Hot answers tagged

13

MuSig is interactive because each signer needs to provide a signature nonce (effectively randomness) before signing. This is not specific to MuSig, but applies to any discrete logarithm-based multisignature scheme as far as I know. Now to understand why multiple communication rounds are necessary let's look at what happens at each of them, starting from the ...


13

Background P2TR addresses will be encoded using Bech32, although likely an amended version. In anticipation of Taproot getting merged, some proponents tested the behavior of various wallets and services regarding segwit v1 outputs. BIP173 prescribes that known restrictions should be enforced for Bech32 addresses, but that "implementations MUST allow the ...


12

The first output of transaction b53e3bc5…5377f141 has the following scriptPubKey: OP_PUSHNUM_1 OP_PUSHBYTES_32 01010101…0101010101 The segwit softfork in 2017 defined versioning rules for all native segwit outputs, but only defined spending rules for version 0.¹ This output worth 5431 satoshis matches the native segwit schema, but the leading OP_PUSHNUM_1 ...


11

From the (very recently updated) bip-schnorr draft: Implicit Y coordinates are not a reduction in security when expressed as the number of elliptic curve operations an attacker is expected to perform to compute the secret key. An attacker can normalize any given public key to a point whose Y coordinate is a quadratic residue by negating the point if ...


10

Wallets SHOULD allow sending to P2TR addresses at this point, but wallets MUST NOT generate P2TR addresses before the spending rules are enforced on the network1. The design of segwit anticipated the lenghty process that is the adoption of optional features. Case in point, segwit activated in August 2017, yet Blockchain.com, a wallet service provider ...


8

There is the annex, leaf version, ext_flag, OP_SUCCESS, unknown pubkey types and you could probably include the existing witness version too. I believe that list is exhaustive. The ext_flag isn't so much an extension mechanism in itself; more a structure that permits safely reusing the sighashing code (as opposed to needing a new tag or other mechanism for ...


8

Beginning with Taproot? Hmm... Something about this feels scary to me. Your mistrust is misguided. So, they are no longer making "signed" installers? The releases are still signed with the release GPG key, what is lacking is the Windows specific binary signatures which have to be made by a paid certificate by one of several authorities Microsoft ...


7

Taproot generally has two ways of spending. The default way is to spend the output using the key path: pay-to-taproot then behaves like a p2pk output except that it is using a schnorr signature and the corresponding address being encoded using bech32. The alternative is to reveal that the inner key was tweaked with the root of a Merkle tree, the Merkle path ...


7

A P2WPKH PubKey is shorter than a P2WSH PubKey. No, not quite. A P2WPKH address is shorter than a P2WSH address. The addresses are both based on a hash of the underlying witness program (i.e. the locking conditions of the output). In the case of Pay to Witness Public Key Hash (P2WPKH) the witness program contains only the public key. On the other hand, Pay ...


6

Taproot allows inputs to hide the fact that there is a script specifying a contract. If sufficient parties involved in that contract agree and cooperatively spend the Bitcoin, that input looks just like any other input, including ones that do not have contracts and have only one person. This helps privacy as the conditions of a contract are hidden. This ...


6

To add to Michael Folkson's answer, a question one may have is what the differences are between witness versions and leaf versions. Why do we need both? Leaf versions are not revealed until an output is spent, and thus is not known in general to the payer (who is only given an address). For native witness outputs, the witness version is visible from the the ...


6

SegWit introduced versioned witness programs. When satisfying a script to spend coins you need to provide a redeem script consisting of a version byte and a witness program. The version introduced with SegWit was version 0 (zero). The Taproot proposal uses this SegWit versioning system by introducing spending rules for version 1. The witness program to ...


6

I think that's both very premature, and misses the point. Simplicity is a completely different approach to scripting, with significant advantages, but it's being designed from the ground up. There is lots of progress, but it will require more than just the base layer. You can't just write scripts in Simplicity, and if you have one, you can't just sign for it....


6

Taproot benefits everyone who uses it, but it has the most benefit to those who use complex scripts and multisigs. Since that group is a small portion of users of Bitcoin, that may be why some people are saying it is useful only to that small part of the population. However I would not characterize such statements as meaning Taproot is not useful to anyone ...


6

With respect to the original wording of the question I believe Taproot will actually make the Lightning Network pointfull instead of pointless. While Taproot allows us to save some space on the bitcoin base layer, it will not make the Lightning Network obsolete. Remember, the main issue with respect to on-chain scaling is that a protocol in which every ...


