I want to struct a transaction output the key-path of which I want to be eliminated, so enforcing only the script path. In order to eliminate key-path, in my opinion, I should set "Internal Public Key" to "0xFFFFFFFFFFF.." making the corresponding "Internal Private Key" unknown so the key-path signature is. By doing so anyone interested in unlocking this output, including me, must follow the script path by fulfilling its conditions. Correct me if I'm wrong. Thanks.

enter image description here


BIP 341 answers this. It is generally important to be able to prove that the internal public key that you choose is a point with an unknown private key. Otherwise a malicious party could hide a key path spend in the P2TR address, pretend not to have the private key for that internal public key but actually possess it.

BIP 341 also provides instructions on how to avoid leaking the fact that the P2TR address had no possible key path spend when it is spent from. If you don't care about this privacy leak you could just take the suggested point H.

Pick as internal key a point with unknown discrete logarithm. One example of such a point is H = lift_x(0x0250929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803ac0) which is constructed by taking the hash of the standard uncompressed encoding of the secp256k1 base point G as X coordinate.

In order to avoid leaking the information that key path spending is not possible it is recommended to pick a fresh integer r in the range 0...n-1 uniformly at random and use H + rG as internal key. It is possible to prove that this internal key does not have a known discrete logarithm with respect to G by revealing r to a verifier who can then reconstruct how the internal key was created.

A closely related question is on how to grant access to a key path spend but not a script path spend.

| improve this answer | |
  • Thanks! I publicly need to prove the fact that key-path spending is not possible at all. So either pick a point with an unknown discrete logarithm or pick a public key whose private key cannot be constructed. – Burak Keceli Oct 29 at 22:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.