3

In some analyses of chain activity, I sometimes see Taproot spends divided into key path and script path.

  1. Why are they called that?
  2. Which BIPs should I read to learn more?
  3. When I look at a P2TR tx in mempool.space, is there a way I can tell if an input is a key path or script path spend?
  4. What does an ordinary P2TR payment use?
  5. What does a MuSig2 payment use?

1 Answer 1

5

Taproot is specified in BIP341 which also includes much relevant information such as motivation and rationale. My answer will essentially just rephrase some of its highlights.

Key path spends and script path spends are two distinct ways of spending a Taproot output. In a key path spend the sender just provides a signature that's valid for the public key in the P2TR output and the transaction being signed. In a script path spend the sender needs to provide a script, a proof that the P2TR output commits to this script (called the control block) and the initial stack to the script in order to satisfy it (which will generally include at least one signature).

You can tell if an input is a key path spend or a script path spend by how many witness items there are in its witness stack. If there is exactly one element in the witness stack1 it is a key path spend, otherwise it is a script path spend. See an example transaction that has two inputs, one of which is a key path spend and the other is a script path spend:

37777defed8717c581b4c0509329550e344bdc14ac38f71fc050096887e535c8

Key path spending should be used when possible as it's cheaper and doesn't reveal the existence of a possible script path. Only when the key path cannot be used (for example when agreement cannot be reached in a multiparty protocol) should the script path be used as a backup.

MuSig2 uses aggregated keys, which are indistinguishable from ordinary keys and can likewise be used in both key path and script path spending.


1 If there are at least two witness items and the last one starts with 0x50, it is the optional annex and it's removed before checking whether the input is a key path or script path spend.

2
  • Thank you very much! That's a great answer. That's a great example too, I can definitely tell the script path spend since it's much bigger. I don't think that's a reliable heuristic however, since a keypath spend could also stuff a bunch of data into the witness, correct? Commented Jun 15, 2023 at 15:48
  • 3
    No, a key path spend cannot have any witness items apart from the signature and the optional annex. It's not a heuristic, it's literally how the consensus rules are defined. Commented Jun 15, 2023 at 16:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.