<p>In a key path spend, you always sign with the private key corresponding to the output key. If that key is a tweaked public key (it's recommended to always use a tweaked key), you will also need to tweak the private key.</p>
<p>In a script path spend, the internal (untweaked) key is used to prove the committment to a script tree. The actual script will contain its own public keys that may be unrelated to the internal or output key, and producing signatures for them will require their corresponding private keys.</p>
<p>You may wish to read <a href="https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki#script-validation-rules" rel="nofollow noreferrer">BIP341: Script validation rules</a> to make sure you understand how exactly Taproot inputs are validated.</p>

CC BY-SA 4.0
2024-02-05T15:04:53.163Z
2024-02-05T15:04:53.163Z
Vojtěch Strnad
<p>The transaction only has one input, where its scriptPubKey is --&gt; Op_1 Q , where Q is the tweaked public key.</p>
<p>Let p = private key, P = Public key, q = p + tweak, Q = tweaked Public key</p>
<p>To create the transaction you have to populate the witness field:</p>
<ol>
<li><p>Key Path Spend:
Do you use q (the tweaked private key) to sign the transaction?</p>
<p>That is,  <strong>s = k + H(R,Q, txdata)q</strong> and <strong>sig is (R,s)</strong> where <strong>k</strong> is the nonce</p>
</li>
<li><p>Script Path Spend:  Do you use p (untweaked internal private key) to sign the transaction</p>
<p>That is,  <strong>s = q + h(Q,P, txdata)p</strong> and <strong>sig is (Q,s)</strong> where <strong>q</strong> is now the nonce</p>
</li>
</ol>
<p>I am not a coder so trying to find the answer to this has been difficult given that I think you would need to code to understand how the mechanics works.</p>

CC BY-SA 4.0
2024-02-07T00:00:33.693Z
Vojtěch - I appreciate the quick response and the link to BIP341. I read the article (several times) and I can say that I now finally understand Taproot. However, it was your comment about the keys used to sign a Script Path Spend transaction, are the ones in the executed scripts that actually made it all clear to me. I am not sure why it didn't click in my head previously, as its seems so obvious now.
J S
<segregated-witness><signature><taproot><key-tweaking>
Which private key is used in Taproot transactions?
J S
# Which private key is used in Taproot transactions?

(Asked by: username_0 on 2024-02-05)

The transaction only has one input, where its scriptPubKey is --> Op\_1 Q , where Q is the tweaked public key.

Let p = private key, P = Public key, q = p + tweak, Q = tweaked Public key

To create the transaction you have to populate the witness field:

1. Key Path Spend:
   Do you use q (the tweaked private key) to sign the transaction?

   That is, **s = k + H(R,Q, txdata)q** and **sig is (R,s)** where **k** is the nonce
2. Script Path Spend: Do you use p (untweaked internal private key) to sign the transaction

   That is, **s = q + h(Q,P, txdata)p** and **sig is (Q,s)** where **q** is now the nonce

I am not a coder so trying to find the answer to this has been difficult given that I think you would need to code to understand how the mechanics works.

**Tags:** segregated-witness, signature, taproot, key-tweaking

> **Comments:**
> **username_0**: username_1 - I appreciate the quick response and the link to BIP341. I read the article (several times) and I can say that I now finally understand Taproot. However, it was your comment about the keys used to sign a Script Path Spend transaction, are the ones in the executed scripts that actually made it all clear to me. I am not sure why it didn't click in my head previously, as its seems so obvious now.  

---

## 1 answers

### Answer by username_1 on 2024-02-05. Score: 2 | Accepted answer

In a key path spend, you always sign with the private key corresponding to the output key. If that key is a tweaked public key (it's recommended to always use a tweaked key), you will also need to tweak the private key.

In a script path spend, the internal (untweaked) key is used to prove the committment to a script tree. The actual script will contain its own public keys that may be unrelated to the internal or output key, and producing signatures for them will require their corresponding private keys.

You may wish to read [BIP341: Script validation rules](https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki#script-validation-rules) to make sure you understand how exactly Taproot inputs are validated.


---

