<p>There are 4 issues:</p>
<ol>
<li>Missing <code>0x00</code> prefix byte (epoch byte)</li>
<li>The message needs to be hashed before it can be signed. It should be a tagged hash with the tag &quot;TapSighash&quot;.</li>
<li>The txid in your prevouts is backwards. It should be byteswapped from what is displayed (i.e. it is the actual result of the hash)</li>
<li>The sequence in your input is <code>0xfdffffff</code>, not <code>0xffffff</code></li>
</ol>
<p>Here is what I have computed for each part:</p>
<div class="s-table-container">
<table class="s-table">
<thead>
<tr>
<th>Message part</th>
<th>Serialization</th>
</tr>
</thead>
<tbody>
<tr>
<td>Epoch</td>
<td>00</td>
</tr>
<tr>
<td>hash_type</td>
<td>00</td>
</tr>
<tr>
<td>nVersion</td>
<td>02000000</td>
</tr>
<tr>
<td>nLockTime</td>
<td>00000000</td>
</tr>
<tr>
<td>sha_prevouts</td>
<td>1da888957df6ce1ac5462fc1b08fe98f2f211026b4b91b71dbd8470239495faf</td>
</tr>
<tr>
<td>sha_amounts</td>
<td>3e1f6dbf626619317d04b24ac25799871709e0f3e35cc0e05dae4da21bc5a162</td>
</tr>
<tr>
<td>sha_scriptpubkeys</td>
<td>1e43f82396d787c36855662b53aa84af812f10cb9bdca5f2328b12ffea3f833c</td>
</tr>
<tr>
<td>sha_sequencues</td>
<td>23e9829bfb4e23fbd3c4848baa035af15d73bcb83e510f7f097f90a21a4280d2</td>
</tr>
<tr>
<td>sha_outputs</td>
<td>fd984a928339e11d1dcda5174c34ddfc8bcc976edceb919d0f52f127d0cd0bf7</td>
</tr>
<tr>
<td>spend_type</td>
<td>00</td>
</tr>
<tr>
<td>input_index</td>
<td>00000000</td>
</tr>
</tbody>
</table>
</div>
<p>The entire thing that you hash should be</p>
<pre><code>000002000000000000001da888957df6ce1ac5462fc1b08fe98f2f211026b4b91b71dbd8470239495faf3e1f6dbf626619317d04b24ac25799871709e0f3e35cc0e05dae4da21bc5a1621e43f82396d787c36855662b53aa84af812f10cb9bdca5f2328b12ffea3f833c23e9829bfb4e23fbd3c4848baa035af15d73bcb83e510f7f097f90a21a4280d2fd984a928339e11d1dcda5174c34ddfc8bcc976edceb919d0f52f127d0cd0bf70000000000
</code></pre>
<p>and you should get a hash of</p>
<pre><code>1b9589328e6c5d8b71288ee5f93a78d655b724ffa0f5ebf23f88983dda8c5676
</code></pre>

