Taproot (BIP340 / 341 / 342)

Quick refs: tweak.md, control-block.md, sighash-default.md, taptree.md

Activated November 2021 (block 709,632). Three BIPs:

BIP340 — Schnorr signatures over secp256k1.
BIP341 — Taproot output: P2TR scriptPubKey, key-path / script-path spending, taptweak.
BIP342 — Tapscript: rules for script-path spends. See scripts/quick-ref/tapscript.md.

Output construction

P = internal_pubkey (x-only, 32 bytes)
TaptreeRoot R = merkle root of script tree (or empty)
t = TaggedHash("TapTweak", P || R)
Q = lift_x(P) + t*G   (the "tweaked" pubkey, x-only)
scriptPubKey = OP_1 <Q>

If you have only a key-path (no scripts), R = "" and the tweak still prevents key reuse leaking the internal key.

Key-path spend

witness = [<schnorr_sig>]    # 64 bytes (SIGHASH_DEFAULT) or 65 bytes

Privacy-equivalent to single-sig. The most efficient Taproot spend. Outsiders cannot tell whether a script-path even exists — every Taproot output looks like a single-key output.

Script-path spend

witness = [<args0>, <args1>, ..., <leaf script>, <control block>]

Args 0..N: stack inputs to the leaf.
Leaf script: the Tapscript bytes being executed.
Control block (33 + 32×depth bytes):
- byte 0: 0xc0 | (parity_of_Q). The leaf version.
- bytes 1..33: internal pubkey P.
- bytes 33..end: merkle path (32 bytes per level).

Validator reconstructs taproot_root from leaf hash + path, computes expected Q = P + tweak*G, compares to Q in scriptPubKey. If match, runs the leaf script per BIP342.

x-only pubkeys

All Schnorr keys in BIP340 are encoded as 32-byte x-coordinate only (no parity byte).
The "even Y" convention: parity is fixed to even by negating the private key when needed.
For tweaked output keys (Q), parity bit lives in the control block byte 0 LSB.

Sighash (BIP341)

SIGHASH_DEFAULT = 0x00 is the new default and equivalent to ALL but with the new digest. Differences from BIP143:

Hashes commit to all spent prevout amounts and scriptPubKeys (not just the current input).
For SINGLE: commit only to single output, but with cleaner digest.
Annex (last witness element prefixed 0x50) is committed.

64-byte sig if SIGHASH_DEFAULT, else 65 bytes (1-byte sighash suffix).

Sigops budget

Tapscript replaces "fixed sigops cost" with a budget: budget = floor(witness_weight / 50). Each CHECKSIG/CHECKSIGADD consumes 50 from the budget. Allows long script paths to validate proportionally to their bytes.

Why Taproot

Privacy: spending paths reveal only the path used. Cooperative spends (key-path) look identical to plain single-sig.
Aggregation: Schnorr's linearity → MuSig2 key aggregation off-chain. n parties can produce one signature for one pubkey.
Smaller witnesses for cooperative cases.
Soft-fork upgrade space: leaf versions, OP_SUCCESS opcodes, annex.

bitcoin-taproot