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT)
+ tx.witnesses[0] = [sig0 + bytes([0x00])]
+ tx.witnesses[1] = [optout_element(sig1)]
+ add_case("optout-explicit-default", "Opted-out input encodes "
+ "SIGHASH_DEFAULT explicitly as a 0x00 sighash byte",
+ tx, utxos, False, "explicit 0x00 sighash byte")
+
+ # 12: valid, opted-out 64-byte signature ending in the marker byte
+ # 0xbc, ground via the auxiliary randomness
+ keys, utxos, tx = fresh_setup(2)
+ m0 = sigmsg_v1(tx, utxos, 0, SIGHASH_DEFAULT)
+ aux_i = 0
+ while True:
+ aux = tagged_hash("CISA/test/aux", aux_i.to_bytes(2, "little"))
+ sig0 = schnorr_sign(m0, keys[0][2], aux)
+ if sig0[63] == MARKER_HALFAGG:
+ break
+ aux_i += 1
+ _, sig1 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT)
+ tx.witnesses[0] = [optout_element(sig0)]
+ tx.witnesses[1] = [optout_element(sig1)]
+ add_case("optout-sig-ends-in-marker", "Opted-out 64-byte signature "
+ "whose last byte equals the half-aggregation marker 0xbc",
+ tx, utxos, True)
+
+ # 13: valid, half-aggregation group member carrying a signed annex
+ keys, utxos, tx = fresh_setup(2, key_offset=15)
+ annex = bytes([0x50]) + b"CISA annex test"
+ m0 = sigmsg_v2(tx, utxos, 0, SIGHASH_DEFAULT, MARKER_HALFAGG, annex=annex)
+ m1 = sigmsg_v2(tx, utxos, 1, SIGHASH_DEFAULT, MARKER_HALFAGG)
+ pk0 = utxos[0].script_pubkey[2:]
+ pk1 = utxos[1].script_pubkey[2:]
+ sig0 = schnorr_sign(m0, keys[0][2], AUX_ZERO)
+ sig1 = schnorr_sign(m1, keys[1][2], AUX_ZERO)
+ aggsig_annex = halfagg.Aggregate([(pk0, m0, sig0), (pk1, m1, sig1)])
+ assert halfagg.VerifyAggregate(aggsig_annex, [(pk0, m0), (pk1, m1)])
+ tx.witnesses[0] = [halfagg_member(sig0[:32]), annex]
+ tx.witnesses[1] = [halfagg_final(aggsig_annex)]
+ add_case("annex-committed-valid", "Half-aggregation group whose first "
+ "member carries an annex that is committed in its signature "
+ "message", tx, utxos, True)
+
+ # 14: invalid, annex stripped from the transaction of case 13
+ keys, utxos, tx = fresh_setup(2, key_offset=15)
+ m0_stripped = sigmsg_v2(tx, utxos, 0, SIGHASH_DEFAULT, MARKER_HALFAGG)
+ assert not halfagg.VerifyAggregate(
+ aggsig_annex, [(pk0, m0_stripped), (pk1, m1)]
+ )
+ tx.witnesses[0] = [halfagg_member(sig0[:32])]
+ tx.witnesses[1] = [halfagg_final(aggsig_annex)]
+ add_case("annex-stripped", "Annex removed by a third party from the "
+ "transaction of annex-committed-valid", tx, utxos, False,
+ "signature message committed to the annex")
+
+ # 15: valid, witness v2 script path spend (BIP 341/342 rules unchanged)
+ script_seckey = test_seckey(20)
+ script_pk = (Scalar.from_bytes_checked(script_seckey) * G).to_bytes_xonly()
+ script = bytes([0x20]) + script_pk + bytes([0xAC]) # OP_CHECKSIG
+ tapleaf_hash = tagged_hash(
+ "TapLeaf", bytes([0xC0]) + ser_compact_size(len(script)) + script
+ )
+ internal_seckey = test_seckey(21)
+ d0 = Scalar.from_bytes_checked(internal_seckey)
+ P_int = d0 * G
+ internal_x = P_int.to_bytes_xonly()
+ t = Scalar.from_bytes_checked(tagged_hash("TapTweak", internal_x + tapleaf_hash))
+ Q = GE.from_bytes_xonly(internal_x) + t * G
+ control = bytes([0xC0 | (0 if Q.has_even_y() else 1)]) + internal_x
+ keys, utxos, tx = fresh_setup(2, key_offset=18)
+ utxos[0] = TxOut(100_000_000, v2_script_pubkey(Q.to_bytes_xonly()))
+ m_script = sigmsg_tapscript(tx, utxos, 0, SIGHASH_DEFAULT, tapleaf_hash)
+ sig_script = schnorr_sign(m_script, script_seckey, AUX_ZERO)
+ assert schnorr_verify(m_script, script_pk, sig_script)
+ _, sig1 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT)
+ tx.witnesses[0] = [sig_script, script, control]
+ tx.witnesses[1] = [optout_element(sig1)]
+ add_case("scriptpath-valid", "Witness v2 script path spend of a single "
+ "CHECKSIG leaf under BIP 341/342 rules, alongside an opted-out "
+ "key path input", tx, utxos, True)
+
+ # 16: invalid, cross-mode messages in a full-aggregation group
+ # The signers run a full-aggregation session over plain BIP 341
+ # messages and the result is placed in a 0xbd witness. Unlike case 9
+ # there is no public fold operation for full-agg, this checks that
+ # verifiers derive the messages with the 0xbd marker on this path too.
+ keys, utxos, tx = fresh_setup(2, key_offset=22)
+ _, _, _, sig64_16 = sign_fullagg_group(
+ tx, utxos,
+ [(0, keys[0][2], SIGHASH_DEFAULT), (1, keys[1][2], SIGHASH_DEFAULT)],
+ msg_mode=None,
+ )
+ pks16 = [GE.from_bytes_xonly(u.script_pubkey[2:]) for u in utxos]
+ consensus_msgs16 = [
+ sigmsg_v2(tx, utxos, i, SIGHASH_DEFAULT, MARKER_FULLAGG) for i in range(2)
+ ]
+ R16 = GE.from_bytes_xonly(sig64_16[:32])
+ s16 = Scalar.from_bytes_checked(sig64_16[32:])
+ assert not fullagg.Verify(pks16, consensus_msgs16, (R16, s16))
+ tx.witnesses[0] = [fullagg_member()]
+ tx.witnesses[1] = [marker_element(MARKER_FULLAGG, sig=sig64_16)]
+ add_case("cross-mode-fullagg", "Full-aggregation signature created over "
+ "plain BIP 341 messages, placed in a full-aggregation group",
+ tx, utxos, False,
+ "aggregate signature invalid, messages commit to the "
+ "aggregation mode")
+
+ # 17: invalid, 97-byte 0xbd element. Marker 0xbd admits lengths 65
+ # and 66 only, so parsing fails in pass 1 regardless of the content.
+ # fresh_setup(2, key_offset=3) recreates the transaction from case 2
+ # deterministically, so the aggregate signature from that case
+ # corresponds to this tx.
+ _, _, _, sig64 = fullagg_base
+ keys, utxos, tx = fresh_setup(2, key_offset=3)
+ tx.witnesses[0] = [fullagg_member(SIGHASH_ALL)]
+ tx.witnesses[1] = [marker_element(MARKER_FULLAGG, sig=sig64 + bytes(32))]
+ add_case("fullagg-size-mismatch", "Full-aggregation final input carries "
+ "96 bytes before the marker (97-byte 0xbd element, matches no "
+ "defined witness structure)", tx, utxos, False,
+ "marker and length match no defined structure")
+
+ # 18: valid, mixed transaction mirroring Example 4 of the BIP: two
+ # opted-out inputs with explicit sighash types, a half-aggregation
+ # group and a full-aggregation group with interleaved indices. Also
+ # covers a valid SIGHASH_SINGLE member with a corresponding output.
