36
votes
Accepted
Why does hashing public keys not actually provide any quantum resistance?
Although hashing a public key by itself does provide quantum resistance, this is really only when it is considered by itself in a vacuum. Unfortunately, public key hashes do not exist in a vacuum and ...
- 68.6k
30
votes
Accepted
Is it possible to convert a taproot address into a native segwit address?
I am afraid the sent coins are irrevocably burned.
The reason is that P2TR addresses encode a (tweaked) public key, while P2WSH addresses encode a script hash. If someone would take a P2TR address so ...
- 102k
28
votes
Accepted
What is the script assembly and execution in P2TR spend (spend from Taproot)
Before we start
I realize your question is only about single-sig scenarios, and you want an answer focused on how validation works. I will address these things, but I think I need to elaborate a bit ...
- 102k
15
votes
Accepted
Why does Taproot require a new address format?
Background
P2TR addresses will be encoded using Bech32, although likely an amended version. In anticipation of Taproot getting merged, some proponents tested the behavior of various wallets and ...
- 73k
14
votes
Accepted
Musig Signature Interactivity
MuSig is interactive because each signer needs to provide a signature nonce (effectively randomness) before signing. This is not specific to MuSig, but applies to any discrete logarithm-based ...
- 776
14
votes
Accepted
How can I find samples for P2TR transactions on mainnet?
Taproot activated in block 709 632, but the first P2TR transactions were in block 709 635. A few P2TR transactions that may be useful for test vectors would be:
33e7…9036, the first P2TR transaction
...
- 73k
13
votes
Accepted
Why is no security lost by using 32-byte public keys in Schnorr signatures instead of 33?
From the (very recently updated) bip-schnorr draft:
Implicit Y coordinates are not a reduction in security when expressed as the number of elliptic curve operations an attacker is expected to perform ...
- 102k
13
votes
Accepted
What is this unusual transaction in the Bitcoin blockchain?
The first output of transaction b53e3bc5…5377f141 has the following scriptPubKey:
OP_PUSHNUM_1 OP_PUSHBYTES_32 01010101…0101010101
The segwit softfork in 2017 defined versioning rules for all native ...
- 73k
13
votes
Accepted
BIP-341: Should key-path-only P2TR be eschewed altogether?
Let's first introduce some terminology, because "key path only" could mean different things. Say:
A raw taproot output is one where the output key (the one in the scriptPubKey) is exactly ...
- 102k
10
votes
Accepted
Spendable by me or deposit to exchange after 5 years?
Bitcoin Script has always had support for multiple spending conditions, see e.g. this overview of flow control operators. What taproot changes (amongst others) is that you can now construct a ...
- 550
10
votes
Accepted
Why isn't the taproot deployment buried in Bitcoin Core?
The Taproot deployment is buried insofar as consensus no longer checks its status to determine whether to enforce the Taproot rules. The Taproot rules are enforced from genesis now, with the (...
- 68.6k
9
votes
Accepted
How are scriptless scripts and taproot different?
One of the most common use of script in Bitcoin is to construct logically atomic operations, such as "Tx2 happens if and only if Tx1 happens".
Scriptless scripts tells us how to use the additive ...
- 7,696
9
votes
Accepted
What are the different upgradeability features in the BIP-Taproot (BIP 341) proposal?
There is the annex, leaf version, ext_flag, OP_SUCCESS, unknown pubkey
types and you could probably include the existing witness version too.
I believe that list is exhaustive.
The ext_flag isn't so ...
- 14.7k
9
votes
Should I be worried that bitcoincore.org now suddenly only provides an "unsigned" Bitcoin Core installer?
Beginning with Taproot? Hmm... Something about this feels scary to me.
Your mistrust is misguided.
So, they are no longer making "signed" installers?
The releases are still signed with ...
- 15.4k
9
votes
Accepted
Should the Bitcoin Core wallet (or any wallet) prevent users from sending funds to a Taproot address pre activation?
TL;DR: Wallets SHOULD allow sending to all bech32m addresses at this point, but wallets MUST NOT request P2TR outputs before the Taproot spending rules are enforced on the network¹.
The design of ...
- 73k
8
votes
What are "leaf versions" in Taproot?
