chapter3-taproot/p2tr-key-and-script-path.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# P2TR Key Path and Script Path\n",
    "\n",
    "- The following material adapted from the Bitcoin Optech [Schnorr Taproot workshop](https://bitcoinops.org/en/schorr-taproot-workshop/).\n",
    "\n",
    "In this section we'll create a P2TR output that commits to a taptree, then explore how we'd spend from it using the key path and script path.\n",
    "\n",
    "## Prerequisite knowledge\n",
    "- For all notebooks:\n",
    "    - A high level understanding of the bitcoin. e.g. [Mastering Bitcoin](https://github.com/bitcoinbook/bitcoinbook) by Andreas Antonopoulos UTXO model, in particular [Chapter 6](https://github.com/bitcoinbook/bitcoinbook/blob/develop/ch06.asciidoc).\n",
    "    - A conceptual understanding of [hash functions](https://www.thesslstore.com/blog/what-is-a-hash-function-in-cryptography-a-beginners-guide).\n",
    "    - [Hexadecimal notation](https://inst.eecs.berkeley.edu/~cs61bl/r//cur/bits/decimal-binary-hex.html?topic=lab28.topic&step=2&course=) and [endianness](https://www.freecodecamp.org/news/what-is-endianness-big-endian-vs-little-endian/).\n",
    "\n",
    "\n",
    "- Specific to this notebook:\n",
    "    - SHA256, HASH256, HASH160 - '[Hash Functions chapter](https://github.com/DariusParvin/bitcoin-tx-tutorial/blob/main/appendix/hash-functions.ipynb)'\n",
    "    - Base58 addresses - '[Addresses chapter](https://github.com/DariusParvin/bitcoin-tx-tutorial/blob/main/appendix/addresses.ipynb)'\n",
    "    - Bitcoin Script basics - '[Bitcoin Script chapter](https://github.com/DariusParvin/bitcoin-tx-tutorial/blob/main/appendix/bitcoin-script.ipynb)'\n",
    "    - TestShell setup - '[P2PKH chapter](https://github.com/DariusParvin/bitcoin-tx-tutorial/blob/main/chapter1-legacy/p2pkh.ipynb)'\n",
    "- Specific for taproot:\n",
    "    - [Elliptic Curve Math Review](https://github.com/DariusParvin/bitcoin-tx-tutorial/blob/main/appendix/elliptic-curve-math-review.ipynb)\n",
    "    - [Schnorr signatures and TapTweaks](https://github.com/DariusParvin/bitcoin-tx-tutorial/blob/main/chapter3-taproot/schnorr-sig-and-taptweak.ipynb)\n",
    "    - [TapTrees](https://github.com/DariusParvin/bitcoin-tx-tutorial/blob/main/chapter3-taproot/taproot-taptree.ipynb)\n",
    "    - [Signature hash evolution](https://github.com/DariusParvin/bitcoin-tx-tutorial/blob/main/appendix/sighash_evolution.ipynb)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Setup \n",
    "\n",
    "### Requirements\n",
    "For this exercise we'll need Bitcoin Core. This notebook has been tested with [v24.0.1](https://github.com/bitcoin/bitcoin/releases/tag/v24.0.1).\n",
    "\n",
    "Below, set the paths for:\n",
    "1. The bitcoin core functional test framework directory.\n",
    "2. The directory containing bitcoin-tx-tutorial.\n",
    "\n",
    "**You'll need to edit these next two lines for your local setup.**"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {},
   "outputs": [],
   "source": [
    "path_to_bitcoin_functional_test = \"/Users/dariuscognac/bitcoin/test/functional\"\n",
    "path_to_bitcoin_tx_tutorial = \"/Users/dariuscognac/Documents/Github/bitcoin-tx-tutorial\"\n",
    "\n",
    "import sys\n",
    "\n",
    "# Add the functional test framework to our PATH\n",
    "sys.path.insert(0, path_to_bitcoin_functional_test)\n",
    "from test_framework.test_shell import TestShell\n",
    "\n",
    "# Add the bitcoin-tx-tutorial functions to our PATH\n",
    "sys.path.insert(0, path_to_bitcoin_tx_tutorial)\n",
    "from functions import *\n",
    "from functions.bip_0340_reference import *\n",
    "\n",
    "import json"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Scenario\n",
    "\n",
