So far we've seen many types of scriptPubKey in the previous modules: P2PKH, P2WPKH, P2SH, P2WSH.

Today we will learn about a new type of scriptPubKey called P2TR.

P2TR has the following format:

• OP_1 means segwit version 1
• <32B tweaked key> is what we are going to spend the next chapters explaining

So far this looks like a simple script, and it can be spent with the private key corresponding to the tweaked key.

But the tweaked key is built in a way that makes it interesting. Let's see how.

Tweaking a public key

The term "tweak" means we start from an original public key and we make a change to it, to get a tweaked public key.

And that's exactly what we are going to do here.

Let's say we have an original public key $P$. Tweaking it means we alter it with a value (we call it the tweak $t$), so that we get a new tweaked public key we call $Q$.

There's a lot going on here, so let's break this equation into two parts: $P$ the original public key, and $t \cdot G$.

Part 1: $P$

$P$ is our original public key. Let's call $d$ its private key.

That's just scalar multiplication, the operation that turns a private key $d$ into a public key $P$. We do this by adding the generator point $G$ to itself $d$ times.

$P$ is also a point on the secp256k1 curve.

We know from the previous lessons that if we have funds locked to a public key $P$, we can use the private key $d$ to sign and spend from it.

Part 2: $t \cdot G$

Now notice the second part of the equation, $t \cdot G$.

Doesn't this also look like a normal point on the secp256k1 curve, with $t$ acting as its private key?

That's exactly what it is. $t \cdot G$ is a point, made by adding $G$ to itself $t$ times.

We are going to call this point $T$, so it's easier to reference.

• $T$ is the tweak point
• $t$ is the tweak value

Putting it back together

So $Q$, the tweaked public key, is just the addition of two points: $P$ the original public key, and $T$ the tweak point.

Adding the two public keys $d \cdot G$ and $t \cdot G$ gives us the point whose private key is the sum $d + t$.

That means if we have funds locked to the tweaked public key $Q$, we can spend them with the tweaked private key $d + t$.

This works because $Q$ is just another point on the curve, made by an addition.

The P2TR output

Remember the scriptPubKey we saw at the beginning:

That <32B tweaked key> is the $Q$ we just computed.

Right now the tweak $t$ is just some value. In the next lessons we will see what happens when we make $t$ commit to something. That is where taproot gets interesting.

Signing with a tweaked keypair

We said that funds locked in $Q$ can be spent with the tweaked private key $x + t$. Let's prove it in code.

Fill in the two tweaked values, then press Run.

The verifier only ever sees $Q$. It has no idea the key was built by adding a tweak. In the next lessons we make that tweak carry data, which is where taproot gets powerful.