36 votes
Accepted

Why does hashing public keys not actually provide any quantum resistance?

Although hashing a public key by itself does provide quantum resistance, this is really only when it is considered by itself in a vacuum. Unfortunately, public key hashes do not exist in a vacuum and ...
Ava Chow's user avatar
  • 70.4k
31 votes
Accepted

Is it possible to convert a taproot address into a native segwit address?

I am afraid the sent coins are irrevocably burned. The reason is that P2TR addresses encode a (tweaked) public key, while P2WSH addresses encode a script hash. If someone would take a P2TR address so ...
Pieter Wuille's user avatar
29 votes
Accepted

What is the script assembly and execution in P2TR spend (spend from Taproot)

Before we start I realize your question is only about single-sig scenarios, and you want an answer focused on how validation works. I will address these things, but I think I need to elaborate a bit ...
Pieter Wuille's user avatar
15 votes
Accepted

Why does Taproot require a new address format?

Background P2TR addresses will be encoded using Bech32, although likely an amended version. In anticipation of Taproot getting merged, some proponents tested the behavior of various wallets and ...
Murch's user avatar
  • 75.2k
14 votes
Accepted

Musig Signature Interactivity

MuSig is interactive because each signer needs to provide a signature nonce (effectively randomness) before signing. This is not specific to MuSig, but applies to any discrete logarithm-based ...
nickler's user avatar
  • 776
14 votes
Accepted

Why is no security lost by using 32-byte public keys in Schnorr signatures instead of 33?

From the (very recently updated) bip-schnorr draft: Implicit Y coordinates are not a reduction in security when expressed as the number of elliptic curve operations an attacker is expected to perform ...
Pieter Wuille's user avatar
14 votes
Accepted

How can I find samples for P2TR transactions on mainnet?

Taproot activated in block 709 632, but the first P2TR transactions were in block 709 635. A few P2TR transactions that may be useful for test vectors would be: 33e7…9036, the first P2TR transaction ...
Murch's user avatar
  • 75.2k
13 votes
Accepted

What is this unusual transaction in the Bitcoin blockchain?

The first output of transaction b53e3bc5…5377f141 has the following scriptPubKey: OP_PUSHNUM_1 OP_PUSHBYTES_32 01010101…0101010101 The segwit softfork in 2017 defined versioning rules for all native ...
Murch's user avatar
  • 75.2k
13 votes
Accepted

BIP-341: Should key-path-only P2TR be eschewed altogether?

Let's first introduce some terminology, because "key path only" could mean different things. Say: A raw taproot output is one where the output key (the one in the scriptPubKey) is exactly ...
Pieter Wuille's user avatar
10 votes
Accepted

Spendable by me or deposit to exchange after 5 years?

Bitcoin Script has always had support for multiple spending conditions, see e.g. this overview of flow control operators. What taproot changes (amongst others) is that you can now construct a ...
stickies-v's user avatar
10 votes
Accepted

Why isn't the taproot deployment buried in Bitcoin Core?

The Taproot deployment is buried insofar as consensus no longer checks its status to determine whether to enforce the Taproot rules. The Taproot rules are enforced from genesis now, with the (...
Ava Chow's user avatar
  • 70.4k
9 votes
Accepted

How are scriptless scripts and taproot different?

One of the most common use of script in Bitcoin is to construct logically atomic operations, such as "Tx2 happens if and only if Tx1 happens". Scriptless scripts tells us how to use the additive ...
G. Maxwell's user avatar
  • 7,727
9 votes
Accepted

What are the different upgradeability features in the BIP-Taproot (BIP 341) proposal?

There is the annex, leaf version, ext_flag, OP_SUCCESS, unknown pubkey types and you could probably include the existing witness version too. I believe that list is exhaustive. The ext_flag isn't so ...
Michael Folkson's user avatar
9 votes

Should I be worried that bitcoincore.org now suddenly only provides an "unsigned" Bitcoin Core installer?

Beginning with Taproot? Hmm... Something about this feels scary to me. Your mistrust is misguided. So, they are no longer making "signed" installers? The releases are still signed with ...
Claris's user avatar
  • 15.4k
9 votes
Accepted

Should the Bitcoin Core wallet (or any wallet) prevent users from sending funds to a Taproot address pre activation?

TL;DR: Wallets SHOULD allow sending to all bech32m addresses at this point, but wallets MUST NOT request P2TR outputs before the Taproot spending rules are enforced on the network¹. The design of ...
Murch's user avatar
  • 75.2k
8 votes

What are "leaf versions" in Taproot?

