<p>As per my understanding what you are proposing can be achieved with Schnorr signatures, which will be implemented with Taproot. Since Schnorr signatures permit key aggregation, you can construct a single public key (threshold public key) from multiple participant public keys, which in your case is N + initiator. When spending you can just combine the signature from all the parties together (threshold signature) and spend it. The threshold public key and threshold signature are indistinguishable from their single-party equivalents. So for an outsider, it might be as though a single person signed it.</p>

<p>MAST is used to reveal only one spending condition while hiding others. For example, say you have a transactio which states that for first 100 days, you require N and initiator. From 100 to 200 days you require M of N and the initiator and after 200 days you only need the initiator. Currently when spending such transaction you need to reveal the entire spending script. With MAST you can consider each spending condition as a branch of the Merkle tree. When spending that output you just need to reveal the branch that you are spending thus allowing you to conceal the other branches from the public.</p>

CC BY-SA 4.0
2019-09-17T11:08:22.103Z
2019-09-17T11:08:22.103Z
Ugam Kamat
<p>Taproot allows to hide a script behind a transaction and only release the relevant information when the output is being spent. Would this allow for a construction of a script with N participants + initiator to generate a script where all N participants have to sign it and the initiator finally signs? Would the MAST reveal all other signers or just the initiator who finally signs the script and can proof that he followed its rules?</p>

CC BY-SA 4.0
2019-09-17T15:54:17.673Z
The question is a bit confusing. CoinJoin refers to having a transaction *with multiple inputs* where each input comes from a different participant. The rest of your question seems to be about a single input that multiple parties need to sign for. Which of the two is it? (in case of the first the answer is no, in case of the second the answer is yes with some caveats).
Pieter Wuille
CC BY-SA 4.0
2019-09-18T15:28:04.000Z
@PieterWuille Thanks for your answer! It's kind of both, is it possible to collaborate for N participants to create a decentralised, trustless mixing of coins to increase privacy?
janowitz
CC BY-SA 4.0
2019-09-18T17:05:35.053Z
Possibly, but that's completely unrelated to Taproot/MAST, as those are things *inside* an individual output (and inputs that spend them), not across inputs.
Pieter Wuille
CC BY-SA 4.0
2019-09-18T18:59:13.613Z
Thank you for clarification, @PieterWuille! I will have to look deeper into Schnorr & Taproot, but there is not much understandable literature out there yet...
janowitz
<privacy><taproot>
Does Taproot allow CoinJoin-style transactions without revealing all signers?
janowitz
# Does Taproot allow CoinJoin-style transactions without revealing all signers?

(Asked by: username_0 on 2019-09-17)

Taproot allows to hide a script behind a transaction and only release the relevant information when the output is being spent. Would this allow for a construction of a script with N participants + initiator to generate a script where all N participants have to sign it and the initiator finally signs? Would the MAST reveal all other signers or just the initiator who finally signs the script and can proof that he followed its rules?

**Tags:** privacy, taproot

> **Comments:**
> **username_1**: The question is a bit confusing. CoinJoin refers to having a transaction *with multiple inputs* where each input comes from a different participant. The rest of your question seems to be about a single input that multiple parties need to sign for. Which of the two is it? (in case of the first the answer is no, in case of the second the answer is yes with some caveats).  
> **username_0**: @username_1 Thanks for your answer! It's kind of both, is it possible to collaborate for N participants to create a decentralised, trustless mixing of coins to increase privacy?  
> **username_1**: Possibly, but that's completely unrelated to Taproot/MAST, as those are things *inside* an individual output (and inputs that spend them), not across inputs.  
> **username_0**: Thank you for clarification, @username_1! I will have to look deeper into Schnorr & Taproot, but there is not much understandable literature out there yet...  

---

## 1 answers

### Answer by username_2 on 2019-09-17. Score: 2

As per my understanding what you are proposing can be achieved with Schnorr signatures, which will be implemented with Taproot. Since Schnorr signatures permit key aggregation, you can construct a single public key (threshold public key) from multiple participant public keys, which in your case is N + initiator. When spending you can just combine the signature from all the parties together (threshold signature) and spend it. The threshold public key and threshold signature are indistinguishable from their single-party equivalents. So for an outsider, it might be as though a single person signed it.

MAST is used to reveal only one spending condition while hiding others. For example, say you have a transactio which states that for first 100 days, you require N and initiator. From 100 to 200 days you require M of N and the initiator and after 200 days you only need the initiator. Currently when spending such transaction you need to reveal the entire spending script. With MAST you can consider each spending condition as a branch of the Merkle tree. When spending that output you just need to reveal the branch that you are spending thus allowing you to conceal the other branches from the public.


---