    "Patricia is a mother of three kids, Adam, Ben, Carla, all in their 20s attending college. She's planning to go backpacking in the countryside where she won't have access to the internet. She decides she wants to put away some funds that her kids could use in an emergency if any of them ever needed money while she was away. She's happy to let any of the kids spend the funds under any condition. Ideally she wants her transaction to be as private as possible.\n",
    "\n",
    "Q: What options does she have?\n",
    "\n",
    "She could simply give all three of her kids the private key to a utxo/wallet, but she knows it's not the best security practice to distribute secret information like that. She also wants it to be provable who spent the in the case it does get spent. Before taproot, she probably would have been best off creating a P2WSH transaction where the script allowed any of the children's private keys to spend the output. Now that taproot transactions are supported, she can create an address that commits to a taptree, where each leaf of the taptree commits to each of the children's public keys.\n",
    "\n",
    "Compared to P2WSH, this transaction will be more private. Patricia can retain the ability to spend the funds using the internal public key and never reveal that it committed to a script. Alternatively, if one of the children spends the output, only their public key gets revealed. "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Part 1: Constructing a P2TR output that commits to a taptree\n",
    "\n",
    "In order to create this output, we'll need to perform the following steps. For more on taptrees see the chapter on\n",
    "[TapTrees](https://github.com/DariusParvin/bitcoin-tx-tutorial/blob/main/taproot_taptree.ipynb):\n",
    "1. Compute TapLeaves A, B and C (for Adam, Ben, Carla).\n",
    "2. Compute Internal TapBranch AB.\n",
    "3. Compute TapTweak\n",
    "4. Derive the bech32m address."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "TapTweak: 8e53fc0da2e9e8e27404703010ae519e85576ef6c73dde1b2bffac7f17b114a9\n",
      "Bech32m address: bcrt1p5jhcyymfj7tkgv0jca4pz7tx9uzvznu0mlfymey6ph63f9h8x0gs7683vc\n"
     ]
    }
   ],
   "source": [
    "TAPSCRIPT_VER = bytes([0xc0])\n",
    "internal_privkey = bytes.fromhex(\"83a5f1039118fbb4276cac2db41d236c1c1790d97d955c228fa3bde439fbec2a\")\n",
    "internal_pubkey = tr.pubkey_gen(internal_privkey)\n",
    "\n",
    "# Derive pay-to-pubkey scripts\n",
    "privkeyA = bytes.fromhex(\"1059bf26660804ced9a3286a16497d7e70692d14dc04e1220c2dbef3667b74f7\")\n",
    "pubkeyA = tr.pubkey_gen(privkeyA)\n",
    "privkeyB = bytes.fromhex(\"2b22bf11ab862a35f16301c0afc7afe60f66d31fc29645f79c2ab43655e65d33\")\n",
    "pubkeyB = tr.pubkey_gen(privkeyB)\n",
    "privkeyC = bytes.fromhex(\"7f8b28e51da049bf63e31d3a3261579c0f5c1fc8058c65a79482814e5061f9f6\")\n",
    "pubkeyC = tr.pubkey_gen(privkeyC)\n",
    "\n",
    "# Pay to pubkey scripts\n",
    "scriptA = b\"\\x20\" + pubkeyA + b\"\\xac\"\n",
    "scriptB = b\"\\x20\" + pubkeyB + b\"\\xac\"\n",
    "scriptC = b\"\\x20\" + pubkeyC + b\"\\xac\"\n",
    "\n",
    "# Method: Returns tapbranch hash. Child hashes are lexographically sorted and then concatenated.\n",
    "# l: tagged hash of left child\n",
    "# r: tagged hash of right child\n",
    "def tapbranch_hash(l, r):\n",
    "    return tagged_hash(\"TapBranch\", b''.join(sorted([l,r])))\n",
    "\n",
    "# 1) Compute TapLeaves A, B and C.\n",
    "# Method: pushbytes(data) is a function which adds compactsize to input data.\n",
    "hash_inputA =  TAPSCRIPT_VER + pushbytes(scriptA)\n",
    "hash_inputB =  TAPSCRIPT_VER + pushbytes(scriptB)\n",
    "hash_inputC =  TAPSCRIPT_VER + pushbytes(scriptC)\n",
    "taggedhash_leafA =  tagged_hash(\"TapLeaf\", hash_inputA)\n",