To add to Michael Folkson's answer, a question one may have is what the differences are between witness versions and leaf versions. Why do we need both?
Leaf versions are not revealed until an output ...
- 102k
8
votes
Accepted
Who would benefit from Taproot deployment?
Taproot benefits everyone who uses it, but it has the most benefit to those who use complex scripts and multisigs. Since that group is a small portion of users of Bitcoin, that may be why some people ...
- 68.6k
8
votes
Accepted
Can Schnorr aggregate signatures be nested inside other Schnorr aggregate signatures?
TL;DR: depending on what you mean, there is probably no published scheme with a security proof, but there is hope for such a scheme.
First, a few clarifications
Aggregation is just a concept, not an ...
- 102k
8
votes
Is a P2TR address a compressed public key?
SEC encoded public keys are either:
Uncompressed 65-byte encoding: 0x04 + [32-byte X coordinate] + [32-byte Y coordinate]
Compressed 33-byte encoding:
0x02 + [32-byte X coordinate] (if Y coordinate ...
- 102k
7
votes
Accepted
What are the sizes of single-sig and 2-of-3 multisig taproot inputs?
Taproot generally has two ways of spending. The default way is to spend the output using the key path: pay-to-taproot then behaves like a p2pk output except that it is using a schnorr signature and ...
- 73k
7
votes
Accepted
Would a Schnorr PubKey be a different length than a Taproot PubKey like P2WPKH and P2WSH?
A P2WPKH PubKey is shorter than a P2WSH PubKey.
No, not quite. A P2WPKH address is shorter than a P2WSH address. The addresses are both based on a hash of the underlying witness program (i.e. the ...
- 73k
7
votes
Will "Taproot" replace Lightning Network?
Will Taproot allow me to skip Lightning Network and simply use pure Bitcoin Core?
Well, Bitcoin Core doesn't support Lightning for now, and probably won't for the foreseeable future, but there is no ...
- 102k
7
votes
Accepted
How do the fees for taproot transactions compare to P2WPKH?
Taproot inputs are smaller but outputs are larger. Specifically, P2WPKH (Native SegWit) inputs and outputs take 68 and 31 vbytes in a transaction, respectively, while P2TR (Taproot) inputs and outputs ...
- 6,823
7
votes
Accepted
Will P2TR make P2WSH obsolete?
As far as I can tell, P2TR is better than P2WSH in almost every way. I cannot think of a case in which it would be a significant advantage to use P2WSH over P2TR, except that P2WSH is already ...
- 73k
7
votes
Accepted
Is there a way to convert a P2PKH address into P2TR?
Short answer: no, at least not via the key path (and using a script path would be less efficient than using P2WPKH instead)
Longer answer: no, and even if it were possible, this would be a terrible ...
- 102k
7
votes
Accepted
How do I create a taproot multisig address requiring 21 of 210 keys to spend?
This will be possible in the upcoming Bitcoin Core 24.0 release, using RPCs like deriveaddresses and importdescriptors, which take as input specifications in the output descriptor language.
RPCs like ...
- 102k
7
votes
Accepted
What does an un-upgraded node see when new Taproot transactions are on chain?
Yet, if the transactions are valid, the old nodes have no idea where those coins got spent. Are they seen as lost coins?
Old nodes do know where the coins are going, as the transaction format didn't ...
- 102k
7
votes
Accepted
Is a P2TR address a compressed public key?
Pay to Taproot uses x-only pubkeys.
In Bitcoin, a private key d is a scalar, and its corresponding public key Q is the elliptic curve point found by multiplying d with the generator G of secp256k1: Q =...
- 73k
6
votes
Accepted
What are "leaf versions" in Taproot?
SegWit introduced versioned witness programs. When satisfying a script to spend coins you need to provide a redeem script consisting of a version byte and a witness program. The version introduced ...
- 14.7k
6
votes
Accepted
In theory could we skip the proposed Taproot soft fork, activate Simplicity instead and use Simplicity to write the equivalent of Taproot scripts?
I think that's both very premature, and misses the point.
Simplicity is a completely different approach to scripting, with significant advantages, but it's being designed from the ground up. There is ...
- 14.7k
Only top scored, non community-wiki answers of a minimum length are eligible