claude-dev-suite Taproot (BIP340 / 341 / 342)
Quick refs: tweak.md, control-block.md, sighash-default.md, taptree.md
Activated November 2021 (block 709,632). Three BIPs:
- BIP340 — Schnorr signatures over secp256k1.
- BIP341 — Taproot output: P2TR scriptPubKey, key-path / script-path spending, taptweak.
- BIP342 — Tapscript: rules for script-path spends. See scripts/quick-ref/tapscript.md.
Output construction
P = internal_pubkey (x-only, 32 bytes)
TaptreeRoot R = merkle root of script tree (or empty)
t = TaggedHash("TapTweak", P || R)
Q = lift_x(P) + t*G (the "tweaked" pubkey, x-only)
scriptPubKey = OP_1 <Q>
If you have only a key-path (no scripts), R = "" and the tweak still
prevents key reuse leaking the internal key.
Key-path spend
witness = [<schnorr_sig>] # 64 bytes (SIGHASH_DEFAULT) or 65 bytes
Privacy-equivalent to single-sig. The most efficient Taproot spend. Outsiders cannot tell whether a script-path even exists — every Taproot output looks like a single-key output.
Script-path spend
witness = [<args0>, <args1>, ..., <leaf script>, <control block>]
- Args 0..N: stack inputs to the leaf.
- Leaf script: the Tapscript bytes being executed.
- Control block (33 + 32×depth bytes):
- byte 0:
0xc0 | (parity_of_Q). The leaf version. - bytes 1..33: internal pubkey P.
- bytes 33..end: merkle path (32 bytes per level).
- byte 0:
Validator reconstructs taproot_root from leaf hash + path, computes
expected Q = P + tweak*G, compares to Q in scriptPubKey. If match,
runs the leaf script per BIP342.
x-only pubkeys
- All Schnorr keys in BIP340 are encoded as 32-byte x-coordinate only (no parity byte).
- The "even Y" convention: parity is fixed to even by negating the private key when needed.
- For tweaked output keys (
Q), parity bit lives in the control block byte 0 LSB.
Sighash (BIP341)
SIGHASH_DEFAULT = 0x00 is the new default and equivalent to ALL but
with the new digest. Differences from BIP143:
- Hashes commit to all spent prevout amounts and scriptPubKeys (not just the current input).
- For SINGLE: commit only to single output, but with cleaner digest.
- Annex (last witness element prefixed
0x50) is committed.
64-byte sig if SIGHASH_DEFAULT, else 65 bytes (1-byte sighash suffix).
Sigops budget
Tapscript replaces "fixed sigops cost" with a budget:
budget = floor(witness_weight / 50). Each CHECKSIG/CHECKSIGADD
consumes 50 from the budget. Allows long script paths to validate
proportionally to their bytes.
Why Taproot
- Privacy: spending paths reveal only the path used. Cooperative spends (key-path) look identical to plain single-sig.
- Aggregation: Schnorr's linearity → MuSig2 key aggregation off-chain. n parties can produce one signature for one pubkey.
- Smaller witnesses for cooperative cases.
- Soft-fork upgrade space: leaf versions, OP_SUCCESS opcodes, annex.