    "taggedhash_leafB =  tagged_hash(\"TapLeaf\", hash_inputB)\n",
    "taggedhash_leafC =  tagged_hash(\"TapLeaf\", hash_inputC)\n",
    "\n",
    "# 2) Compute Internal node TapBranch AB.\n",
    "# Method: use tapbranch_hash() function\n",
    "internal_nodeAB = tapbranch_hash(taggedhash_leafA, taggedhash_leafB)\n",
    "\n",
    "# 3) Compute TapTweak.\n",
    "rootABC =  tapbranch_hash(internal_nodeAB, taggedhash_leafC)\n",
    "taptweak =  tagged_hash(\"TapTweak\", internal_pubkey + rootABC)\n",
    "\n",
    "# 4) Derive the bech32m address.\n",
    "negated, taproot_pubkey = taproot_tweak_pubkey(internal_pubkey, rootABC)\n",
    "print(\"TapTweak:\", taptweak.hex())\n",
    "spk = bytes.fromhex(\"5120\") + taproot_pubkey\n",
    "bech32m_address = spk_to_bech32(spk, 'regtest')\n",
    "print('Bech32m address:', bech32m_address)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Now we are ready to set up the bitcoin `TestShell` and fund this address. For more on these steps you can view the [function definitions](https://github.com/DariusParvin/bitcoin-tx-tutorial/blob/main/functions/setup_testshell.py) or look at the first [P2PKH notebook](https://github.com/DariusParvin/bitcoin-tx-tutorial/blob/main/chapter1-legacy/p2pkh.ipynb) example."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "2023-01-01T09:42:22.576000Z TestFramework (INFO): Initializing test directory /var/folders/r5/yk8yg2xs1gs8xzkn5l8vr72w0000gn/T/bitcoin_func_test_a30mhq8s\n",
      "txid: 5e61d25df2ca61d6be58b98a434e3ddd7d70dabd5a0c38bff8c97df40c02420f, 1\n"
     ]
    }
   ],
   "source": [
    "node = setup_testshell()\n",
    "txid_to_spend, index_to_spend = fund_address(node, bech32m_address, 2.001)\n",
    "print(f\"txid: {txid_to_spend}, {index_to_spend}\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Part 2: Spending along the Key Path\n",
    "\n",
    "### Scenario\n",
    "Patricia comes back from her backpacking trip and thankfully none of her children needed to use the emergency funds she allocated for them. She decides to move majority of the funds (1.5 btc) into her cold wallet, and the rest (0.5 btc) to her hot wallet using the internal public key via a key path spend.\n",
    "\n",
    "The first step she'll need to do is derive the tweaked internal private key. For more on this, review the section on [Schnorr signatures and TapTweaks](https://github.com/DariusParvin/bitcoin-tx-tutorial/blob/main/schnorr_sig_and_taptweak.ipynb)."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [],
   "source": [
    "taproot_privkey = taproot_tweak_seckey(internal_privkey, rootABC)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Next, she'll need to construct the unsigned transaction to "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/plain": [
       "'0014531260aa2a199e228c537dfa42c82bea2c7c1f4d'"
      ]
     },
     "execution_count": 5,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "# Set the output scriptPubkeys and amounts\n",
    "output1_value_sat = int(float(\"1.5\") * 100000000)\n",
    "output1_spk = bytes.fromhex(\"0014fc7250a211deddc70ee5a2738de5f07817351cef\")\n",
    "output2_value_sat = int(float(\"0.5\") * 100000000)\n",
    "output2_spk = bytes.fromhex(\"0014531260aa2a199e228c537dfa42c82bea2c7c1f4d\")\n",
    "output2_spk.hex()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "unsigned_tx:  02000000010f42020cf47dc9f8bf380c5abdda707ddd3d4e438ab958bed661caf25dd2615e0100000000ffffffff0280d1f00800000000160014fc7250a211deddc70ee5a2738de5f07817351cef80f0fa0200000000160014531260aa2a199e228c537dfa42c82bea2c7c1f4d00000000\n"
     ]
    }
   ],
   "source": [
    "# VERSION\n",
    "# version '2' indicates that we may use relative timelocks (BIP68)\n",
    "version = bytes.fromhex(\"0200 0000\")\n",
