What is the control block in Taproot?

Question

What is the definition of "control block" in the context of Taproot?

It is referred to in standard.cpp in the Bitcoin Core repo and in BIP 341.

Answer 1

There are two possible ways of spending a Taproot output:

• Through the key path: simply providing a BIP340 signature signing the spending transaction with the public key in the output.
• Through the script path: revealing that the output was in fact a tweaked key, by revealing the original and the tweak, and showing that this tweak commits to a script leaf. This is where the control block comes into play.

When spending through the script path, the signer has to provide a number of pieces of data to let their spend be verified:

1. The revealed script.
2. The inputs needed to satisfy that script (signatures and whatever other data it may need).
3. The leaf version (for now, always 0xc0, as specified in BIP342).
4. The internal key (the public key before tweaking)
5. The Merkle path to prove that the tweak commits to the revealed script and leaf version (#1 and #2).
6. A sign bit to indicate whether the output key was negated or not (this is necessary to enable batch validation).

The tweak itself is not revealed. It is recomputed by the verifier from the revealed script, leaf version, and internal key. Then it is verified that tweaking the internal key with that tweak matches the public key in the output being spent.

This brings us to the question of how all this information is encoded in the spending input's witness stack:

• First, all the inputs to the script being spent (#2 above)
• As penultimate item, the revealed script (#1 above)
• As final item, the control block, which contains all the other information:
  • Its first byte stores the leaf version (#3) (top 7 bits) and the sign bit (#6) (bottom bit).
  • The next 32 bytes store the (X coordinate only, because x-only key) of the internal public key (#4)
  • Every block of 32 bytes after that encodes a component of the Merkle path (#5) connecting the leaf to the root (and then, the tweak), going in bottom-up direction.

Answer 2

The control block is the data required to prove that a specific script is within the Taproot tree (script path).

Murch defines the control block here (replacing "inner key" with "internal key"):

When a fallback to the backup key is necessary, the existence of the Taproot tree must be revealed. If there is only a single leaf, the spender provides only the internal key. Tweaking the internal key with the hashed leaf results in the public key. In sum, the data necessary to prove the existence of a script path is called the control block.

BIP 341 adds additional details on the "control block":

The last stack element is called the control block c, and must have length 33 + 32m, for a value of m that is an integer between 0 and 128, inclusive. Fail if it does not have such a length.

To prove D (the hash of a particular script) is in the Taproot tree, the control block would need to contain the following data in this order:

<control byte with leaf version and parity bit> <internal key p> <C> <E> <AB>

To prove D is in the Taproot tree you need to be able to hash up to the Merkle root (ABCDE) and to do that you need to hash C with D, then E with CD, and then AB with CDE.