Skip to main content
Share Your Experience: Take the 2024 Developer Survey
7 votes
Accepted

How to tweak a public key for Taproot

That's exactly right. Compute the tweak H(P||c), compute the "public key" corresponding to that tweak, and then add (elliptic curve point addition) the internal public key with that tweak ...
Pieter Wuille's user avatar
5 votes
Accepted

What does it mean to tweak a public key?

The Bitcoin Optech Taproot workshop defines it as: Tweaking a public key means to alter it with a value (the tweak) such that it remains spendable with knowledge of the original private key and tweak....
Michael Folkson's user avatar
5 votes

What is an adaptor signature?

In 2017, Andrew Poelstra published a scientific paper describing Adaptor Signature, inside the signature. This is extremely interesting, since in the case of electronic financial transactions, for ...
Pegasus's user avatar
  • 121
5 votes

Is tweak used when spending from script path for Taproot?

You perform tweaking at signing time if the key you're signing for was tweaked. That's a decision that was made when the output was constructed, not when it is spent. Taproot outputs can consist of: ...
Pieter Wuille's user avatar
5 votes
Accepted

Signing taproot key-path transaction from rust-bitcoin

It looks like you're using the Transaction::signature_hash method to compute your signature hash -- this is used to compute legacy (pre-segwit!) signature hashes, and we've been unfortunately very ...
Andrew Poelstra's user avatar
4 votes
Accepted

What does Pay to Contract (P2C) mean?

The actual protocol as described all the way back in 2012 in the paper Homomorphic Payment Addresses and the Pay-to-Contract Protocol is a bit more complicated, but the basics are as you've described ...
Vojtěch Strnad's user avatar
4 votes
Accepted

Why don't add salt to the tapscript in Taproot?

In general this shouldn't be a concern, as every script almost certainly contains at least a public key, and you can use fresh public keys in every branch. If you're still concerned about privacy of ...
Pieter Wuille's user avatar
2 votes
Accepted

Can you use un-tweaked public key with P2TR?

It depends on what you mean by public key. P2TR outputs encode an "x-only pubkey", that is a public key with just the X coordinate. The Y coordinate is implicitly the even one (on elliptic ...
Pieter Wuille's user avatar
2 votes

Why don't add salt to the tapscript in Taproot?

Salts are used for things like password storage where multiple users may be using the same password. By using a salt it obfuscates to an observer of the database which users are using the same ...
Michael Folkson's user avatar
2 votes
Accepted

Which private key is used in Taproot transactions?

In a key path spend, you always sign with the private key corresponding to the output key. If that key is a tweaked public key (it's recommended to always use a tweaked key), you will also need to ...
Vojtěch Strnad's user avatar
2 votes
Accepted

Do we need a taproot commit for multisignatures if there is no script path, but we are using the MuSig2 protocol?

Is there any need for addition key tweaking if we use MuSig2 protocol for multisignature? Citing BIP341: Why should the output key always have a taproot commitment, even if there is no script path? ...
Pieter Wuille's user avatar
2 votes
Accepted

How to get signature for tweaked public key in P2TR in case of multiple signature?

To sign for an aggregated public key you need to run the respective collaborative signing protocol (e.g. if you use MuSig2 key aggregation to aggregate the keys, you need to run the MuSig2 signing ...
Pieter Wuille's user avatar
2 votes
Accepted

What would happen if you tweaked a public key with an odd y-coordinate?

My question is: what would happen if you had a secret key that produced a pubkey with an odd y-coordinate, e.g. 03af455f4989d122e9185f8c351dbaecd13adca3eef8a9d38ef8ffed6867e342e3, but then simply ...
Michael Folkson's user avatar
1 vote
Accepted

I get an Invalid Schnorr signature when trying to broadcast a taproot transaction

Fixed it, the main problem is that: # Sending wallet creation sendPrivKeyParsed1 = ECKey().set(int('SENDING PRIVATE KEY IN INTEGER')) sendPubKeyObj = sendPrivKeyParsed1.get_pubkey() recPubKeyBytes = ...
ChristianOConnor's user avatar
1 vote
Accepted

Retweaking other person's or my own taproot address

No, this would likely lead to a loss of funds. Key tweaks are created by a recipient who tweaks a key before sharing the resulting tweaked public key in the form of a destination address. If you tweak ...
Murch's user avatar
  • 75.7k
1 vote

Retweaking other person's or my own taproot address

BIP341 recommends tweaking even public keys which have no intended script path, with a dummy tweak. This prevents certain attacks (though none relevant in your scenario). You can tweak an existing ...
Pieter Wuille's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible