Taproot allows to hide a script behind a transaction and only release the relevant information when the output is being spent. Would this allow for a construction of a script with N participants + initiator to generate a script where all N participants have to sign it and the initiator finally signs? Would the MAST reveal all other signers or just the initiator who finally signs the script and can proof that he followed its rules?
4
-
4The question is a bit confusing. CoinJoin refers to having a transaction with multiple inputs where each input comes from a different participant. The rest of your question seems to be about a single input that multiple parties need to sign for. Which of the two is it? (in case of the first the answer is no, in case of the second the answer is yes with some caveats).– Pieter WuilleCommented Sep 17, 2019 at 15:54
-
@PieterWuille Thanks for your answer! It's kind of both, is it possible to collaborate for N participants to create a decentralised, trustless mixing of coins to increase privacy?– janowitzCommented Sep 18, 2019 at 15:28
-
1Possibly, but that's completely unrelated to Taproot/MAST, as those are things inside an individual output (and inputs that spend them), not across inputs.– Pieter WuilleCommented Sep 18, 2019 at 17:05
-
Thank you for clarification, @PieterWuille! I will have to look deeper into Schnorr & Taproot, but there is not much understandable literature out there yet...– janowitzCommented Sep 18, 2019 at 18:59
Add a comment
|
1 Answer
As per my understanding what you are proposing can be achieved with Schnorr signatures, which will be implemented with Taproot. Since Schnorr signatures permit key aggregation, you can construct a single public key (threshold public key) from multiple participant public keys, which in your case is N + initiator. When spending you can just combine the signature from all the parties together (threshold signature) and spend it. The threshold public key and threshold signature are indistinguishable from their single-party equivalents. So for an outsider, it might be as though a single person signed it.
MAST is used to reveal only one spending condition while hiding others. For example, say you have a transactio which states that for first 100 days, you require N and initiator. From 100 to 200 days you require M of N and the initiator and after 200 days you only need the initiator. Currently when spending such transaction you need to reveal the entire spending script. With MAST you can consider each spending condition as a branch of the Merkle tree. When spending that output you just need to reveal the branch that you are spending thus allowing you to conceal the other branches from the public.
answered Sep 17, 2019 at 11:08