+ keys, utxos, tx = fresh_setup(7, key_offset=24)
+ tx.vout = [
+ TxOut(350_000_000, v2_script_pubkey(keys[0][3])),
+ TxOut(349_000_000, v2_script_pubkey(keys[1][3])),
+ ]
+ _, sig0 = sign_optout(tx, utxos, 0, keys[0][2], SIGHASH_DEFAULT)
+ _, sig5 = sign_optout(tx, utxos, 5, keys[5][2],
+ SIGHASH_NONE | SIGHASH_ANYONECANPAY)
+ _, sigs18, aggsig18 = sign_halfagg_group(
+ tx, utxos,
+ [(1, keys[1][2], SIGHASH_SINGLE), (4, keys[4][2], SIGHASH_DEFAULT)],
+ )
+ _, _, _, sig64_18 = sign_fullagg_group(
+ tx, utxos,
+ [(2, keys[2][2], SIGHASH_DEFAULT), (3, keys[3][2], SIGHASH_DEFAULT),
+ (6, keys[6][2], SIGHASH_DEFAULT)],
+ )
+ tx.witnesses[0] = [optout_element(sig0)]
+ tx.witnesses[1] = [halfagg_member(sigs18[0][:32], SIGHASH_SINGLE)]
+ tx.witnesses[2] = [fullagg_member()]
+ tx.witnesses[3] = [fullagg_member()]
+ tx.witnesses[4] = [halfagg_final(aggsig18)]
+ tx.witnesses[5] = [optout_element(sig5,
+ SIGHASH_NONE | SIGHASH_ANYONECANPAY)]
+ tx.witnesses[6] = [marker_element(MARKER_FULLAGG, sig=sig64_18)]
+ add_case("two-groups-valid", "Mixed transaction mirroring Example 4 of "
+ "the BIP: two opted-out inputs, a half-aggregation group with "
+ "a SIGHASH_SINGLE member, and a full-aggregation group, with "
+ "interleaved input indices", tx, utxos, True)
+
+ # 19: invalid, SIGHASH_SINGLE without a corresponding output. Input 1
+ # signals SIGHASH_SINGLE but the transaction has only one output, so
+ # computing SigMsg fails per the BIP 341 failure conditions, which are
+ # incorporated by reference. The witness is structurally well formed
+ # and carries a syntactically valid signature (created over the
+ # SIGHASH_ALL flavored message), so the only reason for rejection is
+ # the missing corresponding output.
+ keys, utxos, tx = fresh_setup(2, key_offset=31)
+ _, sig0 = sign_optout(tx, utxos, 0, keys[0][2], SIGHASH_DEFAULT)
+ m_all = sigmsg_v1(tx, utxos, 1, SIGHASH_ALL)
+ sig1_19 = schnorr_sign(m_all, keys[1][2], AUX_ZERO)
+ tx.witnesses[0] = [optout_element(sig0)]
+ tx.witnesses[1] = [optout_element(sig1_19, SIGHASH_SINGLE)]
+ add_case("sighash-single-no-output", "Opted-out input uses "
+ "SIGHASH_SINGLE at input index 1 of a single-output "
+ "transaction", tx, utxos, False,
+ "SIGHASH_SINGLE input without corresponding output")
+
+ # 20: invalid, two final inputs in one half-aggregation group. Each
+ # element carries a valid single-member final, so the failure is
+ # purely structural. Distinct from case 7, where the element after
+ # the final is a member.
+ keys, utxos, tx = fresh_setup(2, key_offset=34)
+ _, _, agg_a = sign_halfagg_group(tx, utxos, [(0, keys[0][2], SIGHASH_DEFAULT)])
+ _, _, agg_b = sign_halfagg_group(tx, utxos, [(1, keys[1][2], SIGHASH_DEFAULT)])
+ tx.witnesses[0] = [halfagg_final(agg_a)]
+ tx.witnesses[1] = [halfagg_final(agg_b)]
+ add_case("halfagg-two-finals", "Two inputs each carrying a 65-byte "
+ "half-aggregation final element", tx, utxos, False,
+ "more than one final input in a group")
+
+ # 21: invalid, two final inputs in one full-aggregation group
+ keys, utxos, tx = fresh_setup(2, key_offset=36)
+ _, _, _, sig_a = sign_fullagg_group(
+ tx, utxos, [(0, keys[0][2], SIGHASH_DEFAULT)], nonce_offset=10)
+ _, _, _, sig_b = sign_fullagg_group(
+ tx, utxos, [(1, keys[1][2], SIGHASH_DEFAULT)], nonce_offset=11)
+ tx.witnesses[0] = [marker_element(MARKER_FULLAGG, sig=sig_a)]
+ tx.witnesses[1] = [marker_element(MARKER_FULLAGG, sig=sig_b)]
+ add_case("fullagg-two-finals", "Two inputs each carrying a 65-byte "
+ "full-aggregation final element", tx, utxos, False,
+ "more than one final input in a group")
+
+ # 22: invalid, full-aggregation members without a final input
+ # (full-agg analog of case 6)
+ keys, utxos, tx = fresh_setup(2, key_offset=38)
+ tx.witnesses[0] = [fullagg_member()]
+ tx.witnesses[1] = [fullagg_member()]
+ add_case("fullagg-no-final", "Full-aggregation members without an input "
+ "carrying the marker and the aggregate signature", tx, utxos,
+ False, "aggregation group has no final input")
+
+ # 23: invalid, full-agg member after the final
+ # (full-agg analog of case 7)
+ keys, utxos, tx = fresh_setup(3, key_offset=40)
+ _, _, _, sig64_23 = sign_fullagg_group(
+ tx, utxos,
+ [(0, keys[0][2], SIGHASH_DEFAULT), (1, keys[1][2], SIGHASH_DEFAULT)],
+ nonce_offset=12)
+ tx.witnesses[0] = [fullagg_member()]
+ tx.witnesses[1] = [marker_element(MARKER_FULLAGG, sig=sig64_23)]
+ tx.witnesses[2] = [fullagg_member()]
+ add_case("fullagg-member-after-final", "Full-aggregation member appears "
+ "after the group's final input", tx, utxos, False,
+ "member after group final")
+
+ # 24: valid, single-member half-aggregation group. The 65-byte
+ # element matches an explicit sighash opted-out signature in length
+ # and is distinguished by its 0xbc last byte.
+ keys, utxos, tx = fresh_setup(1, key_offset=43)
+ _, _, aggsig24 = sign_halfagg_group(
+ tx, utxos, [(0, keys[0][2], SIGHASH_DEFAULT)])
+ tx.witnesses[0] = [halfagg_final(aggsig24)]
+ add_case("halfagg-single-member", "Half-aggregation group with a single "
+ "member carrying a 64-byte aggregate in a 65-byte element",
+ tx, utxos, True)
+
+ # 25: valid, single-member full-aggregation group
+ keys, utxos, tx = fresh_setup(1, key_offset=44)
+ _, _, _, sig64_25 = sign_fullagg_group(
+ tx, utxos, [(0, keys[0][2], SIGHASH_DEFAULT)], nonce_offset=13)
+ tx.witnesses[0] = [marker_element(MARKER_FULLAGG, sig=sig64_25)]
+ add_case("fullagg-single-member", "Full-aggregation group with a single "
+ "member", tx, utxos, True)
+
+ # 26: invalid, single witness element starting with the annex prefix.
