I want to struct a transaction output the key-path of which I want to be eliminated, so enforcing only the script path. In order to eliminate key-path, in my opinion, I should set "Internal Public Key" to "0xFFFFFFFFFFF.." making the corresponding "Internal Private Key" unknown so the key-path signature is. By doing so anyone interested in unlocking this output, including me, must follow the script path by fulfilling its conditions. Correct me if I'm wrong. Thanks.

enter image description here

1 Answer 1


BIP 341 answers this. It is generally important to be able to prove that the internal public key that you choose is a point with an unknown private key. Otherwise a malicious party could hide a key path spend in the P2TR address, pretend not to have the private key for that internal public key but actually possess it.

BIP 341 also provides instructions on how to avoid leaking the fact that the P2TR address had no possible key path spend when it is spent from. If you don't care about this privacy leak you could just take the suggested point H.

Pick as internal key a point with unknown discrete logarithm. One example of such a point is H = lift_x(0x0250929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803ac0) which is constructed by taking the hash of the standard uncompressed encoding of the secp256k1 base point G as X coordinate.

In order to avoid leaking the information that key path spending is not possible it is recommended to pick a fresh integer r in the range 0...n-1 uniformly at random and use H + rG as internal key. It is possible to prove that this internal key does not have a known discrete logarithm with respect to G by revealing r to a verifier who can then reconstruct how the internal key was created.

A closely related question is on how to grant access to a key path spend but not a script path spend.

  • 1
    Thanks! I publicly need to prove the fact that key-path spending is not possible at all. So either pick a point with an unknown discrete logarithm or pick a public key whose private key cannot be constructed.
    – Brqoo
    Commented Oct 29, 2020 at 22:17
  • 2
    The internal public key needs to be a point on the curve, different from infinity. So that implies that it has a discrete logarithm. Commented Jun 10, 2021 at 16:33
  • Hey, can you point out how to achieve this in JS, please? I'm having a hard time finding a library that does lift_X.
    – pxr_64
    Commented Jun 27, 2023 at 16:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.