BA-07 · LESSON 03

Key-path spending

KEY DEFINITIONS

Terms used in this lesson

Schnorr signature: Bitcoin’s Taproot signature scheme, whose algebra supports compact verification and advanced multi-party signing.
Sighash: The exact transaction digest and signature mode that determine which fields a Bitcoin signature authorizes.
Witness: Signatures, scripts, or other data supplied to satisfy a Bitcoin output’s spending condition.
BIP340: The Bitcoin Improvement Proposal specifying Schnorr signatures for the secp256k1 curve.
Taproot: A Bitcoin output and spending design that can combine a public-key path with privately committed alternative scripts.
P2TR: Pay to Taproot, the Bitcoin output type introduced with Taproot.
Control block: Proof data showing that a revealed script was committed inside a Taproot output.
Taptree: The Merkle tree of alternative scripts committed inside a Taproot output.
BIP341: The Bitcoin Improvement Proposal specifying Taproot output validation and the transaction signature message used by Taproot signatures.

The internal key holder can authorize a spend with a tweaked Schnorr signature without revealing alternative scripts.

55 min Difficulty 2/5 Not started

VISUAL MODEL

See the whole mechanism before going step by step

Use the diagrams to orient yourself. Then the guided explanation below teaches every part in depth.

4 explanatory views

CONCEPT-SPECIFIC MAP · taproot treeAn internal key and hidden script tree commit one Taproot outputSelect any state to inspect its exact role.

RELATIONSHIP MAPCommitment and derivation tree

01
INTERNAL KEYX-only point P
The internal public key is combined with a tagged commitment to the script tree.
02
TAPTREETapLeaf and TapBranch
Leaf scripts are hashed and branches are ordered before hashing.
03
TWEAKH(P || root)
The tagged TapTweak hash becomes a scalar added to the internal key.
04
OUTPUT KEYKey-path spending
The Key-path spending lesson identifies which committed data must be reconstructed.
05
SPENDSignature or leaf proof
Key path reveals no script; script path reveals one leaf and its Merkle siblings.

Rule shown: A key-path signature or a revealed leaf plus control block must reconstruct the committed output key.

STAGE 1 OF 5INTERNAL KEY: X-only point P

The internal public key is combined with a tagged commitment to the script tree.

Governing relationship: A key-path signature or a revealed leaf plus control block must reconstruct the committed output key. Complete path: 1. INTERNAL KEY, X-only point P. The internal public key is combined with a tagged commitment to the script tree. 2. TAPTREE, TapLeaf and TapBranch. Leaf scripts are hashed and branches are ordered before hashing. 3. TWEAK, H(P || root). The tagged TapTweak hash becomes a scalar added to the internal key. 4. OUTPUT KEY, Key-path spending. The Key-path spending lesson identifies which committed data must be reconstructed. 5. SPEND, Signature or leaf proof. Key path reveals no script; script path reveals one leaf and its Merkle siblings.

1. State transitionWhat exists, what changes, and what results

BEFORE

Use toy scalar arithmetic modulo group order n. Let p = 7 and tweak t = 4, so the corresponding tweaked scalar is 11 before parity adjustments.

MECHANISM

Let internal public key P correspond to private scalar p under BIP340's x-only key and parity conventions.

AFTER

The on-chain key is tweaked, so the signing secret must match that tweaked public key.

Text equivalent: Starting from Use toy scalar arithmetic modulo group order n. Let p = 7 and tweak t = 4, so the corresponding tweaked scalar is 11 before parity adjustments. The mechanism begins when Let internal public key P correspond to private scalar p under BIP340's x-only key and parity conventions. The resulting lesson is The on-chain key is tweaked, so the signing secret must match that tweaked public key.

2. Mechanism pathSelect a stage to inspect its job

STAGE 1 OF 6

Start from internal key

Let internal public key P correspond to private scalar p under BIP340's x-only key and parity conventions.

Complete path: 1. Start from internal key: Let internal public key P correspond to private scalar p under BIP340's x-only key and parity conventions. 2. Compute the tweak: TapTweak tagged hashing commits to P and, when present, the taptree Merkle root. The resulting scalar t is checked against the curve order. 3. Derive output key: The public output key is Q = P + tG, with parity recorded implicitly by the chosen x-only representation and signing adjustment. 4. Adjust the signing scalar: The signer applies BIP340 parity normalization and adds the tweak to obtain the private scalar corresponding to Q. 5. Sign the Taproot digest: The key-path sighash commits to defined transaction and prior-output data. The witness contains the 64-byte signature, plus an optional sighash byte when not default. 6. Verify against Q: Every node checks the BIP340 signature against the 32-byte output key already committed in the spent output.

3. Rule and failure boundaryWhat accepts the result and where it can stop

ACCEPTED PATH

BIP341 TapTweak, x-only parity normalization, tweaked private scalar, Taproot sighash, 64-or-65-byte witness signature, and BIP340 verification must agree.

CHANGED CONDITION

An untweaked signature verifies only for the internal key, and a wrong parity adjustment, tree root, or signed field fails against the committed output key.

Important distinction: A key-path spend proves there were no alternative scripts committed in the output. It reveals only a valid signature under the output key. The same output key may include a taptree commitment whose branches remain hidden.

Text equivalent: The accepted path is enforced by BIP341 TapTweak, x-only parity normalization, tweaked private scalar, Taproot sighash, 64-or-65-byte witness signature, and BIP340 verification must agree. If the required condition changes, An untweaked signature verifies only for the internal key, and a wrong parity adjustment, tree root, or signed field fails against the committed output key.

Loading lesson visuals...

Learn the idea

A Taproot key-path spend authorizes a P2TR output with one BIP340 Schnorr signature under the tweaked output key. The internal private key must be adjusted by the same TapTweak used to derive the output key. No script tree, control block, or unused policy branch is revealed on chain.

GUIDED EXPLANATION1/6 ideas inspected

Start from internal key

Let internal public key P correspond to private scalar p under BIP340's x-only key and parity conventions.

The worked example follows the explanation

Inspect every idea above to open it.

Important distinction“A key-path spend proves there were no alternative scripts committed in the output.”

It reveals only a valid signature under the output key. The same output key may include a taptree commitment whose branches remain hidden.

FINISH LEARNING FIRST

The questions unlock after every required learning activity

Inspect every guided idea, open the worked example, rebuild its mechanism, and complete the deterministic lesson tool. Your progress is saved automatically.