6

Will Taproot allow me to skip Lightning Network and simply use pure Bitcoin Core? Well, Bitcoin Core doesn't support Lightning for now, and probably won't for the foreseeable future, but there is no reason why that can't change over time. I'm going to assume your question is: Will Taproot allow getting all the benefits the Lightning Network provides with ...


6

Bitcoin transactions require a certain size and with taproot and tapscript we can decrease that size. This means that effectively we will be able to store more transactions in one block allowing overall a slightly higher throughput of bitcoin transactions in the network. So even if you continue to use legacy transaction formats you might still benefit from ...


6

As far as I can tell, P2TR is better than P2WSH in almost every way. I cannot think of a case in which it would be a significant advantage to use P2WSH over P2TR, except that P2WSH is already established. Privacy P2TR outputs will stand out at first since there will be few of them. In the long term, the anonymity set of P2TR is likely to be larger since both ...


5

I think it's important to note first that BIP341-BIP342 are improvements to the Bitcoin script "framework" more than they are improvements to the smart contracting "functionality". All Bitcoin scripts can do in practice is enforce combinations of conditions on signatures by certain (sub)sets of signers, timelocks, and revealing hashes. At ...


5

Previous Bitcoin Core PR review club sessions A good starting point is the various Bitcoin Core PR review club sessions that have been held thus far on specific commits of the Taproot PR. The latest one was on "Implement Taproot validation" (hosted by John Newbery) and there are various notes and a transcript of the meeting there. There are also ...


5

The idea of Merklized Alternative Script Trees (or previously Merklized Abstract Syntax Trees) dates back to an idea Russell O'Connor had in 2012. The original idea was that you could have alternative scripts or script fragments stored as leaves in a Merkle tree and then the leaves of the tree that weren't used could be pruned away and not take up valuable ...


5

Yes, you can commit to data this way, but there is nothing special about Taproot here. The Pay-to-Contract construction used to tweak the root key in Taproot is generally usable, and has in fact been used for exactly this purpose. In fact, it is one of the mechanisms used in OpenTimestamps to commit to timestamped data (including a variant sign-to-contract ...


5

In addition to what Rene wrote, the adoption of Taproot will provide many bitcoin user's with a higher degree of privacy. The structure of a bitcoin transaction can contain clues about the nature of that transaction. By using certain heuristics, anyone watching the blockchain record can group together certain transactions and addresses, to attempt to ...


5

Taproot inputs are smaller but outputs are larger. Specifically, P2WPKH (Native SegWit) inputs and outputs take 68 and 31 vbytes in a transaction, respectively, while P2TR (Taproot) inputs and outputs take 57.5 and 43 vbytes, respectively. In terms of fees this makes Taproot transactions about 1.5% more expensive when you don't use multisig or scripting. ...


5

To add to Murch's answer: The output was created by Matthew Zipkin to test support for sending to SegWit v1 support on purse.io. This was done in the context of the Bitcoin Optech Compatibility Matix. Here is a screenshot of the purse.io withdrawal that was added in PR 303 to the Bitcoin Optech website.


4

If this question is about the recently published bip-taproot proposal, the answer is no, you cannot use a v0 script inside a v1 output. The general reason for this is that some of the goals the BIP is trying to achieve are incompatible with v0 scripts. That on itself doesn't make it impossible to support v0 scripts, but reasoning about the benefits of the ...


4

This particular response is approximately tripe. Building on Pieter Wullie's comment. find an appropriate post-quantum DSA and it might push the the time to make Bitcoin quantum-secure from 5-10 to 10-20 years, as much more research is needed. We really know what to do to make Bitcoin Quantum safe, there's been methods for doing hash based ...


4

You may have heard before that "Bitcoin is programmable money". Bitcoin uses a simple programming language called Script to encode payment conditions. While today the vast majority of transactions uses standard single-sig outputs (P2PK, P2PKH, P2WPKH) or one of a small set of common scripts (wrapped segwit, 2-of-3 multisig, 2-of-2 multisig with 1-...


4

Pieter Wuille answered this on Twitter. The most important complication of cross input aggregation is explained in this Bitcoin dev mailing list post by AJ Towns. TL;DR: if softforks change which signatures are checked, they mustn't change what is aggregated together. This is especially complicated when they interact with BIP341's OP_SUCCESSx upgrade ...


4

Hampus Sjöberg has set up a site (https://taproot.watch/) with a graphic for which blocks have signaled for Taproot activation and a breakdown by mining pools. It was announced here on Twitter. AJ Towns stated on Mastodon that once signaling starts the Bitcoin Core RPC getblockchaininfo will report the number of signaling blocks in the current period. David ...


Only top voted, non community-wiki answers of a minimum length are eligible