Taproot

Taproot is a Bitcoin upgrade that activated at block 709,632 on 14 November 2021. Its main change is a new output type, Pay to Taproot, or P2TR. A P2TR output can be spent in two ways: with one signature from a single key, or with one of many scripts arranged in a tree. The unused scripts stay hidden. Taproot also brought in Schnorr signatures and a revised scripting language called Tapscript.

Three BIPs define it. BIP 340 covers Schnorr signatures, BIP 341 covers the output and spending rules, and BIP 342 covers Tapscript. The idea was first proposed by Gregory Maxwell in 2018.

When did Taproot activate?

Taproot used version bits signalling, which reads the version field of block headers. Miners set bit 2 to show support. The signalling window ran from 24 April 2021 to 11 August 2021. A retarget period needed 90% of its blocks, or 1,815 of 2,016, to signal before the upgrade could lock in.

The period that ended at block 687,455 had 1,983 of its 2,016 blocks (98.36%) signalling. The upgrade therefore locked in at block 687,456, on 13 June 2021. A minimum activation height of 709,632 meant it could not take effect earlier. It became active at that height, at 05:15:27 UTC on 14 November 2021.

How is a P2TR output built?

A P2TR output is built in four steps. Each one feeds the next.

1. The internal public key. Taproot keys are 32 bytes, the x coordinate only. The y coordinate is assumed to be even. To make one from a 33-byte compressed key, drop its first byte. The example key is a2fc329a085d8cfc4fa28795993d7b666cee024e94c40115141b8e9be4a29fa4.

2. The script tree (optional). Each leaf holds a leaf version and a script. Tapscript uses leaf version c0 (192). A leaf hash is a tagged hash, with the tag TapLeaf, of the leaf version, the compact size of the script, and the script. For the one-byte script 5187 (OP_1 OP_EQUAL), the leaf hash is:

6b13becdaf0eee497e2f304adcfa1c0c9e84561c9989b7f2b5fc39f5f90a60f6

Two leaves combine into a branch. The branch is a tagged hash, with the tag TapBranch, of the two hashes with the lower one first. Repeat until one hash is left. That is the merkle root. With no scripts there is no root, and with one leaf the root is that leaf's hash.

3. The tweak. The tweak is a tagged hash, with the tag TapTweak, of the internal key and the merkle root. With no script tree, it is the tagged hash of the internal key alone, so the key is still tweaked. The example tweak, using the root from a five-leaf tree, is bf0094eae70ba67e2f9fc3c4b81f078c90931855a8d24c959619174c92060cde.

4. The output key. The output key Q is the internal key point plus the tweak times the generator point, so Q = P + t × G. Q is the value that goes on the chain. For the example it is 562529047f476b9a833a5a780a75845ec32980330d76d1ac9f351dc76bce5d72.

The locking script is OP_1, then a 32-byte push of Q. That is 5120 followed by Q, 34 bytes in total. Its address is 62 characters long and starts with bc1p, because the encoding is bech32m, defined in BIP 350.

A leaf version must be even, because the lowest bit of the control byte holds a parity flag. It cannot be 0x50, which marks an annex. Tapscript uses 0xc0, and the other allowed values are listed in BIP 341.

How do you spend a P2TR output?

There are two ways, and the witness shows which one was used. A key path spend has one witness item. A script path spend has two or more.

Key path spend

A key path spend unlocks the output with a signature from the tweaked key. To make it, first tweak the private key. Use d, the private key, or n - d if the public key point has an odd y coordinate, so that it matches the even-y x-only key. Then add the tweak:

tweaked private key = (d + t) mod n

Here n is the order of the secp256k1 curve. Sign the signature hash with that key, using a Schnorr signature. The witness then holds one item, a 64-byte signature. A 65-byte signature includes a hash type byte. Taproot's default hash type is 0x00, which signs the whole transaction, as SIGHASH_ALL does. When that default is used, no hash type byte is added.

The signature hash is a tagged hash, with the tag TapSighash, of an epoch byte 0x00 and the common signature message. That message is the transaction data the signature commits to, and it includes the input being spent and the outputs. You need the script tree's merkle root to compute the tweak, so keep it. Without it you cannot spend by key path.

Script path spend

A script path spend reveals one leaf. The witness holds these parts, in this order:

1. The script inputs, the stack items the leaf script needs, such as a signature. A leaf that needs none has no items here.
2. The leaf script itself.
3. The control block.

The control block has three parts. The first byte is the control byte, which is the leaf version plus one bit. That bit is the parity of the tweaked key's y coordinate, 1 if it is odd. The next 32 bytes are the internal key.

After that comes the merkle path, which is 32 bytes for each sibling hash needed to rebuild the root. A path may hold at most 128 hashes, so a control block is at most 33 + 32 × 128 = 4,129 bytes.

The example control block for the leaf 5387 is c1, then the internal key, then the path. c1 means the leaf version is c0 and the output key's y coordinate is odd. The leaf sits three levels below the root, so its path holds three 32-byte hashes, and the whole control block is 129 bytes.

A signature inside a script path spend uses a different extension to the signature message. It adds the leaf hash and two more fields. The extension flag is set to 1, so the signed message differs from the one used for a key path spend.

The annex is an optional element that starts with 0x50. It is reserved for future upgrades, so do not include one.

What is Tapscript?

Tapscript is the script language used by every leaf. It is almost the same as the Script language. The changes are these:

• OP_CHECKSIG and OP_CHECKSIGVERIFY now check Schnorr signatures.
• OP_CHECKMULTISIG and OP_CHECKMULTISIGVERIFY are disabled.
• OP_CHECKSIGADD (0xba) is new. It lets a script count valid signatures, and it works with batch verification.
• Opcodes that were reserved are now OP_SUCCESSx. A script that contains one of them is valid, no matter where it appears.

Tapscript also drops the old limits. A leaf script was capped at 10,000 bytes and 201 non-push opcodes. Those caps are gone. Instead, each script has a signature budget of 50 plus the witness size, and each signature check costs 50 of it. A script can therefore hold at least one signature check, and the cost is counted per script, not per block.

Why is Taproot private and efficient?

A script tree can hold many spending conditions, but Taproot reveals only the one you use. The others stay as hashes. A key path spend reveals no script at all, so nobody can see that other conditions exist.

It is also compact. A P2TR output is 34 bytes, the same size as a P2WSH output, even though it can hold a whole tree of conditions. The cost of a deep tree shows up at spend time, in a longer merkle path.

The tree is also a choice you make. Place the script you expect to use most often near the root, because its merkle path is shorter and cheaper to spend. The design also leaves room for upgrades. New leaf versions can add script types later, and the annex is reserved for future use.

Where can you see it?

The activation block is 709,632. Its hash is 0000000000000000000687bca986194dc2c1f949318629b44bb54ec0a94d8244, and its block time is 14 November 2021, 05:15:27 UTC. Taproot builds on the witness format from SegWit, so read that page first if you have not yet. The schnorr signatures page explains the signature scheme in more detail.