2

Suppose I get a taproot address=schnorr public key from an exchange that is not tweaked using mast merkle root and I wish to tweak that public key.

This will yield a potentially different public key.

  1. Can I do this?
  2. If I Do this, will the exchange still recognize my deposit?
  3. In general, can I re-tweak already tweaked public keys at will?

Thanks.

Improve this question
4
  • to explain my motivation more in depth, it would be cool if users could be embedding additional data on chain into the tweaks, similar to how they do now with OP_RETURN just privately
    – Hugo Franklin
    Commented Jun 17, 2021 at 18:50
  • Sounds like an XY-problem. You should consider asking another question, but directly about the issue you want to solve rather than an approach you are considering. :)
    – Murch ♦
    Commented Jun 17, 2021 at 18:57
  • meh not really. it would be still cool because 1MB of pubkeys + 1MB data in tweaks > 1MB not tweaked pubkeys
    – Hugo Franklin
    Commented Jun 17, 2021 at 19:06
  • It sounds like you may be looking for sign-to-contract: blog.eternitywall.com/2018/04/13/sign-to-contract. That's a scheme that allows for a signature to commit to arbitrary data, without making it larger. This has the advantage that public keys are not modified, and thus it is purely a signer-side issue.
    – Pieter Wuille
    Commented Jun 17, 2021 at 20:09

2 Answers 2

Reset to default
1

No, this would likely lead to a loss of funds. Key tweaks are created by a recipient who tweaks a key before sharing the resulting tweaked public key in the form of a destination address.

If you tweak a foreign key, the original intended recipient would have no way of recognizing independently that that their key is associated with the new address at all, and very likely would be unable to spend the funds even when informed about the tweak.

Improve this answer
3
  • Are you sure there's a loss of funds? Even If I reveal the tweak + original pubkey + new pubkey to the exchange?
    – Hugo Franklin
    Commented Jun 17, 2021 at 18:40
  • 2
    Yes. What if e.g. the recipient uses a Hardware Security Module that can only sign for addresses they generated? The recipient specifies under what circumstances they recognize a payment. The sender has no business making assumptions how they may modify that.--If your landlord tells you that they expect to be paid by check in the mail, you don't bury a bag of quarters in their frontyard and tell them where to dig, do you?
    – Murch ♦
    Commented Jun 17, 2021 at 18:45
  • 1
    Or worse, don't tell them where to dig, and then act all confused and surprised when they ask you about the money.
    – Pieter Wuille
    Commented Jun 17, 2021 at 19:30
1

BIP341 recommends tweaking even public keys which have no intended script path, with a dummy tweak. This prevents certain attacks (though none relevant in your scenario).

  1. You can tweak an existing public key, yes, but the address will get another meaning.

  2. Absolutely not. Only the receiver's software determines which address they accept coins on. If you pay to anything else, you should assume the coins are sent into the void. It is possible that say an exchange can still access the coins with their keys if you inform them of the tweak, but this cannot be relied upon. The private keys may be in a hardware security module or so, which has no means of signing for anything but the intended address.

  3. In a way, yes, but that turns it into another address, with other semantics.

In theory, if someone has the ability to sign for a public point P, they can sign for a tweaked version of P, assuming they know the tweak. The tweak cannot be inferred from the tweaked point; it has to be conveyed separately. This also works recursively, because if you can sign for a tweaked version, you can also signed for a tweak of that. Again however, this is theory and cannot be relied upon in practice. Only the receiver determines which address they accept.

Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.