+ # An annex requires at least two witness elements, so this parses as
+ # a key path element that matches no defined structure.
+ keys, utxos, tx = fresh_setup(2, key_offset=45)
+ _, sig1_26 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT)
+ tx.witnesses[0] = [bytes([0x50]) + b"CISA annex test"]
+ tx.witnesses[1] = [optout_element(sig1_26)]
+ add_case("annex-lookalike", "Single witness element starting with the "
+ "annex prefix 0x50", tx, utxos, False,
+ "matches no defined structure, a single element is never "
+ "an annex")
+
+ # 27: valid, annex on the final input of a group. The annex must be
+ # stripped before the final element is interpreted. Complements case
+ # 13, which has the annex on a member input.
+ keys, utxos, tx = fresh_setup(2, key_offset=47)
+ annex27 = bytes([0x50]) + b"CISA annex test"
+ m0_27 = sigmsg_v2(tx, utxos, 0, SIGHASH_DEFAULT, MARKER_HALFAGG)
+ m1_27 = sigmsg_v2(tx, utxos, 1, SIGHASH_DEFAULT, MARKER_HALFAGG,
+ annex=annex27)
+ pk0 = utxos[0].script_pubkey[2:]
+ pk1 = utxos[1].script_pubkey[2:]
+ sig0_27 = schnorr_sign(m0_27, keys[0][2], AUX_ZERO)
+ sig1_27 = schnorr_sign(m1_27, keys[1][2], AUX_ZERO)
+ agg27 = halfagg.Aggregate([(pk0, m0_27, sig0_27), (pk1, m1_27, sig1_27)])
+ assert halfagg.VerifyAggregate(agg27, [(pk0, m0_27), (pk1, m1_27)])
+ tx.witnesses[0] = [halfagg_member(sig0_27[:32])]
+ tx.witnesses[1] = [halfagg_final(agg27), annex27]
+ add_case("annex-on-final", "Half-aggregation group whose final input "
+ "carries an annex that is committed in its signature message",
+ tx, utxos, True)
+
+ # 28: invalid, undefined sighash value. Cases 5 and 11 cover the
+ # explicit 0x00 encoding rule, this covers a value outside the
+ # defined set. The signature bytes are irrelevant, parsing fails
+ # first.
+ keys, utxos, tx = fresh_setup(2, key_offset=49)
+ m0_28 = sigmsg_v1(tx, utxos, 0, SIGHASH_DEFAULT)
+ sig0_28 = schnorr_sign(m0_28, keys[0][2], AUX_ZERO)
+ _, sig1_28 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT)
+ tx.witnesses[0] = [sig0_28 + bytes([0x04])]
+ tx.witnesses[1] = [optout_element(sig1_28)]
+ add_case("sighash-value-undefined", "Opted-out input with the undefined "
+ "sighash value 0x04", tx, utxos, False,
+ "undefined sighash type")
+
+ # 29: invalid, 33-byte element ending in 0xbc. It parses as a
+ # half-aggregation member whose sighash byte is the marker value,
+ # which is not a valid sighash type.
+ keys, utxos, tx = fresh_setup(2, key_offset=51)
+ _, sig0_29 = sign_optout(tx, utxos, 0, keys[0][2], SIGHASH_DEFAULT)
+ _, _, agg29 = sign_halfagg_group(
+ tx, utxos, [(1, keys[1][2], SIGHASH_DEFAULT)])
+ tx.witnesses[0] = [optout_element(sig0_29)]
+ tx.witnesses[1] = [agg29[:32] + bytes([MARKER_HALFAGG])]
+ add_case("member-sighash-is-marker", "33-byte element ending in the "
+ "marker 0xbc, a half-aggregation member with an invalid "
+ "sighash byte", tx, utxos, False, "undefined sighash type")
+
+ # 30: valid, witness v2 output whose witness program is not 32 bytes.
+ # Such outputs remain unencumbered by the BIP, so the witness content
+ # is unconstrained, even an undefined marker byte.
+ keys, utxos, tx = fresh_setup(2, key_offset=53)
+ program33 = test_garbage(b"33-byte program", 33)
+ utxos[0] = TxOut(100_000_000, bytes([0x52, 0x21]) + program33)
+ _, sig1_30 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT)
+ tx.witnesses[0] = [bytes([0xBE])]
+ tx.witnesses[1] = [optout_element(sig1_30)]
+ add_case("program-not-32-bytes", "Witness v2 output with a 33-byte "
+ "witness program spent with an arbitrary witness", tx, utxos,
+ True)
+
+ # 31: invalid, opted-out witness program is not a valid x coordinate.
+ # BIP 340 verification fails at lift_x.
+ keys, utxos, tx = fresh_setup(2, key_offset=55)
+ utxos[0] = TxOut(100_000_000,
+ bytes([0x52, 0x20]) + test_offcurve_x(b"optout"))
+ _, sig1_31 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT)
+ tx.witnesses[0] = [optout_element(test_garbage(b"offcurve sig", 64))]
+ tx.witnesses[1] = [optout_element(sig1_31)]
+ add_case("program-offcurve-optout", "Opted-out input whose witness "
+ "program is not a valid x-only public key", tx, utxos, False,
+ "witness program is not a valid x-only public key")
+
+ # 32: invalid, group member witness program is not a valid x
+ # coordinate. VerifyAggregate fails at lift_x of the first pubkey, so
+ # the aggregate content is irrelevant.
+ keys, utxos, tx = fresh_setup(2, key_offset=57)
+ utxos[0] = TxOut(100_000_000,
+ bytes([0x52, 0x20]) + test_offcurve_x(b"group"))
+ m1_32 = sigmsg_v2(tx, utxos, 1, SIGHASH_DEFAULT, MARKER_HALFAGG)
+ sig1_32 = schnorr_sign(m1_32, keys[1][2], AUX_ZERO)
+ agg32 = test_garbage(b"offcurve r0", 32) + sig1_32
+ assert not halfagg.VerifyAggregate(agg32, [
+ (utxos[0].script_pubkey[2:],
+ sigmsg_v2(tx, utxos, 0, SIGHASH_DEFAULT, MARKER_HALFAGG)),
+ (utxos[1].script_pubkey[2:], m1_32),
+ ])
+ tx.witnesses[0] = [halfagg_member(agg32[:32])]
+ tx.witnesses[1] = [halfagg_final(agg32)]
+ add_case("program-offcurve-in-group", "Half-aggregation group member "
+ "whose witness program is not a valid x-only public key",
+ tx, utxos, False,
+ "witness program is not a valid x-only public key")
+
+ # 33: valid, script path spend with an unknown leaf version (0xc2).
+ # Unknown leaf versions succeed unconditionally under BIP 341,
+ # preserving the upgrade hook in witness v2.
+ keys, utxos, tx = fresh_setup(2, key_offset=59)
+ internal_seckey33 = test_seckey(200)
+ internal_x33 = (Scalar.from_bytes_checked(internal_seckey33) * G).to_bytes_xonly()
+ script33 = bytes([0x51])
+ leaf33 = tagged_hash(
+ "TapLeaf", bytes([0xC2]) + ser_compact_size(len(script33)) + script33)
+ t33 = Scalar.from_bytes_checked(tagged_hash("TapTweak", internal_x33 + leaf33))
+ Q33 = GE.from_bytes_xonly(internal_x33) + t33 * G
+ control33 = bytes([0xC2 | (0 if Q33.has_even_y() else 1)]) + internal_x33
+ utxos[0] = TxOut(100_000_000, v2_script_pubkey(Q33.to_bytes_xonly()))
+ _, sig1_33 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT)
+ tx.witnesses[0] = [script33, control33]
+ tx.witnesses[1] = [optout_element(sig1_33)]
+ add_case("scriptpath-unknown-leaf-version", "Witness v2 script path "
+ "spend with unknown leaf version 0xc2, which succeeds "
+ "unconditionally per BIP 341", tx, utxos, True)
+
+ # 34: valid, script path leaf containing an OP_SUCCESS opcode. The
+ # script byte 0xbc is OP_SUCCESS188 in tapscript and has no marker
+ # meaning inside a script.