    "\n",
    "# MARKER (new to segwit)\n",
    "marker = bytes.fromhex(\"00\")\n",
    "\n",
    "# FLAG (new to segwit)\n",
    "flag = bytes.fromhex(\"01\")\n",
    "\n",
    "# INPUTS\n",
    "# We have just 1 input\n",
    "input_count = bytes.fromhex(\"01\")\n",
    "\n",
    "# Convert txid and index to bytes (little endian)\n",
    "txid = (bytes.fromhex(txid_to_spend))[::-1]\n",
    "index = index_to_spend.to_bytes(4, byteorder=\"little\", signed=False)\n",
    "\n",
    "# For the unsigned transaction we use an empty scriptSig\n",
    "scriptsig = bytes.fromhex(\"\")\n",
    "\n",
    "# use 0xffffffff unless you are using OP_CHECKSEQUENCEVERIFY, locktime, or rbf\n",
    "sequence = bytes.fromhex(\"ffff ffff\")\n",
    "\n",
    "inputs = (\n",
    "    txid\n",
    "    + index\n",
    "    + varint_len(scriptsig)\n",
    "    + scriptsig\n",
    "    + sequence\n",
    ")\n",
    "\n",
    "# OUTPUTS\n",
    "# 0x02 for out two outputs\n",
    "output_count = bytes.fromhex(\"02\")\n",
    "\n",
    "# OUTPUT 1 \n",
    "output1_value = output1_value_sat.to_bytes(8, byteorder=\"little\", signed=True)\n",
    "# 'output1_spk' already defined at the start of the script\n",
    "\n",
    "# OUTPUT 2\n",
    "output2_value = output2_value_sat.to_bytes(8, byteorder=\"little\", signed=True)\n",
    "# 'output2_spk' already defined at the start of the script\n",
    "\n",
    "outputs = (\n",
    "    output1_value\n",
    "    + varint_len(output1_spk)\n",
    "    + output1_spk\n",
    "    + output2_value\n",
    "    + varint_len(output2_spk)\n",
    "    + output2_spk\n",
    ")\n",
    "\n",
    "# LOCKTIME\n",
    "locktime = bytes.fromhex(\"0000 0000\")\n",
    "\n",
    "unsigned_tx = (\n",
    "    version\n",
    "    + input_count\n",
    "    + inputs\n",
    "    + output_count\n",
    "    + outputs\n",
    "    + locktime\n",
    ")\n",
    "print(\"unsigned_tx: \", unsigned_tx.hex())"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Now she's ready to compute the sighash and sign it with a schnorr signature using her tweaked internal key. For more on this section see [Signature hash evolution](https://github.com/DariusParvin/bitcoin-tx-tutorial/blob/main/sighash_evolution.ipynb)."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [],
   "source": [
    "sighash_epoch = bytes.fromhex(\"00\")\n",
    "index_of_this_input = bytes.fromhex(\"0000 0000\")\n",
    "\n",
    "# Control\n",
    "hash_type = bytes.fromhex(\"00\") # SIGHASH_DEFAULT (a new sighash type meaning implied SIGHASH_ALL)\n",
    "\n",
    "# Transaction data\n",
    "sha_prevouts = sha256(txid + index)\n",
    "\n",
    "input_amount_sat = int(2.001 * 100_000_000)\n",
    "input_amounts = input_amount_sat.to_bytes(8, byteorder=\"little\", signed=False)\n",
    "sha_amounts = sha256(input_amounts)\n",
    "\n",
    "sha_scriptpubkeys = sha256(\n",
    "    varint_len(spk)\n",
    "    + spk\n",
    ")\n",
    "\n",
    "sha_sequences = sha256(sequence)\n",
    "\n",
    "sha_outputs = sha256(outputs) ######\n",
    "\n",
    "# Data about this input\n",
    "spend_type = bytes.fromhex(\"00\") # no annex present\n",
    "\n",
    "sig_msg = (\n",
    "    sighash_epoch\n",
    "    + hash_type\n",
    "    + version\n",
    "    + locktime\n",
    "    + sha_prevouts\n",
    "    + sha_amounts\n",
    "    + sha_scriptpubkeys\n",
    "    + sha_sequences\n",
    "    + sha_outputs\n",
    "    + spend_type\n",
    "    + index_of_this_input\n",
    ")\n",
    "\n",
    "tag_hash = sha256(\"TapSighash\".encode())\n",
    "sighash = sha256(tag_hash + tag_hash + sig_msg)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Now with the sighash she can sign it with her tweaked internal key. For more on schnorr signatures see [Schnorr signatures and TapTweaks](https://github.com/DariusParvin/bitcoin-tx-tutorial/blob/main/schnorr_sig_and_taptweak.ipynb)."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Sign the transaction\n",
