Taproot Multisig

Slides: https://jimmysong.github.io/taproot-multisig

Overview

  • Review Taproot
  • Traditional Multisig
  • Single-leaf k-of-n Multisig
  • Multi-leaf k-of-k Multisig
  • Multi-leaf k-of-k MuSig
  • Everything Multisig
  • Degrading MultiSig

Taproot Overview

  • Key Path spend requires a Schnorr signature of the point on the Elliptic Curve.
  • Script Path spend requires satisfying a TapScript from a TapRoot tree.
  • A TapRoot tree can have up to $2^{128}$ different TapScripts!

Taproot Structure

  • Tweaked Pubkey
    • PubKey
    • Tweak
      • TapBranch
        • TapLeaf
          • TapScript
        • TapLeaf
          • TapScript
      • TapLeaf
        • TapScript

Traditional Multisig Script

ScriptPubKey
OP_2 PubKey A PubKey B PubKey C OP_3 OP_CHECKMULTISIG
ScriptSig
OP_0 Signature for A Signature for C
Stack
OP_0 Signature for A Signature for C OP_2 PubKey A PubKey B PubKey C OP_3 OP_CHECKMULTISIG

Traditional Multisig Script

Execution
OP_0 Signature for A Signature for C OP_2 PubKey A PubKey B PubKey C OP_3 OP_CHECKMULTISIG
Current OP
Stack

Traditional Multisig Script

Execution
Current OP
OP_CHECKMULTISIG
Stack
3 PubKey C PubKey B PubKey A 2 Signature for C Signature for A 0

Traditional Multisig Script

Execution
Current OP
Stack
1

Traditional Advantages/Disadvantages

  • Non-interactive
  • Signers can be determined as you go
  • All unlocking conditions revealed
  • Public Keys identified
  • Large fees

Single-leaf Multisig TapScript

Taproot Structure

  • Tweaked Pubkey
    • 3-of-3 MuSig
    • 2-of-3 TapScript

k-of-n TapScript

TapScript
PubKey A OP_CHECKSIG PubKey B OP_CHECKSIGADD PubKey C OP_CHECKSIGADD OP_2 OP_NUMEQUAL
Witness
Signature for C '' Signature for A
Execution
Signature for C '' Signature for A PubKey A OP_CHECKSIG PubKey B OP_CHECKSIGADD PubKey C OP_CHECKSIGADD OP_2 OP_NUMEQUAL
Execution
Signature for C '' Signature for A PubKey A OP_CHECKSIG PubKey B OP_CHECKSIGADD PubKey C OP_CHECKSIGADD OP_2 OP_NUMEQUAL
Current OP
Stack

Single-leaf Multisig

Execution
PubKey B OP_CHECKSIGADD PubKey C OP_CHECKSIGADD OP_2 OP_NUMEQUAL
Current OP
OP_CHECKSIG
Stack
PubKey A Signature for A '' Signature for C

Single-leaf Multisig

Execution
PubKey B OP_CHECKSIGADD PubKey C OP_CHECKSIGADD OP_2 OP_NUMEQUAL
Current OP
Stack
1 '' Signature for C

Single-leaf Multisig

Execution
PubKey C OP_CHECKSIGADD OP_2 OP_NUMEQUAL
Current OP
OP_CHECKSIGADD
Stack
PubKey B 1 '' Signature for C

Single-leaf Multisig

Execution
PubKey C OP_CHECKSIGADD OP_2 OP_NUMEQUAL
Current OP
Stack
1 Signature for C

Single-leaf Multisig

Execution
OP_2 OP_NUMEQUAL
Current OP
OP_CHECKSIGADD
Stack
PubKey C 1 Signature for C

Single-leaf Multisig

Execution
OP_2 OP_NUMEQUAL
Current OP
Stack
2

Single-leaf Multisig

Execution
Current OP
OP_NUMEQUAL
Stack
2 2

Single-leaf Multisig

Execution
Current OP
Stack
1

Single-Leaf Advantages/Disadvantages

  • Non-interactive
  • Signers can be determined as you go
  • All unlocking conditions revealed
  • Public Keys Identifiable
  • Large fees

Multi-leaf k-of-k TapScript

Taproot Structure

  • Tweaked Pubkey
    • 3-of-3 MuSig
    • Tweak
      • TapBranch
        • 2-of-2
        • 2-of-2
      • 2-of-2

k-of-k TapScript

TapScript
PubKey A OP_CHECKSIG PubKey C OP_CHECKSIGADD OP_2 OP_NUMEQUAL
Witness
Signature for C Signature for A
Execution
Signature for C Signature for A PubKey A OP_CHECKSIG PubKey C OP_CHECKSIGADD OP_2 OP_NUMEQUAL
Execution
Signature for C Signature for A PubKey A OP_CHECKSIG PubKey C OP_CHECKSIGADD OP_2 OP_NUMEQUAL
Current OP
Stack

Multi-leaf k-of-k Multisig

Execution
PubKey C OP_CHECKSIGADD OP_2 OP_NUMEQUAL
Current OP
OP_CHECKSIG
Stack
PubKey A Signature for A Signature for C

Multi-leaf k-of-k Multisig

Execution
PubKey C OP_CHECKSIGADD OP_2 OP_NUMEQUAL
Current OP
Stack
1 Signature for C

Multi-leaf k-of-k Multisig

Execution
OP_2 OP_NUMEQUAL
Current OP
OP_CHECKSIGADD
Stack
PubKey C 1 Signature for C

Multi-leaf k-of-k Multisig

Execution
OP_2 OP_NUMEQUAL
Current OP
Stack
2

Multi-leaf k-of-k Multisig

Execution
Current OP
OP_NUMEQUAL
Stack
2 2

Multi-leaf k-of-k Multisig

Execution
Current OP
Stack
1

Multi-leaf Advantages/Disadvantages

  • Non-interactive
  • Signers must be determined beforehand
  • Only one unlocking condition revealed
  • Public Keys Identifiable
  • Smaller fees

Multi-leaf Musig TapScript

Taproot Structure

  • Tweaked Pubkey
    • 2-of-2 MuSig
    • Tweak
      • 2-of-2 MuSig
      • 2-of-2 MuSig

Multi-leaf MuSig

TapScript
PubKey A+C OP_CHECKSIG
Witness
Sig for A+C
Execution
Sig for A+C PubKey A+C OP_CHECKSIG

Multi-leaf MuSig

Execution
Sig for A+C PubKey A+C OP_CHECKSIG
Current OP
Stack

Multi-leaf MuSig

Execution
Current OP
OP_CHECKSIG
Stack
PubKey A+C Sig for A+C

Multi-leaf MuSig

Execution
Current OP
Stack
1

Multi-leaf MuSig Advantages/Disadvantages

  • Interactive
  • Signers must be determined beforehand
  • Only one unlocking condition revealed
  • Public Keys not revealed, higher privacy
  • Smallest fees

Multi-leaf Everything

Taproot Structure

  • Tweak
    • TapBranch
      • TapBranch
        • 2-of-2
        • 2-of-2
      • TapBranch
        • 2-of-2
        • MuSig
    • TapBranch
      • TapBranch
        • MuSig
        • MuSig
      • 2-of-3

Everything Advantages/Disadvantages

  • Interactive or Non-interactive
  • Signers can be determined beforehand
  • Reveal whatever conditions you want
  • Public Keys may or may not be identifiable
  • Fees traded off

Degrading Multisig TapScript

Taproot Structure

  • Tweaked PubKey
    • 3-of-3 Musig
    • Tweak
      • TapBranch
        • 2-of-3
        • timelocked 1-of-3

timelocked k-1-of-n TapScript

TapScript
1 yr OP_CSV OP_DROP PubKey A OP_CHECKSIG PubKey B OP_CHECKSIGADD PubKey C OP_CHECKSIGADD OP_1 OP_NUMEQUAL
Witness
'' Signature for B ''
Execution
'' Signature for B '' 1 yr OP_CSV OP_DROP PubKey A OP_CHECKSIG PubKey B OP_CHECKSIGADD PubKey C OP_CHECKSIGADD OP_1 OP_NUMEQUAL
Execution
'' Signature for B '' 1 yr OP_CSV OP_DROP PubKey A OP_CHECKSIG PubKey B OP_CHECKSIGADD PubKey C OP_CHECKSIGADD OP_1 OP_NUMEQUAL
Current OP
Stack

Degrading Multisig

Execution
OP_DROP PubKey A OP_CHECKSIG PubKey B OP_CHECKSIGADD PubKey C OP_CHECKSIGADD OP_1 OP_NUMEQUAL
Current OP
OP_CSV
Stack
1 yr '' Signature for B ''

Degrading Multisig

Execution
PubKey A OP_CHECKSIG PubKey B OP_CHECKSIGADD PubKey C OP_CHECKSIGADD OP_1 OP_NUMEQUAL
Current OP
OP_DROP
Stack
1 yr '' Signature for B ''

Degrading Multisig

Execution
PubKey B OP_CHECKSIGADD PubKey C OP_CHECKSIGADD OP_1 OP_NUMEQUAL
Current OP
OP_CHECKSIG
Stack
PubKey A '' Signature for B ''

Degrading Multisig

Execution
PubKey C OP_CHECKSIGADD OP_1 OP_NUMEQUAL
Current OP
OP_CHECKSIGADD
Stack
PubKey B 0 Signature for B ''

Degrading Multisig

Execution
OP_1 OP_NUMEQUAL
Current OP
OP_CHECKSIGADD
Stack
PubKey C 1 ''

Degrading Multisig

Execution
Current OP
OP_NUMEQUAL
Stack
1 1

Degrading Multisig

Execution
Current OP
Stack
1

Degrading Multisig Advantages/Disadvantages

  • Backup in case of Key Loss
  • Built-in Inheritance/Estate planning
  • Funds have to be moved before timelock

@jimmysong on Twitter, Github, Medium and Substack