I know that Bitcoin can do Schnorr which allows for one way to finalize an atomic swap but on the other side of the current swap implementation( that I am working with), the script needs to multiply a scalar by the curve generator to check for the correct secret scalar value. Is there a way Bitcoin script can handle this?

1 Answer 1


If I got your question right, you need to check if someone actually have a scalar s such that s*G == S? If you need to explicitly commit to s, like:


where OP_ECC_MULL_G multiplies a scalar s by secp's generator point. This is impossible to do with script, as it doesn't expose ECC operations directly.

If you just want to check whether the party has the secret, this is just a simple signature: <S> OP_CHECK_SIG_VERIFY. One can only satisfy this script iff they known s

  • Thank you it does make sense to use OP_CHECK_SIG_VERIFY the main question now is will the public key for a script that just checks for OP_CHECK_SIG_VERIFY on s look like sG or something similar? If so then that will satisfy the requirements, but if the value can not be represented in a public way like this the other party can't audit the swap which is essential. Is this basically just creating a regular public key? Or would I need to do something else.
    – Poseidon
    Mar 2, 2023 at 20:20
  • 1
    You have to publish the public key sG and the signature. For taproot, the public key will go in the spk, and the signature will be in the witness. The public key will always be available for verification... Mar 2, 2023 at 22:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.