<p>The actual protocol as described all the way back in 2012 in the paper <a href="https://arxiv.org/abs/1212.3257" rel="nofollow noreferrer">Homomorphic Payment Addresses and the Pay-to-Contract Protocol</a> is a bit more complicated, but the basics are as you've described them: create a hash from a message, then tweak the public key with this hash and you'll be able to prove later that the public key commits to your original message. Taproot implements a version of this protocol, as spending using the script path requires you to prove that your public key commits to the root of a script tree.</p>
<p><a href="https://bitcoinops.org/en/topics/pay-to-contract-outputs/" rel="nofollow noreferrer">Bitcoin Optech</a> has a topic for Pay-to-Contract which summarizes the topic and links to a few instances where the protocol is discussed.</p>

CC BY-SA 4.0
2023-11-07T23:19:48.657Z
I thought Taproot always include some kind of P2C since you are tweaking public key and a root of MAST?
LeaBit
CC BY-SA 4.0
2023-11-07T23:28:59.487Z
BIP341 recommends that the key is tweaked even if you don't want to include any scripts, but you don't need to.
Vojtěch Strnad
CC BY-SA 4.0
2023-11-07T23:33:27.727Z
So you can use taproot without tweaking public key and the root of MAST in scriptPubKey?
LeaBit
CC BY-SA 4.0
2023-11-07T23:49:55.840Z
Yes, see: [Can you use un-tweaked public key with P2TR?](https://bitcoin.stackexchange.com/q/109716/121614)
Vojtěch Strnad
CC BY-SA 4.0
2023-11-07T23:09:23.950Z
2023-11-07T23:09:23.950Z
Vojtěch Strnad
<p>What does Pay to Contract (P2C) mean in Bitcoin? <strong>Is it just tweaking private/public key with the hash (represented as a number) of some message and then using classic P2PKH?</strong></p>
<p>For example, if we are buying some car, the message <code>this payment is for the car</code> goes into SHA256 hash function. After that, tweaking the given number with the public key and by making RIPEMD(SHA256()) hash of it, we create classic P2PKH output. Later, we can prove that the payment was for the car with revealing the original public key and the message.</p>
<p>Is it P2C? Does it represent something more?</p>

<terminology><key-tweaking>
What does Pay to Contract (P2C) mean?
LeaBit
# What does Pay to Contract (P2C) mean?

(Asked by: username_0 on 2023-11-07)

What does Pay to Contract (P2C) mean in Bitcoin? **Is it just tweaking private/public key with the hash (represented as a number) of some message and then using classic P2PKH?**

For example, if we are buying some car, the message `this payment is for the car` goes into SHA256 hash function. After that, tweaking the given number with the public key and by making RIPEMD(SHA256()) hash of it, we create classic P2PKH output. Later, we can prove that the payment was for the car with revealing the original public key and the message.

Is it P2C? Does it represent something more?

**Tags:** terminology, key-tweaking


---

## 1 answers

### Answer by username_1 on 2023-11-07. Score: 4 | Accepted answer

The actual protocol as described all the way back in 2012 in the paper [Homomorphic Payment Addresses and the Pay-to-Contract Protocol](https://arxiv.org/abs/1212.3257) is a bit more complicated, but the basics are as you've described them: create a hash from a message, then tweak the public key with this hash and you'll be able to prove later that the public key commits to your original message. Taproot implements a version of this protocol, as spending using the script path requires you to prove that your public key commits to the root of a script tree.

[Bitcoin Optech](https://bitcoinops.org/en/topics/pay-to-contract-outputs/) has a topic for Pay-to-Contract which summarizes the topic and links to a few instances where the protocol is discussed.

> **Comments:**
> **username_0**: I thought Taproot always include some kind of P2C since you are tweaking public key and a root of MAST?  
> **username_1**: BIP341 recommends that the key is tweaked even if you don't want to include any scripts, but you don't need to.  
> **username_0**: So you can use taproot without tweaking public key and the root of MAST in scriptPubKey?  
> **username_1**: Yes, see: [Can you use un-tweaked public key with P2TR?](https://bitcoin.stackexchange.com/q/109716/121614)  

---

