BIP 341: Taproot: SegWit version 1 spending rules

The five-minute read

One action, walked through

1. A wallet constructs an internal key and an optional script tree.
2. It publishes the tweaked key as the output.
3. To take the key path, it produces a Schnorr signature.
4. To take a script path, it reveals the leaf, the proof, and whatever that leaf's script requires.
5. Nodes apply BIP 341's weight and validation rules. They do not learn the unused leaves.

The argument, unpacked

What has to be true

• Outputs use this witness version. A wrapped older script is not in the anonymity set.
• Key-path keys are aggregated properly when more than one party must sign. That is MuSig2 or FROST, not BIP 341 alone.
• Unused script leaves remain private only if they are not published elsewhere.
• Consensus rules are the BIPs as deployed. Draft text and activated text should not be mixed silently.

What happened after the paper

Taproot activated on Bitcoin and became the assumed output type for new Lightning and for MuSig2 wallets. The BIP is still the right document for what a spend reveals. It is the wrong document for a claim that Bitcoin transactions became private.

What to check before you use the idea

• Was the spend key path or script path?
• What did the revealed leaf contain?
• Are amounts still public? Yes.
• If several parties hold the key, which multi-signature scheme produced it?

Terms

Key path

A spend that is just a signature under the tweaked key, with no script revealed.

Script path

A spend that reveals one committed script leaf and a Merkle proof of its place in the tree.

The problem the paper names

Complex Bitcoin scripts announce themselves. A multisig, a lightning channel and a simple payment should not have to look different when they take the ordinary path. Taproot makes the ordinary path a key spend.

What the design proposes

• A public key tweaked by the Merkle root of a script tree.
• The key path spends with a Schnorr signature and reveals no script.
• The script path reveals only the leaf that was used, plus a proof it sat in the tree.

How the mechanism is specified

• Unspent outputs that share this pattern are indistinguishable from each other on the key path.
• Taking the script path publishes that leaf. The privacy claim is about the path not taken.
• BIP 341 is the spending rule. BIP 340 is the signature. BIP 342 is the script opcode change. They travel together in deployment and they are not the same document.

What this page does not treat as proven

• Amounts, the graph of transactions, and a revealed script are still visible.
• If most users do not use the key path, the anonymity set the BIP hopes for does not arise.
• The BIP does not create covenants, a virtual machine, or a bridge.

Why a venture studio still reads it

A wallet that says Taproot should be able to say whether a given spend was key path or script path. If every spend reveals a custom script, the BIP's privacy argument is not in use.