CC BY-SA 4.0
2023-10-27T11:49:50.023Z
Still something is missing despite replacing the big-endian with little-endian txid. Thanks for a response.
Greg Tonoski
CC BY-SA 4.0
2023-10-27T14:48:59.947Z
I've updated my answer to include Pieter's comment and the remaining issue I found.
Ava Chow
CC BY-SA 4.0
2023-10-26T21:38:52.783Z
2023-10-27T14:48:38.770Z
2023-10-27T14:48:38.770Z
Ava Chow
<p>Elaborating on the answer:</p>
<div class="s-table-container">
<table class="s-table">
<thead>
<tr>
<th>Position</th>
<th>Name of a message part</th>
<th>Explanatory expression</th>
<th>Value before SHA-256</th>
<th>Final value (hex)</th>
</tr>
</thead>
<tbody>
<tr>
<td>1</td>
<td>hash_type</td>
<td>0x00</td>
<td>not applicable</td>
<td>00</td>
</tr>
<tr>
<td>2</td>
<td>nVersion</td>
<td>LE( 0x00000002 )</td>
<td>not applicable</td>
<td>02000000</td>
</tr>
<tr>
<td>3</td>
<td>nLockTime</td>
<td>LE( 0x00000000 )</td>
<td>not applicable</td>
<td>00000000</td>
</tr>
<tr>
<td>4</td>
<td>sha_prevouts</td>
<td>sha256( LE( predecessor_txid ) || LE( predecessor_vout ) )</td>
<td>sha256( 5f1ab0cd64d050721e4bcd63ffee5c1b4f6224b5fa8f7343062d1f0e32ab87eb00000000 )</td>
<td>1da888957df6ce1ac5462fc1b08fe98f2f211026b4b91b71dbd8470239495faf</td>
</tr>
<tr>
<td>5</td>
<td>sha_amounts</td>
<td>sha256( LE( predecessor_tx_amount ) )</td>
<td>sha256( LE( 0000000000001f40 ) )</td>
<td>3e1f6dbf626619317d04b24ac25799871709e0f3e35cc0e05dae4da21bc5a162</td>
</tr>
<tr>
<td>6</td>
<td>sha_scriptpubkeys</td>
<td>sha256( predecessor_scriptpubkey_length || predecessor_scriptpubkey )</td>
<td>sha256( 22512055355ca83c973f1d97ce0e3843c85d78905af16b4dc531bc488e57212d230116 )</td>
<td>1e43f82396d787c36855662b53aa84af812f10cb9bdca5f2328b12ffea3f833c</td>
</tr>
<tr>
<td>7</td>
<td>sha_sequences</td>
<td>sha256( LE( predecessor_tx_sequences )</td>
<td>sha256( LE( fffffffd ) )</td>
<td>23e9829bfb4e23fbd3c4848baa035af15d73bcb83e510f7f097f90a21a4280d2</td>
</tr>
<tr>
<td>8</td>
<td>sha_outputs</td>
<td>sha256( LE( new_tx_amount ) || new_tx_scriptpubkey_length || new_tx_scriptpubkey</td>
<td>sha256( e8030000000000001600140bc6dda83a5c6346d31808f685c7cbf1ae20a23e )</td>
<td>fd984a928339e11d1dcda5174c34ddfc8bcc976edceb919d0f52f127d0cd0bf7</td>
</tr>
<tr>
<td>9</td>
<td>spend_type</td>
<td>0x00</td>
<td>not applicable</td>
<td>00</td>
</tr>
<tr>
<td>10</td>
<td>input_index</td>
<td>LE( 0x00000000)</td>
<td>not applicable</td>
<td>00000000</td>
</tr>
</tbody>
</table>
</div>
<pre><code>message digest = hashTapSighash( 0x00 || SigMsg( 0x00, 0 ) ) = sha256( sha256( &quot;TapSighash&quot; ) || sha256( &quot;TagSighash&quot; ) || sighash_epoch || message_parts_above ) = sha256( sha256( 0x54617053696768617368 ) || sha256( 0x54617053696768617368 ) || 0x00 || 0x0002000000000000001da888957df6ce1ac5462fc1b08fe98f2f211026b4b91b71dbd8470239495faf3e1f6dbf626619317d04b24ac25799871709e0f3e35cc0e05dae4da21bc5a1621e43f82396d787c36855662b53aa84af812f10cb9bdca5f2328b12ffea3f833c23e9829bfb4e23fbd3c4848baa035af15d73bcb83e510f7f097f90a21a4280d2fd984a928339e11d1dcda5174c34ddfc8bcc976edceb919d0f52f127d0cd0bf70000000000 ) = 0x1b9589328e6c5d8b71288ee5f93a78d655b724ffa0f5ebf23f88983dda8c5676
</code></pre>
<p><a href="https://github.com/bitcoin/bips/blob/master/bip-0340/reference.py" rel="nofollow noreferrer">Reference.py</a> used to compute the signature:</p>
<pre><code>reference.schnorr_sign(b'\x1b\x95\x892\x8el]\x8bq(\x8e\xe5\xf9:x\xd6U\xb7$\xff\xa0\xf5\xeb\xf2?\x88\x98=\xda\x8cVv', b'\xdf\xf1\xc8\xc2\xc0\x16\xa5r\x91KLZ\xdb\x87\x91\xd6+Gh\xae\x9d\na\xbe\x8a\xb9L\xf5\x03\x8d}\x90', b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00')
</code></pre>
<p>Signature=<code>0x082779351eb8509993140dbcb9c6d1d4928c6cf397569c49891334ba6d6c9c0bbe6312d4f7af558f3d83398c4dfdf6caabb1b6bcd7cba216141450e240746299</code></p>
<p>Verification:</p>
<pre><code>testmempoolaccept '[&quot;020000000001015f1ab0cd64d050721e4bcd63ffee5c1b4f6224b5fa8f7343062d1f0e32ab87eb0000000000fdffffff01e8030000000000001600140bc6dda83a5c6346d31808f685c7cbf1ae20a23e0140082779351eb8509993140dbcb9c6d1d4928c6cf397569c49891334ba6d6c9c0bbe6312d4f7af558f3d83398c4dfdf6caabb1b6bcd7cba216141450e24074629900000000&quot;]'


