To address efficiency, privacy, and flexibility issues within the Bitcoin network, the Bitcoin development community implemented the Taproot upgrade at the end of 2021. The core components of this upgrade include Schnorr signatures and MAST (Merkelized Abstract Syntax Tree).
Schnorr's key aggregation feature allows participants in a single multi-signature transaction to collaboratively combine their public keys and generate an aggregate signature that is valid for the sum of their public keys. This saves block space, enhances privacy, and enables faster transaction verification. MAST improves the privacy and efficiency of Bitcoin scripts by breaking down complex Bitcoin scripts into smaller sub-scripts and utilizing the Merkle tree structure.
To fully understand how Taproot operates, this article explains the Taproot transaction process from two main aspects: the creation of the Taproot public key and the spending patterns of Taproot.
To create a Taproot public key, we first need to understand the process of generating an aggregated public key and aggregated signature. The most notable related research includes MuSig1 and MuSig2. Compared to MuSig2's two-round communication mechanism, MuSig1's major drawback is that it requires three rounds of communication to create a signature, with each round consisting of back-and-forth message exchanges. Since this article does not involve inter-network communication, we will focus on the basic generation process of aggregated public keys and signatures.
The generation process of the aggregated public key can be divided into three steps:
The generation process of the aggregated signature requires three rounds of communication and can be divided into two main steps:
As shown in the diagram, the Taproot public key primarily consists of two parts: the aggregated public key `P` and the public key `tG` formed by the MAST structure. Assuming `P` is the aggregated public key of Alice, Bob, and Charlie, and `script_A`, `script_B`, and `script_C` are the scripts related to Alice, Bob, and Charlie respectively, the Taproot public key creation process is as follows:
2.The public keys are aggregated into `pubkey_agg`, and the private keys are adjusted for future signatures.
3. Create scripts `script_A`, `script_B`, and `script_C`.
4. Construct the MAST, and calculate the private key `taptweak` corresponding to the MAST structure. In the diagram, `TaggedHash` represents a tagged hash with a fixed length of 32 bytes, calculated as `TaggedHash(tag, x) = sha256(sha256(tag) + sha256(tag) + x)`. `ver` represents the Tapscript version number, currently set to `0xc0`, and `size` represents the byte size of the script. `A&B` represents the concatenation of `A` and `B` in dictionary order.
5. Combine `Q=P+tG` to form the Taproot public key and generate a `segwit_address` for the transaction.
6. Transfer 50 BTC to the Taproot address.
To transfer 0.5 BTC from the Taproot address to Bob, there are two payment methods: one involves Alice, Bob, and Charlie all signing to form an aggregated signature, completing the transfer to Bob; the other involves using the script in the MAST structure to transfer to Bob.
5. Test the legality of the transaction created by the second method and send the transaction.
Overall, Taproot transactions focus on one type of output and two spending patterns. One type of output ensures that the public key in the locking script is consistent, whether for individual transactions or multi-signature transactions, making it indistinguishable in form. The two spending patterns enable transaction participants to achieve more complex transactions and a wider variety of application scenarios with fewer bytes.
Recognizing the technical characteristics of the Taproot mechanism, the Bitcoin Layer 2 solution BEVM has adopted it as one of the core architectures of the "Taproot Consensus" technology. By combining Schnorr signatures and MAST, BEVM can provide a more efficient and flexible smart contract execution environment while ensuring security, pushing the entire Bitcoin ecosystem towards a more secure and efficient future.