<p>Finally, I found the problem.</p>
<ol>
<li><p>The signature is generated with the <code>default</code> sig type, aka <code>0x00</code>. But I use the <code>sighash_all</code>, aka <code>0x01</code> to generate the sighash.</p>
</li>
<li><p>I missed the <a href="https://github.com/bitcoin/bips/blob/master/bip-0342.mediawiki#common-signature-message-extension" rel="nofollow noreferrer">extension part</a>. Which is &lt;tapleaf_hash_of_script&gt; &lt;0x00&gt; &lt;0xFFFFFFFF&gt;, and should be appended at the end of sigmsg.</p>
</li>
<li><p>As Peter commented, we need the internal pubkey to verify the script path spending.</p>
</li>
</ol>

CC BY-SA 4.0
2023-05-30T11:31:42.880Z
Not the internal pubkey, but the pubkey in the script. In this case they are the same, but they don't have to be.
Pieter Wuille
CC BY-SA 4.0
2023-05-30T09:47:12.950Z
2023-05-30T09:47:12.950Z
lj zn
<p>I am trying to verify the witness of a P2TR transaction, but the signature verification failed, could you please help?</p>
<p>The raw transaction:</p>
<pre><code>010000000001016dacbb729930a8ba699a4188880d1b3525f430e52ad0c01fb4f6eae7987febd50300000000fdffffff014a01000000000000225120e2bc122cdb981a985074e182db9120e52c79b96710d517f84ab186c6ab092c4a0340318bd919ead99017116322d9b861fef0e1f7d26a115dcc7b48fba34bfd5be023ef6d5ab364861b99bd0950ff74b3e93e50c6fd6d17751336f0cf435bb0738c5d8e2064a5ee88fba503623726eabb0aa54bcced4eb2328d30dd05c8088bf5ed26fc41ac0063036f7264010118746578742f706c61696e3b636861727365743d7574662d3800487b2270223a226f72632d3230222c20227469636b223a226d656d65222c20226964223a2233333838303736222c20226f70223a226d696e74222c2022616d74223a2231303030227d6821c064a5ee88fba503623726eabb0aa54bcced4eb2328d30dd05c8088bf5ed26fc4100000000
</code></pre>
<p>The <code>scriptpubkey</code> of input: <code>5120dde70c00d3aec1533bd7f8b6f704ec21e6ed0a0de317a0ccf8199abde58d3062</code> , and the value: <code>4677</code>.</p>
<p>Above are arguments, and I generate a <code>sigmsg</code> from those arguments:</p>
<pre><code>000101000000000000009d9a573f31fa9eb2787db1c5d2162e36d76d21b0ecfa8c1e65617a4f5ca4a54bb4e368d5ab0ab9129e0c72ac46249d5bb8dc63b28638ebbc35bb69f62bae4ef4e342cce0133cd546aca2580d6f5bc5a184674e8dadda449fcfd073f503a44fe423e9829bfb4e23fbd3c4848baa035af15d73bcb83e510f7f097f90a21a4280d2386a04a2c1c490d8709f4b2bdf3d0d95d2aca0b6052ecc4a4c6a93fa33fba6ff0200000000
</code></pre>
<p>Then <code>sighash</code>: <code>54383836474379391a2ef0151bdbd9dc0e3b0e770f5052c433952082b09a2d7d</code>.</p>
<p>The <code>merkle_root</code>: <code>ec24ababd925ccbc309ce2684694fa32d17a8263b0a3f2d2999febfdfc7e5d28</code>.</p>
<p>And the <code>tweaked_pubkey</code>: <code>dde70c00d3aec1533bd7f8b6f704ec21e6ed0a0de317a0ccf8199abde58d3062</code>.</p>
<p>In the end, I use signature <code>318bd919ead99017116322d9b861fef0e1f7d26a115dcc7b48fba34bfd5be023ef6d5ab364861b99bd0950ff74b3e93e50c6fd6d17751336f0cf435bb0738c5d</code> to verify with <code>sighash</code> and <code>tweaked_pubkey</code>, but failed.</p>

CC BY-SA 4.0
2023-05-29T13:12:45.963Z
If it's a script path spend, the signature in it should be verified against the public key at it appears in the script, not the tweaked pubkey (the latter is only for key path spends).
Pieter Wuille
CC BY-SA 4.0
2023-05-29T13:52:56.627Z
@peter Thank you. I tried the internal pubkey `64a5ee88fba503623726eabb0aa54bcced4eb2328d30dd05c8088bf5ed26fc41`, but still can't pass the schnorr signature verify.
lj zn
<taproot><schnorr-signatures><p2tr>
Taproot Script Path Spending can't pass signature verification
lj zn
# Taproot Script Path Spending can't pass signature verification

(Asked by: username_0 on 2023-05-29)

I am trying to verify the witness of a P2TR transaction, but the signature verification failed, could you please help?