[
  {
    &quot;txid&quot;: &quot;466474502a15ca2258cf5cadcfec6743c499720843cd51c2c646ad501befffe2&quot;,
    &quot;wtxid&quot;: &quot;9fbcd4eb32f2811786d46ff5272347891badba07b7b7d1d02d64d71430a2778f&quot;,
    &quot;allowed&quot;: true,
    &quot;vsize&quot;: 99,
    &quot;fees&quot;: {
      &quot;base&quot;: 0.00007000,
      &quot;effective-feerate&quot;: 0.00070707,
      &quot;effective-includes&quot;: [
        &quot;9fbcd4eb32f2811786d46ff5272347891badba07b7b7d1d02d64d71430a2778f&quot;
      ]
    }
  }
]
deriveaddresses &quot;rawtr(cV628xvqToz45dwdPmTcJ9RgEVnWMwP8dpZBGzb9LfTk3sBHFNwc)#5u2k7u2l&quot;
[
  &quot;tb1p2564e2pujul3m97wpcuy8jza0zg94uttfhznr0zg3etjztfrqytq7n93n2&quot;
]
</code></pre>

CC BY-SA 4.0
2023-10-31T10:05:46.367Z
2023-10-31T10:20:29.523Z
2023-10-31T10:20:29.523Z
Greg Tonoski
<p>Is there an example of key-path BIP-0341 signature message computation, perhaps? Or, could you tell what is incorrect in the example below, please?</p>
<pre><code>deriveaddresses &quot;rawtr(cV628xvqToz45dwdPmTcJ9RgEVnWMwP8dpZBGzb9LfTk3sBHFNwc)#5u2k7u2l&quot;
[
  &quot;tb1p2564e2pujul3m97wpcuy8jza0zg94uttfhznr0zg3etjztfrqytq7n93n2&quot;
]
testmempoolaccept '[&quot;020000000001015f1ab0cd64d050721e4bcd63ffee5c1b4f6224b5fa8f7343062d1f0e32ab87eb0000000000fdffffff01e8030000000000001600140bc6dda83a5c6346d31808f685c7cbf1ae20a23e0140caf56a13c54a7d786579ad9b92868082685dafa4c7d97ee5d031d80105de0eea501548e63812806ec1adaf2fab6de48ec59a59701c5cdfa2e9f84e9a3c4109d900000000&quot;]'

[
  {
    &quot;txid&quot;: &quot;466474502a15ca2258cf5cadcfec6743c499720843cd51c2c646ad501befffe2&quot;,
    &quot;wtxid&quot;: &quot;c3808cff6390357ed24705c470d4da0e3608fdcb43d34b5283a933bccb439c84&quot;,
    &quot;allowed&quot;: false,
    &quot;reject-reason&quot;: &quot;non-mandatory-script-verify-flag (Invalid Schnorr signature)&quot;
  }
]
</code></pre>
<p>The rest of the text has been truncated.</p>

<taproot><schnorr-signatures><sighash>
Example of key-path BIP-0341 signature message computation
Greg Tonoski
# Example of key-path BIP-0341 signature message computation

(Asked by: username_0 on 2023-10-24)

Is there an example of key-path BIP-0341 signature message computation, perhaps? Or, could you tell what is incorrect in the example below, please?

```
deriveaddresses "rawtr(cV628xvqToz45dwdPmTcJ9RgEVnWMwP8dpZBGzb9LfTk3sBHFNwc)#5u2k7u2l"
[
  "tb1p2564e2pujul3m97wpcuy8jza0zg94uttfhznr0zg3etjztfrqytq7n93n2"
]
testmempoolaccept '["020000000001015f1ab0cd64d050721e4bcd63ffee5c1b4f6224b5fa8f7343062d1f0e32ab87eb0000000000fdffffff01e8030000000000001600140bc6dda83a5c6346d31808f685c7cbf1ae20a23e0140caf56a13c54a7d786579ad9b92868082685dafa4c7d97ee5d031d80105de0eea501548e63812806ec1adaf2fab6de48ec59a59701c5cdfa2e9f84e9a3c4109d900000000"]'

[
  {
    "txid": "466474502a15ca2258cf5cadcfec6743c499720843cd51c2c646ad501befffe2",
    "wtxid": "c3808cff6390357ed24705c470d4da0e3608fdcb43d34b5283a933bccb439c84",
    "allowed": false,
    "reject-reason": "non-mandatory-script-verify-flag (Invalid Schnorr signature)"
  }
]