+ keys, utxos, tx = fresh_setup(2, key_offset=61)
+ internal_seckey34 = test_seckey(201)
+ internal_x34 = (Scalar.from_bytes_checked(internal_seckey34) * G).to_bytes_xonly()
+ script34 = bytes([MARKER_HALFAGG])
+ leaf34 = tagged_hash(
+ "TapLeaf", bytes([0xC0]) + ser_compact_size(len(script34)) + script34)
+ t34 = Scalar.from_bytes_checked(tagged_hash("TapTweak", internal_x34 + leaf34))
+ Q34 = GE.from_bytes_xonly(internal_x34) + t34 * G
+ control34 = bytes([0xC0 | (0 if Q34.has_even_y() else 1)]) + internal_x34
+ utxos[0] = TxOut(100_000_000, v2_script_pubkey(Q34.to_bytes_xonly()))
+ _, sig1_34 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT)
+ tx.witnesses[0] = [script34, control34]
+ tx.witnesses[1] = [optout_element(sig1_34)]
+ add_case("scriptpath-op-success", "Witness v2 script path spend whose "
+ "leaf script is OP_SUCCESS188 (byte 0xbc), which succeeds "
+ "unconditionally per BIP 342", tx, utxos, True)
+
+ # 35: valid, mixed witness v1 and v2 transaction mirroring Example 3
+ # of the BIP. Input 0 spends a taproot output with an unchanged
+ # BIP 341 key path signature (epoch 0x00, no marker).
+ keys, utxos, tx = fresh_setup(3, key_offset=63)
+ utxos[0] = TxOut(100_000_000, bytes([0x51, 0x20]) + keys[0][3])
+ m0_35 = sigmsg_v1(tx, utxos, 0, SIGHASH_DEFAULT)
+ sig0_35 = schnorr_sign(m0_35, keys[0][2], AUX_ZERO)
+ _, sigs35, agg35 = sign_halfagg_group(
+ tx, utxos,
+ [(1, keys[1][2], SIGHASH_DEFAULT), (2, keys[2][2], SIGHASH_DEFAULT)])
+ tx.witnesses[0] = [sig0_35]
+ tx.witnesses[1] = [halfagg_member(sigs35[0][:32])]
+ tx.witnesses[2] = [halfagg_final(agg35)]
+ add_case("v1-v2-mixed", "Witness v1 key path input alongside a "
+ "two-member witness v2 half-aggregation group, mirroring "
+ "Example 3 of the BIP", tx, utxos, True)
+
+ # 36: invalid, explicit sighash byte stripped by a third party. Input
+ # 0 signed with explicit SIGHASH_ALL, the witness is malleated to the
+ # 32-byte form, so the verifier derives the SIGHASH_DEFAULT flavored
+ # message. Complements case 14, which strips the annex.
+ keys, utxos, tx = fresh_setup(2, key_offset=66)
+ msgs36, sigs36, agg36 = sign_halfagg_group(
+ tx, utxos,
+ [(0, keys[0][2], SIGHASH_ALL), (1, keys[1][2], SIGHASH_DEFAULT)])
+ m0_default = sigmsg_v2(tx, utxos, 0, SIGHASH_DEFAULT, MARKER_HALFAGG)
+ assert not halfagg.VerifyAggregate(agg36, [
+ (utxos[0].script_pubkey[2:], m0_default),
+ (utxos[1].script_pubkey[2:], msgs36[1]),
+ ])
+ tx.witnesses[0] = [halfagg_member(sigs36[0][:32])]
+ tx.witnesses[1] = [halfagg_final(agg36)]
+ add_case("sighash-byte-stripped", "Explicit SIGHASH_ALL byte removed "
+ "from a group member by a third party", tx, utxos, False,
+ "signature message committed to the sighash type")
+
+ # 37: invalid, single empty witness element. It parses as a
+ # full-aggregation member and the group has no final input. Distinct
+ # from case 10, where the witness stack itself is empty.
+ keys, utxos, tx = fresh_setup(2, key_offset=68)
+ _, sig1_37 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT)
+ tx.witnesses[0] = [b""]
+ tx.witnesses[1] = [optout_element(sig1_37)]
+ add_case("empty-element-no-final", "Witness v2 input whose only witness "
+ "element is empty, a full-aggregation member without a final "
+ "input", tx, utxos, False,
+ "aggregation group has no final input")
+
+ # 38: invalid, SIGHASH_SINGLE group member without a corresponding
+ # output. Complements case 19, which covers the opted-out path. The
+ # witness is structurally well formed (66-byte final element) and
+ # the signature bytes are created over the SIGHASH_ALL flavored
+ # message, so the only reason for rejection is the missing output.
+ keys, utxos, tx = fresh_setup(2, key_offset=70)
+ pk0 = utxos[0].script_pubkey[2:]
+ pk1 = utxos[1].script_pubkey[2:]
+ m0_38 = sigmsg_v2(tx, utxos, 0, SIGHASH_DEFAULT, MARKER_HALFAGG)
+ m1_38 = sigmsg_v2(tx, utxos, 1, SIGHASH_ALL, MARKER_HALFAGG)
+ sig0_38 = schnorr_sign(m0_38, keys[0][2], AUX_ZERO)
+ sig1_38 = schnorr_sign(m1_38, keys[1][2], AUX_ZERO)
+ agg38 = halfagg.Aggregate([(pk0, m0_38, sig0_38), (pk1, m1_38, sig1_38)])
+ tx.witnesses[0] = [halfagg_member(sig0_38[:32])]
+ tx.witnesses[1] = [halfagg_final(agg38, SIGHASH_SINGLE)]
+ add_case("sighash-single-no-output-group", "Half-aggregation group "
+ "member uses SIGHASH_SINGLE at input index 1 of a "
+ "single-output transaction", tx, utxos, False,
+ "SIGHASH_SINGLE input without corresponding output")
+
+ # 39: invalid, two witness elements where the last is not an annex.
+ # With two elements and no annex prefix this is a script path spend,
+ # and the 1-byte last element is not a valid control block.