To add to Michael Folkson's answer, a question one may have is what the differences are between witness versions and leaf versions. Why do we need both? Leaf versions are not revealed until an output ...
Pieter Wuille's user avatar
8 votes
Accepted

Who would benefit from Taproot deployment?

Taproot benefits everyone who uses it, but it has the most benefit to those who use complex scripts and multisigs. Since that group is a small portion of users of Bitcoin, that may be why some people ...
Ava Chow's user avatar
  • 70.4k
8 votes
Accepted

How do the fees for taproot transactions compare to P2WPKH?

Taproot inputs are smaller but outputs are larger. Specifically, P2WPKH (Native SegWit) inputs and outputs take 68 and 31 vbytes in a transaction, respectively, while P2TR (Taproot) inputs and outputs ...
Vojtěch Strnad's user avatar
8 votes
Accepted

Can Schnorr aggregate signatures be nested inside other Schnorr aggregate signatures?

TL;DR: depending on what you mean, there is probably no published scheme with a security proof, but there is hope for such a scheme. First, a few clarifications Aggregation is just a concept, not an ...
Pieter Wuille's user avatar
8 votes
Accepted

How do I create a taproot multisig address requiring 21 of 210 keys to spend?

This will be possible in the upcoming Bitcoin Core 24.0 release, using RPCs like deriveaddresses and importdescriptors, which take as input specifications in the output descriptor language. RPCs like ...
Pieter Wuille's user avatar
8 votes

Is a P2TR address a compressed public key?

SEC encoded public keys are either: Uncompressed 65-byte encoding: 0x04 + [32-byte X coordinate] + [32-byte Y coordinate] Compressed 33-byte encoding: 0x02 + [32-byte X coordinate] (if Y coordinate ...
Pieter Wuille's user avatar
7 votes
Accepted

What are the sizes of single-sig and 2-of-3 multisig taproot inputs?

Taproot generally has two ways of spending. The default way is to spend the output using the key path: pay-to-taproot then behaves like a p2pk output except that it is using a schnorr signature and ...
Murch's user avatar
  • 75.2k
7 votes
Accepted

Would a Schnorr PubKey be a different length than a Taproot PubKey like P2WPKH and P2WSH?

A P2WPKH PubKey is shorter than a P2WSH PubKey. No, not quite. A P2WPKH address is shorter than a P2WSH address. The addresses are both based on a hash of the underlying witness program (i.e. the ...
Murch's user avatar
  • 75.2k
7 votes

Will "Taproot" replace Lightning Network?

Will Taproot allow me to skip Lightning Network and simply use pure Bitcoin Core? Well, Bitcoin Core doesn't support Lightning for now, and probably won't for the foreseeable future, but there is no ...
Pieter Wuille's user avatar
7 votes
Accepted

Will P2TR make P2WSH obsolete?

As far as I can tell, P2TR is better than P2WSH in almost every way. I cannot think of a case in which it would be a significant advantage to use P2WSH over P2TR, except that P2WSH is already ...
Murch's user avatar
  • 75.2k
7 votes
Accepted

Why Schnorr was added to secp256k1 library instead of a separate library?

Yes, the BIP340 signature scheme that was added to libsecp256k1 is an Elliptic Curve based variant of Schnorr signatures. Traditionally Schnorr signatures use a group of integer multiplication modulo ...
Pieter Wuille's user avatar
7 votes
Accepted

Is there a way to convert a P2PKH address into P2TR?

Short answer: no, at least not via the key path (and using a script path would be less efficient than using P2WPKH instead) Longer answer: no, and even if it were possible, this would be a terrible ...
Pieter Wuille's user avatar
7 votes
Accepted

What does an un-upgraded node see when new Taproot transactions are on chain?

Yet, if the transactions are valid, the old nodes have no idea where those coins got spent. Are they seen as lost coins? Old nodes do know where the coins are going, as the transaction format didn't ...
Pieter Wuille's user avatar
7 votes
Accepted

Is a P2TR address a compressed public key?

Pay to Taproot uses x-only pubkeys. In Bitcoin, a private key d is a scalar, and its corresponding public key Q is the elliptic curve point found by multiplying d with the generator G of secp256k1: Q =...
Murch's user avatar
  • 75.2k
7 votes
Accepted

How to extract the internal key of a simple P2TR address?

A P2TR address encodes a public key using Bech32m, which you can directly decode. This public key is often (as recommended by BIP341) the result of taking a different key (called "internal key&...
Vojtěch Strnad's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible