<p>Consider two keyapirs, pubkey <code>A</code> with privkey <code>a</code> and pubkey <code>B</code> with privkey <code>b</code>. If you add the pubkeys together to get pubkey <code>C</code>, (<code>A + B = C</code>), <code>C</code>'s private key <code>c</code> is also the sum of the two private keys, i.e. <code>a + b = c</code>. Furthermore, Schnorr signatures over the same message can be added together to produce a valid signature for the sum of the pubkeys, i.e. <code>sig(a, msg) + sig(b, msg) = sig(c, msg)</code>. This linearity property of pubkeys and Schnorr signatures is what Taproot makes use of.</p>
<p>The most basic construction in Taproot is the keypath spend. This is simply a valid Schnorr signature for the output public key. At the most basic, you could just generate a new random keypair, put the public key in your P2TR script, and then spending is just generating a Schnorr signature with the private key.</p>
<p>However BIP 341 recommends using an &quot;internal key&quot;. This is just a normal keypair that has a &quot;tweak&quot; added to it. In its most basic form, the tweak is just the hash of the public key itself. As a hash produces a 256 bit value, it can be treated as a private key, so the public key is computed with the tweak as the private key, and that public key is added to the internal key's pubkey to get the output key. When spending, the tweak is added to the private key so to get the private key of the output pubkey so that a valid signature can be produced for the output pubkey.</p>
<p>The last form a taproot output key can take is one that has both an internal key and a script tree. The script tree is a set of scripts which are used as the leaves of a merkle tree. Then the hashes of that merkle tree are computed until the merkle root is computed. Computing the output pubkey is almost the same as the previous construction with just the internal key. The only difference is that the tweak is the internal public key concatenated with the merkle root. The rest of the procedure remains the same.</p>
<p>In all of these constructions, there's always a random keypair, whether that is the output key itself, or the internal key. Even when you add the tweak in, the randomness is still preserved. The additional steps of hashing the tweak also help to make the tweak more random.</p>

CC BY-SA 4.0
2023-11-08T06:08:56.697Z
2023-11-08T06:08:56.697Z
Ava Chow
<p>I've started learning Taproot and I'm having trouble understanding some of the general story behind how it works in the context of a public key in <code>scriptPubKey</code>.</p>
<p>The segWit v1 (Taproot) <code>scriptPubKey</code> looks like <code>1 &lt;32-public-key&gt;</code>. <strong>However, what is the way to create this public key?</strong></p>
<p><strong>Can someone give me some general abstract story of how this public key is created? I don't need details, just some general story to create a bigger picture. Below I have just listed the questions that would be good to include in the answer.</strong></p>
<p>I know that we need to create MAST, and then by tweaking MAST root and some random public key we get the public key for the taproot (something like that). However, what if we do not have MAST and we just want to use classic signature (I think its called <em>keypath</em>)? We are not doing any tweaking then? Also, is the underline public key (that was tweaked with MAST root) really random or does it result from the application of some algorithm (Schnorr?)?</p>

CC BY-SA 4.0
2023-11-08T00:48:40.383Z
Hi LeaBit, your post contains a lot of different questions, can you shorten it to just one and make the other questions each into their own post if needed?
Vojtěch Strnad
CC BY-SA 4.0
2023-11-08T01:00:04.613Z
@VojtěchStrnad Hi Vojtech, my question is just `how to create public key (and perhaps signature) for the taproot`.  This text below are not actual questions but notes what I expect in answer. I shortened it a bit to focus on one thing only. Hope its better now.
LeaBit
CC BY-SA 4.0
2023-11-08T14:45:30.553Z
For general emphasis or introducing lingo, it may be better to use _italicized_ style rather than `code` style. Too much code styling can reduce readability. Around here, most users seem to use code styling mostly to present variable or function names, or when inlining formulas or logic expressions.
Murch
<address-generation><taproot><p2tr><output-script>
What is the way to create public key in P2TR?
LeaBit
# What is the way to create public key in P2TR?

(Asked by: username_0 on 2023-11-08)

I've started learning Taproot and I'm having trouble understanding some of the general story behind how it works in the context of a public key in `scriptPubKey`.

The segWit v1 (Taproot) `scriptPubKey` looks like `1 <32-public-key>`. **However, what is the way to create this public key?**

**Can someone give me some general abstract story of how this public key is created? I don't need details, just some general story to create a bigger picture. Below I have just listed the questions that would be good to include in the answer.**

I know that we need to create MAST, and then by tweaking MAST root and some random public key we get the public key for the taproot (something like that). However, what if we do not have MAST and we just want to use classic signature (I think its called *keypath*)? We are not doing any tweaking then? Also, is the underline public key (that was tweaked with MAST root) really random or does it result from the application of some algorithm (Schnorr?)?

**Tags:** address-generation, taproot, p2tr, output-script

> **Comments:**
> **username_1**: Hi username_0, your post contains a lot of different questions, can you shorten it to just one and make the other questions each into their own post if needed?  
> **username_0**: @username_1 Hi Vojtech, my question is just `how to create public key (and perhaps signature) for the taproot`.  This text below are not actual questions but notes what I expect in answer. I shortened it a bit to focus on one thing only. Hope its better now.  
> **username_2**: For general emphasis or introducing lingo, it may be better to use _italicized_ style rather than `code` style. Too much code styling can reduce readability. Around here, most users seem to use code styling mostly to present variable or function names, or when inlining formulas or logic expressions.  

---

## 1 answers

### Answer by username_3 on 2023-11-08. Score: 2 | Accepted answer

Consider two keyapirs, pubkey `A` with privkey `a` and pubkey `B` with privkey `b`. If you add the pubkeys together to get pubkey `C`, (`A + B = C`), `C`'s private key `c` is also the sum of the two private keys, i.e. `a + b = c`. Furthermore, Schnorr signatures over the same message can be added together to produce a valid signature for the sum of the pubkeys, i.e. `sig(a, msg) + sig(b, msg) = sig(c, msg)`. This linearity property of pubkeys and Schnorr signatures is what Taproot makes use of.

The most basic construction in Taproot is the keypath spend. This is simply a valid Schnorr signature for the output public key. At the most basic, you could just generate a new random keypair, put the public key in your P2TR script, and then spending is just generating a Schnorr signature with the private key.

However BIP 341 recommends using an "internal key". This is just a normal keypair that has a "tweak" added to it. In its most basic form, the tweak is just the hash of the public key itself. As a hash produces a 256 bit value, it can be treated as a private key, so the public key is computed with the tweak as the private key, and that public key is added to the internal key's pubkey to get the output key. When spending, the tweak is added to the private key so to get the private key of the output pubkey so that a valid signature can be produced for the output pubkey.

The last form a taproot output key can take is one that has both an internal key and a script tree. The script tree is a set of scripts which are used as the leaves of a merkle tree. Then the hashes of that merkle tree are computed until the merkle root is computed. Computing the output pubkey is almost the same as the previous construction with just the internal key. The only difference is that the tweak is the internal public key concatenated with the merkle root. The rest of the procedure remains the same.

In all of these constructions, there's always a random keypair, whether that is the output key itself, or the internal key. Even when you add the tweak in, the randomness is still preserved. The additional steps of hashing the tweak also help to make the tweak more random.


---