+ keys, utxos, tx = fresh_setup(2, key_offset=72)
+ m0_39 = sigmsg_v1(tx, utxos, 0, SIGHASH_DEFAULT)
+ sig0_39 = schnorr_sign(m0_39, keys[0][2], AUX_ZERO)
+ _, sig1_39 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT)
+ tx.witnesses[0] = [sig0_39, bytes([0x60])]
+ tx.witnesses[1] = [optout_element(sig1_39)]
+ add_case("two-elements-no-annex", "Keypath-looking element followed by "
+ "a second element that is not an annex, making this a script "
+ "path spend with an invalid control block", tx, utxos, False,
+ "invalid control block size")
+
+ # 40: invalid, half-aggregation flavored signature placed as a bare
+ # 64-byte opted-out element
+ keys, utxos, tx = fresh_setup(2, key_offset=74)
+ m0_agg = sigmsg_v2(tx, utxos, 0, SIGHASH_DEFAULT, MARKER_HALFAGG)
+ sig0_40 = schnorr_sign(m0_agg, keys[0][2], AUX_ZERO)
+ m0_plain = sigmsg_v1(tx, utxos, 0, SIGHASH_DEFAULT)
+ assert not schnorr_verify(m0_plain, utxos[0].script_pubkey[2:], sig0_40)
+ _, sig1_40 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT)
+ tx.witnesses[0] = [optout_element(sig0_40)]
+ tx.witnesses[1] = [optout_element(sig1_40)]
+ add_case("agg-mode-sig-as-optout", "Signature created over the "
+ "half-aggregation flavored message used as a bare opted-out "
+ "signature", tx, utxos, False,
+ "signature invalid, message commits to the aggregation mode")
+
+ # 41: valid, 8-member half-aggregation group, exercising the nonce
+ # share assembly across many inputs
+ keys, utxos, tx = fresh_setup(8, key_offset=76)
+ members41 = [(i, keys[i][2], SIGHASH_DEFAULT) for i in range(8)]
+ _, sigs41, agg41 = sign_halfagg_group(tx, utxos, members41)
+ for i in range(7):
+ tx.witnesses[i] = [halfagg_member(sigs41[i][:32])]
+ tx.witnesses[7] = [halfagg_final(agg41)]
+ add_case("halfagg-large-group", "8-member half-aggregation group",
+ tx, utxos, True)
+
+ # 42: valid, script path spend whose first stack element is a 1-byte
+ # 0xbc marker lookalike. With three witness elements this is a script
+ # path spend, so marker interpretation does not apply. The leaf
+ # script drops the element and pushes true.
+ keys, utxos, tx = fresh_setup(2, key_offset=84)
+ internal_seckey42 = test_seckey(202)
+ internal_x42 = (Scalar.from_bytes_checked(internal_seckey42) * G).to_bytes_xonly()
+ script42 = bytes([0x75, 0x51]) # OP_DROP OP_1
+ leaf42 = tagged_hash(
+ "TapLeaf", bytes([0xC0]) + ser_compact_size(len(script42)) + script42)
+ t42 = Scalar.from_bytes_checked(tagged_hash("TapTweak", internal_x42 + leaf42))
+ Q42 = GE.from_bytes_xonly(internal_x42) + t42 * G
+ control42 = bytes([0xC0 | (0 if Q42.has_even_y() else 1)]) + internal_x42
+ utxos[0] = TxOut(100_000_000, v2_script_pubkey(Q42.to_bytes_xonly()))
+ _, sig1_42 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT)
+ tx.witnesses[0] = [bytes([MARKER_HALFAGG]), script42, control42]
+ tx.witnesses[1] = [optout_element(sig1_42)]
+ add_case("scriptpath-marker-lookalike", "Script path spend whose first "
+ "stack element is a 1-byte 0xbc marker lookalike, which has "
+ "no marker meaning outside key path spends", tx, utxos, True)
+
+ # 43: valid, both group members spend outputs with the same witness
+ # program (address reuse). The messages differ by input index and
+ # neither scheme deduplicates keys.
+ keys, utxos, tx = fresh_setup(4, key_offset=86)
+ utxos[1] = TxOut(100_000_000, v2_script_pubkey(keys[0][3]))
+ utxos[3] = TxOut(100_000_000, v2_script_pubkey(keys[2][3]))
+ _, sigs43, agg43 = sign_halfagg_group(
+ tx, utxos,
+ [(0, keys[0][2], SIGHASH_DEFAULT), (1, keys[0][2], SIGHASH_DEFAULT)])
+ _, _, _, sig64_43 = sign_fullagg_group(
+ tx, utxos,
+ [(2, keys[2][2], SIGHASH_DEFAULT), (3, keys[2][2], SIGHASH_DEFAULT)],
+ nonce_offset=20)
+ tx.witnesses[0] = [halfagg_member(sigs43[0][:32])]
+ tx.witnesses[1] = [halfagg_final(agg43)]
+ tx.witnesses[2] = [fullagg_member()]
+ tx.witnesses[3] = [marker_element(MARKER_FULLAGG, sig=sig64_43)]
+ add_case("duplicate-key-groups", "Half-aggregation and full-aggregation "
+ "groups whose two members each spend outputs with the same "
+ "witness program (address reuse)", tx, utxos, True)
+
+ # 44: invalid, ANYONECANPAY signature for the same output key created
+ # as if spending the v1 scriptPubKey, replayed on the witness v2
+ # input. Fails because the message commits to the spent scriptPubKey.
+ keys, utxos, tx = fresh_setup(2, key_offset=90)
+ utxos_v1 = list(utxos)
+ utxos_v1[0] = TxOut(utxos[0].amount, bytes([0x51, 0x20]) + keys[0][3])
+ ht44 = SIGHASH_ALL | SIGHASH_ANYONECANPAY
+ m0_v1spk = sigmsg_v1(tx, utxos_v1, 0, ht44)
+ sig0_44 = schnorr_sign(m0_v1spk, keys[0][2], AUX_ZERO)
+ m0_v2spk = sigmsg_v1(tx, utxos, 0, ht44)
+ assert not schnorr_verify(m0_v2spk, keys[0][3], sig0_44)
+ _, sig1_44 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT)
+ tx.witnesses[0] = [optout_element(sig0_44, ht44)]
+ tx.witnesses[1] = [optout_element(sig1_44)]
+ add_case("v1-replay", "BIP 341 key path signature created for a "
+ "witness v1 output with the same output key, replayed on a "
+ "witness v2 input", tx, utxos, False,
+ "signature message commits to the spent scriptPubKey")
+
+ # 45: invalid, undefined sighash value on a 1-byte full-aggregation
+ # member, complementing case 28 for the member forms. The aggregate
+ # covers the matching messages, so only the sighash validation fails.
+ keys, utxos, tx = fresh_setup(3, key_offset=92)
+ _, sig0_45 = sign_optout(tx, utxos, 0, keys[0][2], SIGHASH_DEFAULT)
+ _, _, _, sig64_45 = sign_fullagg_group(
+ tx, utxos, [(1, keys[1][2], 0x04), (2, keys[2][2], SIGHASH_DEFAULT)],
+ nonce_offset=21)
+ tx.witnesses[0] = [optout_element(sig0_45)]
+ tx.witnesses[1] = [fullagg_member(0x04)]
+ tx.witnesses[2] = [marker_element(MARKER_FULLAGG, sig=sig64_45)]
+ add_case("member-sighash-undefined", "Full-aggregation member with the "
+ "undefined sighash value 0x04", tx, utxos, False,
+ "undefined sighash type")
+
+ # 46: invalid, 97-byte 0xbc element carrying the whole aggregate
+ # signature on the final input, the encoding of an earlier revision
+ # of this BIP. Half-agg analog of case 17.
+ keys, utxos, tx = fresh_setup(2, key_offset=95)
+ _, sigs46, agg46 = sign_halfagg_group(
+ tx, utxos,
+ [(0, keys[0][2], SIGHASH_DEFAULT), (1, keys[1][2], SIGHASH_DEFAULT)])
+ tx.witnesses[0] = [halfagg_member(sigs46[0][:32])]
+ tx.witnesses[1] = [marker_element(MARKER_HALFAGG, sig=agg46)]
+ add_case("halfagg-final-old-format", "97-byte 0xbc element carrying the "
+ "whole aggregate signature, the final input encoding of an "
+ "earlier revision", tx, utxos, False,
+ "marker and length match no defined structure")
+
+ # 47: valid, half-aggregation member with SIGHASH_ALL|ANYONECANPAY,
+ # covering the per-input commitment branch of SigMsg in an
+ # aggregation flavored message
+ keys, utxos, tx = fresh_setup(2, key_offset=97)
+ ht47 = SIGHASH_ALL | SIGHASH_ANYONECANPAY
+ _, sigs47, agg47 = sign_halfagg_group(
+ tx, utxos, [(0, keys[0][2], ht47), (1, keys[1][2], SIGHASH_DEFAULT)]
+ )
+ tx.witnesses[0] = [halfagg_member(sigs47[0][:32], ht47)]
+ tx.witnesses[1] = [halfagg_final(agg47)]
+ add_case("halfagg-acp-member", "Half-aggregation group with a "
+ "SIGHASH_ALL|SIGHASH_ANYONECANPAY member", tx, utxos, True)
+
+ # 48: invalid, marker of the full-aggregation final from case 25
+ # flipped to 0xbc by a third party, which parses as a half-aggregation
+ # final of the correct size. Fails because the message commits to the
+ # marker. fresh_setup(1, key_offset=44) recreates the case 25 tx.