```

The rest of the text has been truncated.

**Tags:** taproot, schnorr-signatures, sighash


---

## 2 answers

### Answer by username_1 on 2023-10-26. Score: 1 | Accepted answer

There are 4 issues:

1. Missing `0x00` prefix byte (epoch byte)
2. The message needs to be hashed before it can be signed. It should be a tagged hash with the tag "TapSighash".
3. The txid in your prevouts is backwards. It should be byteswapped from what is displayed (i.e. it is the actual result of the hash)
4. The sequence in your input is `0xfdffffff`, not `0xffffff`

Here is what I have computed for each part:

| Message part | Serialization |
| --- | --- |
| Epoch | 00 |
| hash\_type | 00 |
| nVersion | 02000000 |
| nLockTime | 00000000 |
| sha\_prevouts | 1da888957df6ce1ac5462fc1b08fe98f2f211026b4b91b71dbd8470239495faf |
| sha\_amounts | 3e1f6dbf626619317d04b24ac25799871709e0f3e35cc0e05dae4da21bc5a162 |
| sha\_scriptpubkeys | 1e43f82396d787c36855662b53aa84af812f10cb9bdca5f2328b12ffea3f833c |
| sha\_sequencues | 23e9829bfb4e23fbd3c4848baa035af15d73bcb83e510f7f097f90a21a4280d2 |
| sha\_outputs | fd984a928339e11d1dcda5174c34ddfc8bcc976edceb919d0f52f127d0cd0bf7 |
| spend\_type | 00 |
| input\_index | 00000000 |

The entire thing that you hash should be

```
000002000000000000001da888957df6ce1ac5462fc1b08fe98f2f211026b4b91b71dbd8470239495faf3e1f6dbf626619317d04b24ac25799871709e0f3e35cc0e05dae4da21bc5a1621e43f82396d787c36855662b53aa84af812f10cb9bdca5f2328b12ffea3f833c23e9829bfb4e23fbd3c4848baa035af15d73bcb83e510f7f097f90a21a4280d2fd984a928339e11d1dcda5174c34ddfc8bcc976edceb919d0f52f127d0cd0bf70000000000

```

and you should get a hash of

```
1b9589328e6c5d8b71288ee5f93a78d655b724ffa0f5ebf23f88983dda8c5676

```

> **Comments:**
> **username_0**: Still something is missing despite replacing the big-endian with little-endian txid. Thanks for a response.  
> **username_1**: I've updated my answer to include Pieter's comment and the remaining issue I found.  

---

### Answer by username_0 on 2023-10-31. Score: 0

Elaborating on the answer:

| Position | Name of a message part | Explanatory expression | Value before SHA-256 | Final value (hex) |
| --- | --- | --- | --- | --- |
| 1 | hash\_type | 0x00 | not applicable | 00 |
| 2 | nVersion | LE( 0x00000002 ) | not applicable | 02000000 |
| 3 | nLockTime | LE( 0x00000000 ) | not applicable | 00000000 |
| 4 | sha\_prevouts | sha256( LE( predecessor\_txid ) || LE( predecessor\_vout ) ) | sha256( 5f1ab0cd64d050721e4bcd63ffee5c1b4f6224b5fa8f7343062d1f0e32ab87eb00000000 ) | 1da888957df6ce1ac5462fc1b08fe98f2f211026b4b91b71dbd8470239495faf |
| 5 | sha\_amounts | sha256( LE( predecessor\_tx\_amount ) ) | sha256( LE( 0000000000001f40 ) ) | 3e1f6dbf626619317d04b24ac25799871709e0f3e35cc0e05dae4da21bc5a162 |
| 6 | sha\_scriptpubkeys | sha256( predecessor\_scriptpubkey\_length || predecessor\_scriptpubkey ) | sha256( 22512055355ca83c973f1d97ce0e3843c85d78905af16b4dc531bc488e57212d230116 ) | 1e43f82396d787c36855662b53aa84af812f10cb9bdca5f2328b12ffea3f833c |
| 7 | sha\_sequences | sha256( LE( predecessor\_tx\_sequences ) | sha256( LE( fffffffd ) ) | 23e9829bfb4e23fbd3c4848baa035af15d73bcb83e510f7f097f90a21a4280d2 |
| 8 | sha\_outputs | sha256( LE( new\_tx\_amount ) || new\_tx\_scriptpubkey\_length || new\_tx\_scriptpubkey | sha256( e8030000000000001600140bc6dda83a5c6346d31808f685c7cbf1ae20a23e ) | fd984a928339e11d1dcda5174c34ddfc8bcc976edceb919d0f52f127d0cd0bf7 |
| 9 | spend\_type | 0x00 | not applicable | 00 |
| 10 | input\_index | LE( 0x00000000) | not applicable | 00000000 |

```
message digest = hashTapSighash( 0x00 || SigMsg( 0x00, 0 ) ) = sha256( sha256( "TapSighash" ) || sha256( "TagSighash" ) || sighash_epoch || message_parts_above ) = sha256( sha256( 0x54617053696768617368 ) || sha256( 0x54617053696768617368 ) || 0x00 || 0x0002000000000000001da888957df6ce1ac5462fc1b08fe98f2f211026b4b91b71dbd8470239495faf3e1f6dbf626619317d04b24ac25799871709e0f3e35cc0e05dae4da21bc5a1621e43f82396d787c36855662b53aa84af812f10cb9bdca5f2328b12ffea3f833c23e9829bfb4e23fbd3c4848baa035af15d73bcb83e510f7f097f90a21a4280d2fd984a928339e11d1dcda5174c34ddfc8bcc976edceb919d0f52f127d0cd0bf70000000000 ) = 0x1b9589328e6c5d8b71288ee5f93a78d655b724ffa0f5ebf23f88983dda8c5676

```

[Reference.py](https://github.com/bitcoin/bips/blob/master/bip-0340/reference.py) used to compute the signature:

```
reference.schnorr_sign(b'\x1b\x95\x892\x8el]\x8bq(\x8e\xe5\xf9:x\xd6U\xb7$\xff\xa0\xf5\xeb\xf2?\x88\x98=\xda\x8cVv', b'\xdf\xf1\xc8\xc2\xc0\x16\xa5r\x91KLZ\xdb\x87\x91\xd6+Gh\xae\x9d\na\xbe\x8a\xb9L\xf5\x03\x8d}\x90', b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00')

```

Signature=`0x082779351eb8509993140dbcb9c6d1d4928c6cf397569c49891334ba6d6c9c0bbe6312d4f7af558f3d83398c4dfdf6caabb1b6bcd7cba216141450e240746299`

Verification:

```
testmempoolaccept '["020000000001015f1ab0cd64d050721e4bcd63ffee5c1b4f6224b5fa8f7343062d1f0e32ab87eb0000000000fdffffff01e8030000000000001600140bc6dda83a5c6346d31808f685c7cbf1ae20a23e0140082779351eb8509993140dbcb9c6d1d4928c6cf397569c49891334ba6d6c9c0bbe6312d4f7af558f3d83398c4dfdf6caabb1b6bcd7cba216141450e24074629900000000"]'

[
  {
    "txid": "466474502a15ca2258cf5cadcfec6743c499720843cd51c2c646ad501befffe2",
    "wtxid": "9fbcd4eb32f2811786d46ff5272347891badba07b7b7d1d02d64d71430a2778f",
    "allowed": true,
    "vsize": 99,
    "fees": {
      "base": 0.00007000,
      "effective-feerate": 0.00070707,
      "effective-includes": [
        "9fbcd4eb32f2811786d46ff5272347891badba07b7b7d1d02d64d71430a2778f"
      ]
    }
  }
]
deriveaddresses "rawtr(cV628xvqToz45dwdPmTcJ9RgEVnWMwP8dpZBGzb9LfTk3sBHFNwc)#5u2k7u2l"
[
  "tb1p2564e2pujul3m97wpcuy8jza0zg94uttfhznr0zg3etjztfrqytq7n93n2"
]

```


---

