---

name: bitcoin-taproot description: | Taproot soft fork: BIP340 (Schnorr signatures), BIP341 (key tweak + script-path), BIP342 (Tapscript). x-only pubkeys, key-path vs script-path spending, control block, leaf versions, taptweak math. Quick refs: tweak math, control block layout, sighash differences, building a taptree. USE WHEN: building/spending P2TR outputs, designing taptrees, reasoning about Schnorr-only contexts. allowed-tools: Read, Grep, Glob

Taproot (BIP340 / 341 / 342)

Quick refs: tweak.md, control-block.md, sighash-default.md, taptree.md

Activated November 2021 (block 709,632). Three BIPs:

• BIP340 — Schnorr signatures over secp256k1.
• BIP341 — Taproot output: P2TR scriptPubKey, key-path / script-path spending, taptweak.
• BIP342 — Tapscript: rules for script-path spends. See scripts/quick-ref/tapscript.md.

Output construction

P = internal_pubkey (x-only, 32 bytes)
TaptreeRoot R = merkle root of script tree (or empty)
t = TaggedHash("TapTweak", P || R)
Q = lift_x(P) + t*G   (the "tweaked" pubkey, x-only)
scriptPubKey = OP_1 <Q>

If you have only a key-path (no scripts), R = "" and the tweak still prevents key reuse leaking the internal key.

Key-path spend

witness = [<schnorr_sig>]    # 64 bytes (SIGHASH_DEFAULT) or 65 bytes

Privacy-equivalent to single-sig. The most efficient Taproot spend. Outsiders cannot tell whether a script-path even exists — every Taproot output looks like a single-key output.

Script-path spend

witness = [<args0>, <args1>, ..., <leaf script>, <control block>]

• Args 0..N: stack inputs to the leaf.
• Leaf script: the Tapscript bytes being executed.
• Control block (33 + 32×depth bytes):
  • byte 0: 0xc0 | (parity_of_Q). The leaf version.
  • bytes 1..33: internal pubkey P.
  • bytes 33..end: merkle path (32 bytes per level).

Validator reconstructs taproot_root from leaf hash + path, computes expected Q = P + tweak*G, compares to Q in scriptPubKey. If match, runs the leaf script per BIP342.

x-only pubkeys

• All Schnorr keys in BIP340 are encoded as 32-byte x-coordinate only (no parity byte).
• The "even Y" convention: parity is fixed to even by negating the private key when needed.
• For tweaked output keys (Q), parity bit lives in the control block byte 0 LSB.

Sighash (BIP341)

SIGHASH_DEFAULT = 0x00 is the new default and equivalent to ALL but with the new digest. Differences from BIP143:

• Hashes commit to all spent prevout amounts and scriptPubKeys (not just the current input).
• For SINGLE: commit only to single output, but with cleaner digest.
• Annex (last witness element prefixed 0x50) is committed.

64-byte sig if SIGHASH_DEFAULT, else 65 bytes (1-byte sighash suffix).

Sigops budget

Tapscript replaces "fixed sigops cost" with a budget: budget = floor(witness_weight / 50). Each CHECKSIG/CHECKSIGADD consumes 50 from the budget. Allows long script paths to validate proportionally to their bytes.

Why Taproot

1. Privacy: spending paths reveal only the path used. Cooperative spends (key-path) look identical to plain single-sig.
2. Aggregation: Schnorr's linearity → MuSig2 key aggregation off-chain. n parties can produce one signature for one pubkey.
3. Smaller witnesses for cooperative cases.
4. Soft-fork upgrade space: leaf versions, OP_SUCCESS opcodes, annex.

See also

• scripts/quick-ref/tapscript.md
• ../../cryptography/schnorr/SKILL.md
• ../../cryptography/musig2/SKILL.md
• miniscript/SKILL.md