The raw transaction:

```
010000000001016dacbb729930a8ba699a4188880d1b3525f430e52ad0c01fb4f6eae7987febd50300000000fdffffff014a01000000000000225120e2bc122cdb981a985074e182db9120e52c79b96710d517f84ab186c6ab092c4a0340318bd919ead99017116322d9b861fef0e1f7d26a115dcc7b48fba34bfd5be023ef6d5ab364861b99bd0950ff74b3e93e50c6fd6d17751336f0cf435bb0738c5d8e2064a5ee88fba503623726eabb0aa54bcced4eb2328d30dd05c8088bf5ed26fc41ac0063036f7264010118746578742f706c61696e3b636861727365743d7574662d3800487b2270223a226f72632d3230222c20227469636b223a226d656d65222c20226964223a2233333838303736222c20226f70223a226d696e74222c2022616d74223a2231303030227d6821c064a5ee88fba503623726eabb0aa54bcced4eb2328d30dd05c8088bf5ed26fc4100000000

```

The `scriptpubkey` of input: `5120dde70c00d3aec1533bd7f8b6f704ec21e6ed0a0de317a0ccf8199abde58d3062` , and the value: `4677`.

Above are arguments, and I generate a `sigmsg` from those arguments:

```
000101000000000000009d9a573f31fa9eb2787db1c5d2162e36d76d21b0ecfa8c1e65617a4f5ca4a54bb4e368d5ab0ab9129e0c72ac46249d5bb8dc63b28638ebbc35bb69f62bae4ef4e342cce0133cd546aca2580d6f5bc5a184674e8dadda449fcfd073f503a44fe423e9829bfb4e23fbd3c4848baa035af15d73bcb83e510f7f097f90a21a4280d2386a04a2c1c490d8709f4b2bdf3d0d95d2aca0b6052ecc4a4c6a93fa33fba6ff0200000000

```

Then `sighash`: `54383836474379391a2ef0151bdbd9dc0e3b0e770f5052c433952082b09a2d7d`.

The `merkle_root`: `ec24ababd925ccbc309ce2684694fa32d17a8263b0a3f2d2999febfdfc7e5d28`.

And the `tweaked_pubkey`: `dde70c00d3aec1533bd7f8b6f704ec21e6ed0a0de317a0ccf8199abde58d3062`.

In the end, I use signature `318bd919ead99017116322d9b861fef0e1f7d26a115dcc7b48fba34bfd5be023ef6d5ab364861b99bd0950ff74b3e93e50c6fd6d17751336f0cf435bb0738c5d` to verify with `sighash` and `tweaked_pubkey`, but failed.

**Tags:** taproot, schnorr-signatures, p2tr

> **Comments:**
> **username_1**: If it's a script path spend, the signature in it should be verified against the public key at it appears in the script, not the tweaked pubkey (the latter is only for key path spends).  
> **username_0**: @peter Thank you. I tried the internal pubkey `64a5ee88fba503623726eabb0aa54bcced4eb2328d30dd05c8088bf5ed26fc41`, but still can't pass the schnorr signature verify.  

---

## 1 answers

### Answer by username_0 on 2023-05-30. Score: 1

Finally, I found the problem.

1. The signature is generated with the `default` sig type, aka `0x00`. But I use the `sighash_all`, aka `0x01` to generate the sighash.
2. I missed the [extension part](https://github.com/bitcoin/bips/blob/master/bip-0342.mediawiki#common-signature-message-extension). Which is <tapleaf\_hash\_of\_script> <0x00> <0xFFFFFFFF>, and should be appended at the end of sigmsg.
3. As Peter commented, we need the internal pubkey to verify the script path spending.

> **Comments:**
> **username_1**: Not the internal pubkey, but the pubkey in the script. In this case they are the same, but they don't have to be.  

---