+ keys, utxos, tx = fresh_setup(1, key_offset=44)
+ m0_48 = sigmsg_v2(tx, utxos, 0, SIGHASH_DEFAULT, MARKER_HALFAGG)
+ assert not halfagg.VerifyAggregate(
+ sig64_25, [(utxos[0].script_pubkey[2:], m0_48)])
+ tx.witnesses[0] = [marker_element(MARKER_HALFAGG, sig=sig64_25)]
+ add_case("marker-swapped-fullagg", "Full-aggregation final of a "
+ "single-member group mutated to carry the half-aggregation "
+ "marker", tx, utxos, False,
+ "aggregate signature invalid, messages commit to the "
+ "aggregation mode")
+
+ # 49: valid, annex on an empty full-aggregation member element.
+ # Complements cases 13 and 27 for the empty element form.
+ keys, utxos, tx = fresh_setup(2, key_offset=99)
+ annex49 = bytes([0x50]) + b"CISA annex test"
+ _, _, _, sig64_49 = sign_fullagg_group(
+ tx, utxos,
+ [(0, keys[0][2], SIGHASH_DEFAULT), (1, keys[1][2], SIGHASH_DEFAULT)],
+ nonce_offset=22, annexes={0: annex49})
+ tx.witnesses[0] = [fullagg_member(), annex49]
+ tx.witnesses[1] = [marker_element(MARKER_FULLAGG, sig=sig64_49)]
+ add_case("annex-on-empty-member", "Full-aggregation member carrying an "
+ "annex on an empty witness element, committed in its signature "
+ "message", tx, utxos, True)
+
+ # 50: invalid, nonce shares swapped between the two inputs by a third
+ # party. The randomizers of the aggregate commit to the shares in
+ # input order, so verification fails.
+ keys, utxos, tx = fresh_setup(2, key_offset=101)
+ _, sigs50, agg50 = sign_halfagg_group(
+ tx, utxos,
+ [(0, keys[0][2], SIGHASH_DEFAULT), (1, keys[1][2], SIGHASH_DEFAULT)])
+ swapped = sigs50[1][:32] + sigs50[0][:32] + agg50[-32:]
+ msgs50 = [(utxos[i].script_pubkey[2:],
+ sigmsg_v2(tx, utxos, i, SIGHASH_DEFAULT, MARKER_HALFAGG))
+ for i in range(2)]
+ assert not halfagg.VerifyAggregate(swapped, msgs50)
+ tx.witnesses[0] = [halfagg_member(sigs50[1][:32])]
+ tx.witnesses[1] = [halfagg_final(swapped)]
+ add_case("nonce-shares-swapped", "Nonce shares of the two "
+ "half-aggregation inputs swapped by a third party", tx, utxos,
+ False, "aggregate signature invalid, the randomizers commit "
+ "to the shares in input order")
+
+ # 51: invalid, 66-byte element ending in a valid sighash byte.
+ # 66-byte elements must end in a marker, there is no 66-byte
+ # opted-out form.
+ keys, utxos, tx = fresh_setup(2, key_offset=103)
+ _, sig0_51 = sign_optout(tx, utxos, 0, keys[0][2], SIGHASH_ALL)
+ _, sig1_51 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT)
+ tx.witnesses[0] = [sig0_51 + bytes([SIGHASH_ALL, SIGHASH_ALL])]
+ tx.witnesses[1] = [optout_element(sig1_51)]
+ add_case("optout-too-long", "66-byte element ending in a valid sighash "
+ "byte, one byte above the opted-out maximum", tx, utxos, False,
+ "marker and length match no defined structure")
+
+ # 52: invalid, 1-byte element containing only the marker value. It
+ # parses as a full-aggregation member with an invalid sighash byte.
+ # In an earlier revision this was a valid placeholder form.
+ keys, utxos, tx = fresh_setup(2, key_offset=105)
+ _, sig1_52 = sign_optout(tx, utxos, 1, keys[1][2], SIGHASH_DEFAULT)
+ tx.witnesses[0] = [bytes([MARKER_HALFAGG])]
+ tx.witnesses[1] = [optout_element(sig1_52)]
+ add_case("member-marker-only", "1-byte element containing only the "
+ "marker value 0xbc, a full-aggregation member with an invalid "
+ "sighash byte", tx, utxos, False, "undefined sighash type")
+
+ # 53: invalid, marker of the half-aggregation final from case 24
+ # flipped to 0xbd by a third party, the mirror of case 48.
+ # fresh_setup(1, key_offset=43) recreates the case 24 tx.
+ keys, utxos, tx = fresh_setup(1, key_offset=43)
+ m0_53 = sigmsg_v2(tx, utxos, 0, SIGHASH_DEFAULT, MARKER_FULLAGG)
+ R53 = GE.from_bytes_xonly(aggsig24[:32])
+ s53 = Scalar.from_bytes_checked(aggsig24[32:])
+ assert not fullagg.Verify(
+ [GE.from_bytes_xonly(utxos[0].script_pubkey[2:])], [m0_53],
+ (R53, s53))
+ tx.witnesses[0] = [marker_element(MARKER_FULLAGG, sig=aggsig24)]
+ add_case("marker-swapped-halfagg", "Half-aggregation final of a "
+ "single-member group mutated to carry the full-aggregation "
+ "marker", tx, utxos, False,
+ "aggregate signature invalid, messages commit to the "
+ "aggregation mode")
+
+ return {"testCases": cases}
+
+
+def main():
+ out_dir = Path(__file__).parent
+ wallet = make_wallet_vectors()
+ consensus = make_consensus_vectors()
+ with open(out_dir / "wallet-test-vectors.json", "w") as f:
+ json.dump(wallet, f, indent=2)
+ f.write("\n")
+ with open(out_dir / "consensus-test-vectors.json", "w") as f:
+ json.dump(consensus, f, indent=2)
+ f.write("\n")
+ print(f"wrote {out_dir / 'wallet-test-vectors.json'}")
+ print(f"wrote {out_dir / 'consensus-test-vectors.json'}")
+
+
+if __name__ == "__main__":
+ main()
diff --git a/bip-0460/wallet-test-vectors.json b/bip-0460/wallet-test-vectors.json
new file mode 100644
index 0000000000..9fdb49d267
--- /dev/null
+++ b/bip-0460/wallet-test-vectors.json
@@ -0,0 +1,222 @@
+{
+ "scriptPubKey": [
+ {
+ "given": {
+ "internalPubkey": "34b703e82bfdedfbab012da7a34767456c3f85524171663df7c0aaf227276901"
+ },
+ "intermediary": {
