BA-07 · LESSON 06

Unspendable internal keys

KEY DEFINITIONS

Terms used in this lesson

Taproot: A Bitcoin output and spending design that can combine a public-key path with privately committed alternative scripts.
NUMS: Nothing Up My Sleeve: a point derived transparently from public data so no participant is expected to know its private scalar.
Taptree: The Merkle tree of alternative scripts committed inside a Taproot output.
P2TR: Pay to Taproot, the Bitcoin output type introduced with Taproot.
Witness: Signatures, scripts, or other data supplied to satisfy a Bitcoin output’s spending condition.
Control block: Proof data showing that a revealed script was committed inside a Taproot output.

Protocols can use a provably unspendable internal key to require script-path enforcement rather than retaining a hidden bypass.

45 min Difficulty 2/5 Not started

VISUAL MODEL

See the whole mechanism before going step by step

Use the diagrams to orient yourself. Then the guided explanation below teaches every part in depth.

4 explanatory views

CONCEPT-SPECIFIC MAP · taproot treeAn internal key and hidden script tree commit one Taproot outputSelect any state to inspect its exact role.

RELATIONSHIP MAPCommitment and derivation tree

01
INTERNAL KEYX-only point P
The internal public key is combined with a tagged commitment to the script tree.
02
TAPTREETapLeaf and TapBranch
Leaf scripts are hashed and branches are ordered before hashing.
03
TWEAKH(P || root)
The tagged TapTweak hash becomes a scalar added to the internal key.
04
OUTPUT KEYUnspendable internal keys
The Unspendable internal keys lesson identifies which committed data must be reconstructed.
05
SPENDSignature or leaf proof
Key path reveals no script; script path reveals one leaf and its Merkle siblings.

Rule shown: A key-path signature or a revealed leaf plus control block must reconstruct the committed output key.

STAGE 1 OF 5INTERNAL KEY: X-only point P

The internal public key is combined with a tagged commitment to the script tree.

Governing relationship: A key-path signature or a revealed leaf plus control block must reconstruct the committed output key. Complete path: 1. INTERNAL KEY, X-only point P. The internal public key is combined with a tagged commitment to the script tree. 2. TAPTREE, TapLeaf and TapBranch. Leaf scripts are hashed and branches are ordered before hashing. 3. TWEAK, H(P || root). The tagged TapTweak hash becomes a scalar added to the internal key. 4. OUTPUT KEY, Unspendable internal keys. The Unspendable internal keys lesson identifies which committed data must be reconstructed. 5. SPEND, Signature or leaf proof. Key path reveals no script; script path reveals one leaf and its Merkle siblings.

1. State transitionWhat exists, what changes, and what results

BEFORE

Design A lets operator O generate internal key P and claim to delete its scalar. Design B derives point U deterministically from a published phrase and procedure.

MECHANISM

If anyone knows the internal private key and the taptree tweak, they can derive the output private key and spend by key path without revealing a script.

AFTER

Provable unspendability is about removing an unverifiable hidden key-path assumption.

Text equivalent: Starting from Design A lets operator O generate internal key P and claim to delete its scalar. Design B derives point U deterministically from a published phrase and procedure. The mechanism begins when If anyone knows the internal private key and the taptree tweak, they can derive the output private key and spend by key path without revealing a script. The resulting lesson is Provable unspendability is about removing an unverifiable hidden key-path assumption.

2. Mechanism pathSelect a stage to inspect its job

STAGE 1 OF 5

Identify the bypass

If anyone knows the internal private key and the taptree tweak, they can derive the output private key and spend by key path without revealing a script.

Complete path: 1. Identify the bypass: If anyone knows the internal private key and the taptree tweak, they can derive the output private key and spend by key path without revealing a script. 2. Derive a nothing-up-my-sleeve point: Participants can deterministically map fixed public data into a valid curve point with no known discrete logarithm, using a specified and reviewable procedure. 3. Commit the script tree: The unspendable internal point and Merkle root are combined through TapTweak to form the P2TR output key. 4. Retain script-path proofs: Authorized users need each spending leaf, witness data, and control block because there is intentionally no known key-path recovery. 5. Audit every construction assumption: A point chosen by an untrusted party could have a known secret. The derivation transcript, domain, curve validity, and absence of alternative output construction matter.

3. Rule and failure boundaryWhat accepts the result and where it can stop

ACCEPTED PATH

External reviewers compare deletion trust, full multiparty ceremony assumptions, and a domain-separated deterministic public point while preserving every script-path proof.

CHANGED CONDITION

An operator-chosen point can hide a retained scalar, an incomplete ceremony retains collusion risk, and a NUMS design intentionally has no key-path recovery.

Important distinction: Sending a private key to zero or deleting a wallet proves a Taproot internal key is unspendable. Observers cannot verify deletion and copies may exist. A publicly derived point with no known discrete logarithm avoids trusting a deletion ceremony.

Text equivalent: The accepted path is enforced by External reviewers compare deletion trust, full multiparty ceremony assumptions, and a domain-separated deterministic public point while preserving every script-path proof. If the required condition changes, An operator-chosen point can hide a retained scalar, an incomplete ceremony retains collusion risk, and a NUMS design intentionally has no key-path recovery.

Loading lesson visuals...

Learn the idea

A Taproot internal key normally creates a key-path spend. A Nothing Up My Sleeve, or NUMS, point is derived transparently from fixed public data so no participant is expected to know its private scalar. A protocol that intends all spending to follow scripts may use such an internal key. The construction must make that lack of knowledge publicly convincing, rather than relying on one party's promise that it deleted a key.

GUIDED EXPLANATION1/5 ideas inspected

Identify the bypass

If anyone knows the internal private key and the taptree tweak, they can derive the output private key and spend by key path without revealing a script.

The worked example follows the explanation

Inspect every idea above to open it.

Important distinction“Sending a private key to zero or deleting a wallet proves a Taproot internal key is unspendable.”

Observers cannot verify deletion and copies may exist. A publicly derived point with no known discrete logarithm avoids trusting a deletion ceremony.

FINISH LEARNING FIRST

The questions unlock after every required learning activity

Inspect every guided idea, open the worked example, rebuild its mechanism, and complete the deterministic lesson tool. Your progress is saved automatically.