<p>In <a href="https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki#user-content-Script_validation_rules" rel="nofollow noreferrer">BIP-341</a>, an example NUMS point is given, along with a cautionary note about leaking information:</p>
<blockquote>
<p>One example of such a point is H = lift_x(0x0250929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803ac0) which is constructed by taking the hash of the standard uncompressed encoding of the secp256k1 base point G as X coordinate.</p>
<p>In order to avoid leaking the information that key path spending is not possible it is recommended to pick a fresh integer r in the range 0...n-1 uniformly at random and use H + rG as internal key. It is possible to prove that this internal key does not have a known discrete logarithm with respect to G by revealing r to a verifier who can then reconstruct how the internal key was created.</p>
</blockquote>
<p>For what it's worth, the point as-written is <a href="https://bitcoin.stackexchange.com/questions/92680/what-are-the-der-signature-and-sec-format">encoded in DER format</a>, so in order to get the corresponding integer you have to remove the first byte (<code>0x02</code>).</p>

CC BY-SA 4.0
2023-01-12T14:11:59.713Z
Nit: this is not DER format; DER is only used in Bitcoin for ECDSA signatures. This is a public key is SEC compressed encoding (it's still wrong in the BIP though; lift_x just takes an X coordinate as input).
Pieter Wuille
CC BY-SA 4.0
2023-01-12T10:52:27.613Z
2023-01-12T11:29:50.123Z
2023-01-12T11:29:50.123Z
James O'Beirne
<p>Per <a href="https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki" rel="nofollow noreferrer">BIP-341</a>, if you want to create a Taproot output that is only spendable via the script-path spend (and not a key-path spend), you must &quot;pick as internal key a point with unknown discrete logarithm.&quot;</p>
<p>This requires using a nothing-up-my-sleeve (NUMS) point as your internal public key which has no valid corresponding private key.</p>
<p>How should I go about choosing such a point? Are there canonical examples to draw from?</p>

CC BY-SA 4.0
2023-01-12T10:59:35.723Z
Does this answer your question? [Taproot - Eliminating Key Path](https://bitcoin.stackexchange.com/questions/99722/taproot-eliminating-key-path)
Michael Folkson
CC BY-SA 4.0
2023-01-12T11:00:00.547Z
Regardless, welcome to StackExchange James :)
Michael Folkson
CC BY-SA 4.0
2023-01-12T11:00:50.697Z
Kind of - when I searched "NUMS point" I didn't get anything relevant, so it's probably not indexed for that.
James O'Beirne
CC BY-SA 4.0
2023-01-12T11:03:05.913Z
The way to get round that would be to add a "NUMS point" tag. But I don't think that should be a tag, it is pretty specific. You should be searching for Taproot, secp256k1, script tags and hopefully find it through that. Of course the StackExchange search functionality could be improved but that is kind of out of scope for a particular Q&A
Michael Folkson
CC BY-SA 4.0
2023-01-12T12:17:30.307Z
In my experience, the best way to search on Stack Exchange is to use a regular search engine restricted by “site:bitcoin.stackexchange.com”.
Murch
<script><taproot><secp256k1><p2tr>
How to choose a nothing-up-my-sleeve (NUMS) point on secp256k1 for use in Taproot?
James O'Beirne
# How to choose a nothing-up-my-sleeve (NUMS) point on secp256k1 for use in Taproot?

(Asked by: username_0 on 2023-01-12)

Per [BIP-341](https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki), if you want to create a Taproot output that is only spendable via the script-path spend (and not a key-path spend), you must "pick as internal key a point with unknown discrete logarithm."

This requires using a nothing-up-my-sleeve (NUMS) point as your internal public key which has no valid corresponding private key.

How should I go about choosing such a point? Are there canonical examples to draw from?

**Tags:** script, taproot, secp256k1, p2tr

> **Comments:**
> **username_1**: Does this answer your question? [Taproot - Eliminating Key Path](https://bitcoin.stackexchange.com/questions/99722/taproot-eliminating-key-path)  
> **username_1**: Regardless, welcome to StackExchange username_0 :)  
> **username_0**: Kind of - when I searched "NUMS point" I didn't get anything relevant, so it's probably not indexed for that.  
> **username_1**: The way to get round that would be to add a "NUMS point" tag. But I don't think that should be a tag, it is pretty specific. You should be searching for Taproot, secp256k1, script tags and hopefully find it through that. Of course the StackExchange search functionality could be improved but that is kind of out of scope for a particular Q&A  
> **username_2**: In my experience, the best way to search on Stack Exchange is to use a regular search engine restricted by “site:bitcoin.stackexchange.com”.  

---

## 1 answers

### Answer by username_0 on 2023-01-12. Score: 2

In [BIP-341](https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki#user-content-Script_validation_rules), an example NUMS point is given, along with a cautionary note about leaking information:

> One example of such a point is H = lift\_x(0x0250929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803ac0) which is constructed by taking the hash of the standard uncompressed encoding of the secp256k1 base point G as X coordinate.
>
> In order to avoid leaking the information that key path spending is not possible it is recommended to pick a fresh integer r in the range 0...n-1 uniformly at random and use H + rG as internal key. It is possible to prove that this internal key does not have a known discrete logarithm with respect to G by revealing r to a verifier who can then reconstruct how the internal key was created.

For what it's worth, the point as-written is [encoded in DER format](https://bitcoin.stackexchange.com/questions/92680/what-are-the-der-signature-and-sec-format), so in order to get the corresponding integer you have to remove the first byte (`0x02`).

> **Comments:**
> **username_3**: Nit: this is not DER format; DER is only used in Bitcoin for ECDSA signatures. This is a public key is SEC compressed encoding (it's still wrong in the BIP though; lift_x just takes an X coordinate as input).  

---