    "aux_rand = bytes.fromhex(\"0000000000000000000000000000000000000000000000000000000000000000\")\n",
    "signature = tr.schnorr_sign(sighash, taproot_privkey, aux_rand)\n",
    "# Sighash flag is not appended for SIGHASH_DEFAULT"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Finally the last step is to add the signature to the witness field and she has the signed transaction!"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "0140ae7803efebf0bd7bfdf5a3d7cdd18a77190d08288a72f6bc28261be426cfd7b65055f6f324e0cc7b3e62c03ad4eaf301cc7851bde78031f759e1abaec9921764\n",
      "signed transaction:  020000000001010f42020cf47dc9f8bf380c5abdda707ddd3d4e438ab958bed661caf25dd2615e0100000000ffffffff0280d1f00800000000160014fc7250a211deddc70ee5a2738de5f07817351cef80f0fa0200000000160014531260aa2a199e228c537dfa42c82bea2c7c1f4d0140ae7803efebf0bd7bfdf5a3d7cdd18a77190d08288a72f6bc28261be426cfd7b65055f6f324e0cc7b3e62c03ad4eaf301cc7851bde78031f759e1abaec992176400000000\n"
     ]
    }
   ],
   "source": [
    "witness = (\n",
    "    bytes.fromhex(\"01\") # one stack item in the witness\n",
    "    + varint_len(signature)\n",
    "    + signature\n",
    ")\n",
    "print(witness.hex())\n",
    "\n",
    "# the final signed transaction\n",
    "signed_tx = (\n",
    "    version\n",
    "    + marker\n",
    "    + flag\n",
    "    + input_count\n",
    "    + inputs\n",
    "    + output_count\n",
    "    + outputs\n",
    "    + witness\n",
    "    + locktime\n",
    ")\n",
    "\n",
    "print(\"signed transaction: \",signed_tx.hex())"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[{'txid': '92a4387f65646140ccb75a611874d58defb94a3a7bb46b0ba4d59ef87e29aec9', 'wtxid': 'bdeeda66b862d30a3dffecc9fad27c46490bc677b96e550c265ff7e1101830ef', 'allowed': True, 'vsize': 130, 'fees': {'base': Decimal('0.00100000')}}]\n"
     ]
    }
   ],
   "source": [
    "result = node.testmempoolaccept(rawtxs=[signed_tx.hex()])\n",
    "print(result)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Note that unlike P2SH or P2WSH, the taptree is never revealed."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Part 3: Spending along the Script Path\n",
    "\n",
    "### Scenario\n",
    "While Patricia is out of town, Adam has an emergency medical expense and needs to use some of the bitcoin Patricia set aside for them. He decides to spend the UTXO to fund his hospital bill costing 1.5 btc.\n",
    "\n",
    "For convenience we'll reuse the same outputs as in part 2. Note that since Adam is spending via script path, he'll need to set the `spend_type` to `02`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {},
   "outputs": [],
   "source": [
    "spend_type = bytes.fromhex(\"02\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "The rest of the sighash is very similar to the key path spend, however we also need to append the _common signature message extension_ defined in [BIP 342](https://github.com/bitcoin/bips/blob/master/bip-0342.mediawiki#common-signature-message-extension). Pieter Wuille describes the purpose of these fields in a stack exchange answer [here](https://bitcoin.stackexchange.com/questions/115695/what-are-the-last-bytes-for-in-a-taproot-script-path-sighash/115699#115699)."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "e9877ad0b9a7a935c5c8e9cb819afa130f26036e5623388c895cb45b55c3e7f6\n"
     ]
    }
   ],
   "source": [
    "sighash_epoch = bytes.fromhex(\"00\")\n",
    "index_of_this_input = bytes.fromhex(\"0000 0000\")\n",
    "\n",
    "# Control\n",
    "hash_type = bytes.fromhex(\"00\") # SIGHASH_DEFAULT (a new sighash type meaning implied SIGHASH_ALL)\n",
