From what I know, to tweak a public key, I can use:

Q = P + H(P|c)G


Q is the tweaked public key
P is the initial public key (P = xG where x is the private key)
H is the hash function
| is concatenation
c is the commitment to the script path spend
G is the generator point

This might seem like high school math but can I calculate the H(P|c)G part by using the result of H(P|c) as a private key and computing the public key from it? I think this might work because the H() returns a 32 byte array and the result could be casted as a private key then multiplied by generator point G to get the corresponding public key which is equal to H(P|c)G?

  • I don't understand the question. xG is the public key of x. So if you substitute H(P|c) for x then xG is now the public key of H(P|c). Is that what you are asking? You are effectively adding two public keys to get Q, the tweaked public key. Oct 26, 2021 at 14:19

1 Answer 1


That's exactly right.

Compute the tweak H(P||c), compute the "public key" corresponding to that tweak, and then add (elliptic curve point addition) the internal public key with that tweak public key.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.