+ "tweak": "4821522480fda0d8eeab11f09a642cae24605302c3ccda3f590e323f81d6fc0b",
+ "tweakedPubkey": "4049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b"
+ },
+ "expected": {
+ "scriptPubKey": "52204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b",
+ "address": "bc1zgpyuugjdfdjq06w8se8g3kqzpxttavzxv0x3t94lflu2kv6mc4as88u8yc"
+ }
+ },
+ {
+ "given": {
+ "internalPubkey": "cca0578cd53156e37b6e87c90b2d03cb38b046587a7c4a9a2986e24d0c85c120"
+ },
+ "intermediary": {
+ "tweak": "d18eb46c3f1105be40607ff7c064a3af23cb7cce36938f7cf73dbfd2e694a950",
+ "tweakedPubkey": "cc93415eadd2ed34dc668b345ef49dd492eaaf5c0562482d393917966a6dbfd5"
+ },
+ "expected": {
+ "scriptPubKey": "5220cc93415eadd2ed34dc668b345ef49dd492eaaf5c0562482d393917966a6dbfd5",
+ "address": "bc1zejf5zh4d6tknfhrx3v69aaya6jfw4t6uq43ystfe8ytev6ndhl2sx2w44g"
+ }
+ }
+ ],
+ "keyPathSpending": [
+ {
+ "description": "Opted-out input with SIGHASH_ALL alongside a two-member half-aggregation group with SIGHASH_DEFAULT",
+ "given": {
+ "rawUnsignedTx": "0200000003375412079d92555f10368dc54e08189023c8a6bfe0318933dda280bb8c96e76a0000000000ffffffff2dea8db84ee1bcea688026b1bda8fea0667b8f3b24d914e2afe0f5dffae5086d0000000000ffffffff8e89080fe122cee9ffa6c0b2128cc14be4ca148c2629d0040f6037cfd0f816190000000000ffffffff01c060d211000000002252204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b00000000",
+ "utxosSpent": [
+ {
+ "scriptPubKey": "52204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b",
+ "amountSats": 100000000
+ },
+ {
+ "scriptPubKey": "5220cc93415eadd2ed34dc668b345ef49dd492eaaf5c0562482d393917966a6dbfd5",
+ "amountSats": 101000000
+ },
+ {
+ "scriptPubKey": "52208877c408836c8fac26214cd6ce52200ef5c44f8466b08d889cc671b7fa7dbcbd",
+ "amountSats": 102000000
+ }
+ ]
+ },
+ "inputSpending": [
+ {
+ "given": {
+ "txinIndex": 0,
+ "internalPrivkey": "50dbc446357ea19a9f032c65541a3d69d7fce0f909c67671ab92f0fdf75bc75b",
+ "aggMode": null,
+ "hashType": 1
+ },
+ "intermediary": {
+ "internalPubkey": "34b703e82bfdedfbab012da7a34767456c3f85524171663df7c0aaf227276901",
+ "tweak": "4821522480fda0d8eeab11f09a642cae24605302c3ccda3f590e323f81d6fc0b",
+ "tweakedPrivkey": "98fd166ab67c42738dae3e55ee7e6a17fc5d33fbcd9350b104a1233d7932c366",
+ "sigHash": "d69ac779928b23970adb2b5db967f32353d9f8025b721b146f063a65015e0809"
+ },
+ "expected": {
+ "witness": [
+ "86a207d61052859ed25d045739ff69f6c94e246c7e95c0bd2dbf951cb75f0ee55e890397180835f8d5aeb8eabef4c9e234b13aa87fe38c96f25001f3b1a0631d01"
+ ]
+ }
+ },
+ {
+ "given": {
+ "txinIndex": 1,
+ "internalPrivkey": "26cc4c0d15b25be1e2137c638a99c9dbce9cfe8b74d2f1612731d9e620648870",
+ "aggMode": "0xbc",
+ "hashType": 0
+ },
+ "intermediary": {
+ "internalPubkey": "cca0578cd53156e37b6e87c90b2d03cb38b046587a7c4a9a2986e24d0c85c120",
+ "tweak": "d18eb46c3f1105be40607ff7c064a3af23cb7cce36938f7cf73dbfd2e694a950",
+ "tweakedPrivkey": "f85b007954c361a02273fc5b4afe6d8af2687b59ab6680de1e6f99b906f931c0",
+ "sigHash": "b4790a58d8405ea70b8758143fd245301d725b23af4a60a2d2393686b79122af"
+ },
+ "expected": {
+ "witness": [
+ "5dc80989a7bcfb1fce2602935d5b70052b7eb030c50f4a9f08b49c08cb20ef3f"
+ ]
+ }
+ },
+ {
+ "given": {
+ "txinIndex": 2,
+ "internalPrivkey": "213ac0b0d8b50089762f10ee2851872255c673e87da343375d89060cbec74e4a",
+ "aggMode": "0xbc",
+ "hashType": 0
+ },
+ "intermediary": {
+ "internalPubkey": "49d40eb515a74c614f7b231d3b2957b5dd4267f34b0c99f3da86116d1974670c",
+ "tweak": "88e8cdaa41ee11c3a85fcb9b1321fcd82d4c79ba143265d6df49ed76127071ca",
+ "tweakedPrivkey": "67ae0cf96939113a3230baacead075b5d78605d1968f229f81c0e76953a92380",
+ "sigHash": "d8562e8cf18da05da50f2bc3f00fc8b93585bcc3c07e398b85a68b068c15247c"
+ },
+ "expected": {
+ "witness": [
+ "9e0f4cac3b04d5360ca75e857091040adbc8e35d7e72d6ba1e4d4d5f407018ebe603d806099e372dd2a69aa2a10d23361cf711fcdd5a7ca1b79456cf318c95adbc"
+ ]
+ }
+ }
+ ],
+ "auxiliary": {
+ "aggregateSignature": "5dc80989a7bcfb1fce2602935d5b70052b7eb030c50f4a9f08b49c08cb20ef3f9e0f4cac3b04d5360ca75e857091040adbc8e35d7e72d6ba1e4d4d5f407018ebe603d806099e372dd2a69aa2a10d23361cf711fcdd5a7ca1b79456cf318c95ad"
+ },
+ "expected": {
+ "rawSignedTx": "02000000000103375412079d92555f10368dc54e08189023c8a6bfe0318933dda280bb8c96e76a0000000000ffffffff2dea8db84ee1bcea688026b1bda8fea0667b8f3b24d914e2afe0f5dffae5086d0000000000ffffffff8e89080fe122cee9ffa6c0b2128cc14be4ca148c2629d0040f6037cfd0f816190000000000ffffffff01c060d211000000002252204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b014186a207d61052859ed25d045739ff69f6c94e246c7e95c0bd2dbf951cb75f0ee55e890397180835f8d5aeb8eabef4c9e234b13aa87fe38c96f25001f3b1a0631d0101205dc80989a7bcfb1fce2602935d5b70052b7eb030c50f4a9f08b49c08cb20ef3f01419e0f4cac3b04d5360ca75e857091040adbc8e35d7e72d6ba1e4d4d5f407018ebe603d806099e372dd2a69aa2a10d23361cf711fcdd5a7ca1b79456cf318c95adbc00000000"
+ }
+ },
+ {
+ "description": "Two-member full-aggregation group with SIGHASH_ALL (using deterministic nonces)",
+ "given": {
+ "rawUnsignedTx": "020000000254d36a0897340110cc34b526d73b206175ae4f5db4d25fe7bdeef3a8a5e89afd0100000000ffffffff835a02826d69e61b563ec713020bd2b7c3bc3848223cda2b3c52bbdcd3e6267a0100000000ffffffff01c0cb1707000000002252208640c68f13b51a1e63dfc5cc41202cca21c18f1f9d7037c2cbec3f03f63e52e400000000",
