<p>No, this would likely lead to a loss of funds. Key tweaks are created by a recipient who tweaks a key before sharing the resulting tweaked public key in the form of a destination address.</p>
<p>If you tweak a foreign key, the original intended recipient would have no way of recognizing independently that that their key is associated with the new address at all, and very likely would be unable to spend the funds even when informed about the tweak.</p>

CC BY-SA 4.0
2021-06-17T18:40:01.150Z
Are you sure there's a loss of funds? Even If I reveal the tweak + original pubkey + new pubkey to the exchange?
Hugo Franklin
CC BY-SA 4.0
2021-06-17T18:45:01.200Z
Yes. What if e.g. the recipient uses a Hardware Security Module that can only sign for addresses they generated? The recipient specifies under what circumstances they recognize a payment. The sender has no business making assumptions how they may modify that.--If your landlord tells you that they expect to be paid by check in the mail, you don't bury a bag of quarters in their frontyard and tell them where to dig, do you?
Murch
CC BY-SA 4.0
2021-06-17T19:30:15.150Z
Or worse, don't tell them where to dig, and then act all confused and surprised when they ask you about the money.
Pieter Wuille
CC BY-SA 4.0
2021-06-17T18:31:08.700Z
2021-06-17T18:31:08.700Z
Murch
<p>BIP341 recommends tweaking even public keys which have no intended script path, with a dummy tweak. This prevents certain attacks (though none relevant in your scenario).</p>
<ol>
<li><p>You can tweak an existing public key, yes, but the address will get another meaning.</p>
</li>
<li><p>Absolutely not. Only the receiver's software determines which address they accept coins on. If you pay to anything else, you should assume the coins are sent into the void. It is <em>possible</em> that say an exchange can still access the coins with their keys if you inform them of the tweak, but this cannot be relied upon. The private keys may be in a hardware security module or so, which has no means of signing for anything but the intended address.</p>
</li>
<li><p>In a way, yes, but that turns it into another address, with other semantics.</p>
</li>
</ol>
<p>In <em>theory</em>, if someone has the ability to sign for a public point <em>P</em>, they can sign for a tweaked version of <em>P</em>, assuming they know the tweak. The tweak cannot be inferred from the tweaked point; it has to be conveyed separately. This also works recursively, because if you can sign for a tweaked version, you can also signed for a tweak of that. Again however, this is theory and cannot be relied upon in practice. Only the receiver determines which address they accept.</p>

CC BY-SA 4.0
2021-06-17T18:30:34.207Z
2021-06-17T18:39:02.097Z
2021-06-17T18:39:02.097Z
Pieter Wuille
<p>Suppose I get a taproot address=schnorr public key from an exchange that is not tweaked using mast merkle root and I wish to tweak that public key.</p>
<p>This will yield a potentially different public key.</p>
<ol>
<li>Can I do this?</li>
<li>If I Do this, will the exchange still recognize my deposit?</li>
<li>In general, can I re-tweak already tweaked public keys at will?</li>
</ol>
<p>Thanks.</p>

CC BY-SA 4.0
2021-06-17T18:50:18.703Z
to explain my motivation more in depth, it would be cool if users could be embedding additional data on chain into the tweaks, similar to how they do now with OP_RETURN just privately
Hugo Franklin
CC BY-SA 4.0
2021-06-17T18:57:50.807Z
Sounds like an [XY-problem](https://en.wikipedia.org/wiki/XY_problem). You should consider asking another question, but directly about the issue you want to solve rather than an approach you are considering. :)
Murch
CC BY-SA 4.0
2021-06-17T19:06:40.837Z
meh not really. it would be still cool because 1MB of pubkeys + 1MB data in tweaks > 1MB not tweaked pubkeys
Hugo Franklin
CC BY-SA 4.0
2021-06-17T20:09:04.760Z
It sounds like you may be looking for sign-to-contract: https://blog.eternitywall.com/2018/04/13/sign-to-contract/. That's a scheme that allows for a *signature* to commit to arbitrary data, without making it larger. This has the advantage that public keys are not modified, and thus it is purely a signer-side issue.
Pieter Wuille
<taproot><schnorr-signatures><key-tweaking>
Retweaking other person's or my own taproot address
Hugo Franklin
# Retweaking other person's or my own taproot address

(Asked by: username_0 on 2021-06-17)

Suppose I get a taproot address=schnorr public key from an exchange that is not tweaked using mast merkle root and I wish to tweak that public key.

This will yield a potentially different public key.

1. Can I do this?
2. If I Do this, will the exchange still recognize my deposit?
3. In general, can I re-tweak already tweaked public keys at will?

Thanks.

**Tags:** taproot, schnorr-signatures, key-tweaking

> **Comments:**
> **username_0**: to explain my motivation more in depth, it would be cool if users could be embedding additional data on chain into the tweaks, similar to how they do now with OP_RETURN just privately  
> **username_1**: Sounds like an [XY-problem](https://en.wikipedia.org/wiki/XY_problem). You should consider asking another question, but directly about the issue you want to solve rather than an approach you are considering. :)  
> **username_0**: meh not really. it would be still cool because 1MB of pubkeys + 1MB data in tweaks > 1MB not tweaked pubkeys  
> **username_2**: It sounds like you may be looking for sign-to-contract: https://blog.eternitywall.com/2018/04/13/sign-to-contract/. That's a scheme that allows for a *signature* to commit to arbitrary data, without making it larger. This has the advantage that public keys are not modified, and thus it is purely a signer-side issue.  

---

## 2 answers

### Answer by username_1 on 2021-06-17. Score: 1 | Accepted answer

No, this would likely lead to a loss of funds. Key tweaks are created by a recipient who tweaks a key before sharing the resulting tweaked public key in the form of a destination address.

If you tweak a foreign key, the original intended recipient would have no way of recognizing independently that that their key is associated with the new address at all, and very likely would be unable to spend the funds even when informed about the tweak.

> **Comments:**
> **username_0**: Are you sure there's a loss of funds? Even If I reveal the tweak + original pubkey + new pubkey to the exchange?  
> **username_1**: Yes. What if e.g. the recipient uses a Hardware Security Module that can only sign for addresses they generated? The recipient specifies under what circumstances they recognize a payment. The sender has no business making assumptions how they may modify that.--If your landlord tells you that they expect to be paid by check in the mail, you don't bury a bag of quarters in their frontyard and tell them where to dig, do you?  
> **username_2**: Or worse, don't tell them where to dig, and then act all confused and surprised when they ask you about the money.  

---

### Answer by username_2 on 2021-06-17. Score: 1

BIP341 recommends tweaking even public keys which have no intended script path, with a dummy tweak. This prevents certain attacks (though none relevant in your scenario).

1. You can tweak an existing public key, yes, but the address will get another meaning.
2. Absolutely not. Only the receiver's software determines which address they accept coins on. If you pay to anything else, you should assume the coins are sent into the void. It is *possible* that say an exchange can still access the coins with their keys if you inform them of the tweak, but this cannot be relied upon. The private keys may be in a hardware security module or so, which has no means of signing for anything but the intended address.
3. In a way, yes, but that turns it into another address, with other semantics.

In *theory*, if someone has the ability to sign for a public point *P*, they can sign for a tweaked version of *P*, assuming they know the tweak. The tweak cannot be inferred from the tweaked point; it has to be conveyed separately. This also works recursively, because if you can sign for a tweaked version, you can also signed for a tweak of that. Again however, this is theory and cannot be relied upon in practice. Only the receiver determines which address they accept.


---

