Here seeking information. I have 2 questions marked with parens

Would like some clarification pertaining to the Mark Friedenbach article:

The point of contention with Mark seems to be with the space savings for the N-N Musig2 everyone signs/happy path, being embedded into the the root of the MAST/Taproot, thus exposing a pubkey in an output that sits on the blockchain.

(1) please correct if I'm wrong about the way I'm describing this.

I did see Pieter's presentation at Bitdevs from a while back reference, "plain pubkey security model in mind" for taproot. But, it wasn't apparent that this would hypothetically make it quantum vulnerable,.. as Mark's article says, "a naked secp256k1 pubkey on chain at the time the output is created which has absolute spend authority for the underlying bitcoins".

(2) Would love for someone to rebut or verify this claim.

  • 1
    See bitcoin.stackexchange.com/a/95133/208 Commented May 24, 2021 at 2:08
  • Help me understand something.. a pubkey for bech32 (native segwit v0) is only revealed on a spend. Segwit v1 will make it where a pubkey is available before a spend? Commented May 24, 2021 at 3:13
  • 2
    Yes, the (tweaked) pubkey goes directly in the scriptPubKey. Commented May 24, 2021 at 3:43

1 Answer 1


See Pieter's responses. (1) seems ok (2) Mark's concern is real, but worry about exposing the tweaked pubkey doesn't seem to be of a high concern to people supporting Taproot. In ref to Taproot exposing pubkey, "numerous advantages (it's smaller, cheaper, and makes a number of more advanced protocols on top a lot easier)."

"TL;DR: public keys should be public."

Quotes from: What are the potential attacks against ECDSA that would be possible if we used raw public keys as addresses?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.