+ "utxosSpent": [
+ {
+ "scriptPubKey": "52208640c68f13b51a1e63dfc5cc41202cca21c18f1f9d7037c2cbec3f03f63e52e4",
+ "amountSats": 50000000
+ },
+ {
+ "scriptPubKey": "522018b6491469cc78b764b01669b0a5a4e892f57e8c1b20b89bc1ca6dce3e881b51",
+ "amountSats": 70000000
+ }
+ ]
+ },
+ "inputSpending": [
+ {
+ "given": {
+ "txinIndex": 0,
+ "internalPrivkey": "edc07892ebcc0812db6aea0fbc967eed825fedecf70db83d4c69fbe574b97361",
+ "aggMode": "0xbd",
+ "hashType": 1
+ },
+ "intermediary": {
+ "internalPubkey": "020be368e697e135d54cd88e86b42c0b5e3e72d4b0c77632a8a4d0441203ded5",
+ "tweak": "22b1442d7532c6cdbe4d9854a90b8f7a5820c559af2ca6f7d375e6fc3bfd8a09",
+ "tweakedPrivkey": "1071bcc060fecee099b8826465a20e691fd1d65ff6f1bef9600d8454e080bc29",
+ "sigHash": "9339267f5f6715d1b7e1b26bd69e13689b3872be5fa0c50a9d90daf9f2ae46cc"
+ },
+ "expected": {
+ "witness": [
+ "01"
+ ]
+ }
+ },
+ {
+ "given": {
+ "txinIndex": 1,
+ "internalPrivkey": "80f4d8f499868a546ca66497352d4df0aa1c7e99cd83faeba3eeb11ecafec708",
+ "aggMode": "0xbd",
+ "hashType": 1
+ },
+ "intermediary": {
+ "internalPubkey": "0fef9c578d084fb5f7c8fe48a570dc644609cc012a356fdd0c056f674f9455c0",
+ "tweak": "85fb96a1a8a6c3a93ebfaf308aecc9837eceb6cfda6eb735cf8586e989a87563",
+ "tweakedPrivkey": "0506bdad0f203954d2194a9955bf7b92d4b238360ceabc4a2b96d5cabea9ae5b",
+ "sigHash": "d2982e6665e1e964ecefa2a747b19f17ad46d6765e284d639c293647c9349857"
+ },
+ "expected": {
+ "witness": [
+ "4be941b64750c3c7746300107ddcb53de5a1a4e106938eed846bad8493d1e95272717f49232d9639b988cf0a135df878463dd5680bfc71c407d11cc09a42677e01bd"
+ ]
+ }
+ }
+ ],
+ "auxiliary": {
+ "secnonces": [
+ "87c33dcedc7db5994d68278a81a4693ee961d08ef7e3fdeab611ab8061e92dd4517ac39af981926ed1124224dfe721c6dc0769a8ea24d2e2fc2636c3b1e9ca15",
+ "3c4b7832dd37bbdb955ebf900769d133d55161e5c6ad9e09c2efa4ace1ba2e153d007745e9f74e6b8a47651a672111b07589261401674263a40e286340bcefea"
+ ],
+ "pubnonces": [
+ "021be5111aa027a4b7368d88cb0f5419f7b530e17e41af6fe7a611a03abc9bab63020e72955a3c53f163a1373ac5233ad30ff8bb4ef69dad424d91529c0ef6329ac6",
+ "0367b7d091e6b58f7e94e9228393bc6b777e9fbe0186e9fce56248c9177c96f65e03592137dea3431dbb0fbe1287c35f8e44a30d68e62486969d21e90d2b4c68f05e"
+ ],
+ "aggregateSignature": "4be941b64750c3c7746300107ddcb53de5a1a4e106938eed846bad8493d1e95272717f49232d9639b988cf0a135df878463dd5680bfc71c407d11cc09a42677e"
+ },
+ "expected": {
+ "rawSignedTx": "0200000000010254d36a0897340110cc34b526d73b206175ae4f5db4d25fe7bdeef3a8a5e89afd0100000000ffffffff835a02826d69e61b563ec713020bd2b7c3bc3848223cda2b3c52bbdcd3e6267a0100000000ffffffff01c0cb1707000000002252208640c68f13b51a1e63dfc5cc41202cca21c18f1f9d7037c2cbec3f03f63e52e401010101424be941b64750c3c7746300107ddcb53de5a1a4e106938eed846bad8493d1e95272717f49232d9639b988cf0a135df878463dd5680bfc71c407d11cc09a42677e01bd00000000"
+ }
+ }
+ ],
+ "scriptPathSpending": [
+ {
+ "description": "Script path spend of a witness v2 output with a single CHECKSIG leaf, following BIP 341/342 unchanged",
+ "given": {
+ "rawUnsignedTx": "02000000019d159d40bef848f021458aee62eecb1006f6e987d41b8af985dcb13cf97b47d60000000000ffffffff01c09ee605000000002252204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b00000000",
+ "utxosSpent": [
+ {
+ "scriptPubKey": "5220e8605ff15e754192a9d6c053969ae935932c82ceaeea0fed9a152f0c6b4b424b",
+ "amountSats": 100000000
+ }
+ ],
+ "internalPubkey": "39920c3a54000624c1923187eebbbd3fcdc409302757139c1a1b003bc9276da4",
+ "script": "2038c01dda6433ce79606dda3f70ee5dd525104bbbba5b0fd96f56d6d634e92f71ac",
+ "leafVersion": "0xc0",
+ "hashType": 0
+ },
+ "intermediary": {
+ "leafHash": "d888fa5463776e32e8b0fddf14df8b3862673078395cbc592c10912056af7c52",
+ "tweak": "543da6eae6544c2af0aa1c684f67bf908059153e077714caa4af34da3bd72ae6",
+ "tweakedPubkey": "e8605ff15e754192a9d6c053969ae935932c82ceaeea0fed9a152f0c6b4b424b",
+ "controlBlock": "c139920c3a54000624c1923187eebbbd3fcdc409302757139c1a1b003bc9276da4",
+ "sigHash": "ea23ae9afeeb7f6e5e6aa6ca278eee5071aa9f20ca843a590b28f0faf9df058c"
+ },
+ "expected": {
+ "scriptPubKey": "5220e8605ff15e754192a9d6c053969ae935932c82ceaeea0fed9a152f0c6b4b424b",
+ "address": "bc1zaps9lu27w4qe92wkcpfedxhfxkfjeqkw4m4qlmv6z5hsc66tgf9sg52494",
+ "witness": [
+ "3f748f6e85b7064aa161a2e35ed5d17f540a2de4975c690739a04af70adf372b6daa1b3a27d553c38e12547289803aeb2d726187cdf6faec419e5cd864391460",
+ "2038c01dda6433ce79606dda3f70ee5dd525104bbbba5b0fd96f56d6d634e92f71ac",
+ "c139920c3a54000624c1923187eebbbd3fcdc409302757139c1a1b003bc9276da4"
+ ],
+ "rawSignedTx": "020000000001019d159d40bef848f021458aee62eecb1006f6e987d41b8af985dcb13cf97b47d60000000000ffffffff01c09ee605000000002252204049ce224d4b6407e9c7864e88d8020996beb04663cd1596bf4ff8ab335bc57b03403f748f6e85b7064aa161a2e35ed5d17f540a2de4975c690739a04af70adf372b6daa1b3a27d553c38e12547289803aeb2d726187cdf6faec419e5cd864391460222038c01dda6433ce79606dda3f70ee5dd525104bbbba5b0fd96f56d6d634e92f71ac21c139920c3a54000624c1923187eebbbd3fcdc409302757139c1a1b003bc9276da400000000"
+ }
+ }
+ ]
+}