PISA Demo Uses One Signature to Cut 16 vB From Bitcoin Transaction

A prototype called PISA combines Payjoin and cross-input signature aggregation in a two-input Bitcoin (BTC) transaction, cutting 16 virtual bytes (vB) by using one 64-byte aggregate signature for both inputs.

Fabian Jahr announced the demo Oct. 23, describing it as work built at Lugano’s Plan ₿ event with support from Cypher Tank. Payjoin Dev Kit and Brink collaborated on the project. The event was part of the Plan ₿ Forum, scheduled in Lugano for Oct. 23-24.

Payjoin lets a sender and receiver contribute inputs to the same transaction. That can weaken the common-input-ownership heuristic, an assumption that all transaction inputs belong to the same owner. Combining inputs from both parties can make that ownership inference less reliable.

CISA works on a separate transaction feature: signature data. By aggregating signatures across inputs, it reduces the space they use. CISA does not itself provide Payjoin’s privacy feature; the demo combines the two mechanisms, with each serving a different purpose.

The 16-vB figure measures transaction size rather than a set fee reduction in dollars or satoshis. Each input added after the first in an aggregation group saves a further 64 weight units, or about 16 vB. The prototype’s stated result is in size units, not a fixed monetary discount.

The prototype runs only on regtest, Bitcoin’s testing environment, and requires a Bitcoin Core build that validates BIP 460. It also depends on a branch of the Payjoin crate, a software library, that supports the aggregation fields. Those requirements confine the demonstration to a development setup.

PISA uses the asynchronous Payjoin specification in BIP 77, which is marked Draft. The Simple Payjoin specification, BIP 78, has Deployed status. The CISA proposals are split across BIP 458 for half-aggregation, BIP 459 for full aggregation and BIP 460 for transaction-level integration; all three remain open pull requests. The BIP 460 integration targets Taproot-style key-path spends.

Under BIP 459, full aggregation uses interactive signing to produce a 64-byte signature; PISA demonstrates one shared signature for two inputs. The project remains a prototype and is not ready for real coins, so its savings are not available on Bitcoin’s live network.