Secure Commitment

Let's examine the cause of our insecure commitment first.

We have:

Q=P+t⋅GQ = P + t \cdot G

The root cause is that nothing ties tt to PP.

Alice can pick any contract she wants, and then compute a P′P' that makes it fit the same QQ.

Let's fix that.

The fix

One small change: put PP inside the hash.

t = hash(P || contract)Q = P + t·G

Now let's take the same scenario, where Alice wants to swap the contract.

She needs a new key P′P' and a new tweak:

t′=hash(P′ ∣∣ contract′)t' = \text{hash}(P' \, || \, \text{contract}')

For her forgery to work she needs the same QQ, so she needs:

P+t⋅G=P′+t′⋅GP + t \cdot G = P' + t' \cdot G

She knows PP, tt, and the fake contract'. The only thing missing is P′P'. So let's solve for it:

P′=P+t⋅G−t′⋅GP' = P + t \cdot G - t' \cdot G

P′=P+hash(P ∣∣ contract)⋅G−hash(P′ ∣∣ contract′)⋅GP' = P + \text{hash}(P \, || \, \text{contract}) \cdot G - \text{hash}(P' \, || \, \text{contract}') \cdot G

Look at the last line.

P′P' appears on both sides of the equation.

To compute P′P' she first needs t′t'. But t′t' is a hash of P′P'. So she needs P′P' before she can get P′P'.

Alice can't pick t′t' and solve for P′P'.

Her only other option is to guess: try random P′P' values until one happens to work. That means breaking the hash function.

The commitment is now binding.

This is what taproot really does

This is exactly the shape taproot uses. The real tweak is

t = tagged_hash("TapTweak", P || merkle_root)

Suggest Edits
Next
Exercises