diff --git a/bip-xxxx.mediawiki b/bip-xxxx.mediawiki index 2ed45bb1..279e3146 100644 --- a/bip-xxxx.mediawiki +++ b/bip-xxxx.mediawiki @@ -13,6 +13,7 @@ ==Abstract== + This document specifies a unspendable() key expression for output script descriptors. The unspendable() expression takes multiple public keys as input and produces an unspendable public key that can be independently verified by anyone with knowledge of all the constituent public keys. ==Copyright== @@ -21,6 +22,8 @@ This BIP is licensed under the BSD 2-clause license. ==Motivation== +When creating a multi-party Taproot transaction spending only from the script path, it is useful to be able to prove to all cosigners that they keypath is unspendable. Otherwise a malicious participant could use an internal key which they have the private key for and spend the transaction out from the rest of the participants. + This document introduces a mechanism to compute a NUMS (Nothing Up My Sleeve) point for use in the Taproot key path that: * Allows active participants involved in constructing the output script to independently verify the unspendable key. * Prevents passive observers from recognizing that the key path is unspendable. @@ -82,8 +85,15 @@ Less than two derivation paths in a KEY expression: A KEY expression is not an xpub: * tr(unspendable()/0, pk(0260b2003c386519fc9eadf2b5cf124dd8eea4c4e68d5e154050a9346ea98ce600)) +A musig expression with derivation paths is used: +* tr(unspendable()/0, musig(xpub6ERApfZwUNrhLCkDtcHTcxd75RbzS1ed54G1LkBUHQVHQKqhMkhgbmJbZRkrgZw4koxb5JaHWkY4ALHY2grBGRjaDMzQLcgJvLJuZZvRcEL/0/0)/0/0) + ==Rationale== +The restrictions on KEY expressions is necessary to not allow multiple TREE expressions which would all produce the same merkle root to produce different internal keys. +* Using different lengths of derivation paths would allow a descriptor using a child xpub to generate a different key, while the merkle root would be identical. +* Not sorting the public keys would allow sortedmulti expressions to generate different keys depending on the order specified in the descriptor, while the merkle roots would be identical. + This proposal ensures: * Compatibility with existing Taproot functionality by leveraging NUMS points. * Verifiability of unspendable constructions by participants, without exposing this property to outside observers. @@ -93,6 +103,8 @@ This proposal ensures: This is backwards compatible with BIP386 by computing the unspendable key as a BIP380 KEY expression and replacing the unspendable expression as the first argument of the tr() expression. +This is backwards compatible with BIP388, since the public keys are deduplicated. The key information vector will contain all the necessary public keys. + ==Acknowledgements== Thanks to Salvatore Ingala, Pieter Wuille, Antoine Poinsot, Andrew Kozlik and all others who