    "\n",
    "# Transaction data\n",
    "sha_prevouts = sha256(txid + index)\n",
    "\n",
    "input_amount_sat = int(2.001 * 100_000_000)\n",
    "input_amounts = input_amount_sat.to_bytes(8, byteorder=\"little\", signed=False)\n",
    "sha_amounts = sha256(input_amounts)\n",
    "sha_scriptpubkeys = sha256(\n",
    "    varint_len(spk)\n",
    "    + spk\n",
    ")\n",
    "sha_sequences = sha256(sequence)\n",
    "sha_outputs = sha256(outputs)\n",
    "\n",
    "# these next three variables make up the 'common signature message extension'\n",
    "tapleaf_hash = tagged_hash(\"TapLeaf\", TAPSCRIPT_VER + pushbytes(scriptA))\n",
    "key_version = bytes.fromhex(\"00\")\n",
    "code_separator_pos = bytes.fromhex(\"ffffffff\")\n",
    "\n",
    "sig_msg = (\n",
    "    sighash_epoch\n",
    "    + hash_type\n",
    "    + version\n",
    "    + locktime\n",
    "    + sha_prevouts\n",
    "    + sha_amounts\n",
    "    + sha_scriptpubkeys\n",
    "    + sha_sequences\n",
    "    + sha_outputs\n",
    "    + spend_type # spend_type = 0x02 for script path\n",
    "    + index_of_this_input\n",
    "    # 'common signature message extension' for script path\n",
    "    + tapleaf_hash\n",
    "    + key_version\n",
    "    + code_separator_pos\n",
    ")\n",
    "\n",
    "tag_hash = sha256(\"TapSighash\".encode())\n",
    "sighash = sha256(tag_hash + tag_hash + sig_msg)\n",
    "print(sighash.hex())"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Now Adam is ready to sign it with his private key (`privkeyA`)."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {},
   "outputs": [],
   "source": [
    "aux_rand = bytes.fromhex(\"0000000000000000000000000000000000000000000000000000000000000000\")\n",
    "signatureA = tr.schnorr_sign(sighash, privkeyA, aux_rand)\n",
    "# Sighash flag is not appended for SIGHASH_DEFAULT"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Witness elements for taproot script path spend\n",
    "\n",
    "The witness field for a key path spend transaction is a little more involved than previous transaction types. The witness elements should contain the following pattern:\n",
    "\n",
    "* Witness to spend TapScript_A:\n",
    "\n",
    "    * `[Stack element(s) satisfying TapScript_A]`\n",
    "    * `[TapScript_A]` \n",
    "    * `[Controlblock c]`\n",
    "\n",
    "Compared to the script spend path of a taproot with a single committed tapscript, the controlblock spending a taproot containing multiple tapscripts will also include a script inclusion proof.\n",
    "\n",
    "* Controlblock c contains:\n",
    "\n",
    "    * `[Tapscript Version]` \n",
    "        * `0xfe & c[0]`\n",
    "    * `[Parity bit (oddness of Q's y-coordinate)]`\n",
    "        * `0x01 & c[0]` \n",
    "    * `[Internal Public Key]` \n",
    "        * `c[1:33]`\n",
    "    * `[Script Inclusion Proof]` \n",
    "        * `n x 32Bytes`\n",
    "        \n",
    "Note that this script inclusion proof is a 32B multiple and its size will depend on the position of tapscript in the taptree structure."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {},
   "outputs": [],
   "source": [
    "control_byte = (TAPSCRIPT_VER[0] | negated).to_bytes(1, \"big\")\n",
    "\n",
    "control_block = (\n",
    "    control_byte\n",
    "    + internal_pubkey\n",
    "    + taggedhash_leafB\n",
    "    + taggedhash_leafC\n",
    "    )"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Now we can construct the witness field with 3 elements (each proceeded with the variable length integer), and complete the transaction!"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "signed transaction:  020000000001010f42020cf47dc9f8bf380c5abdda707ddd3d4e438ab958bed661caf25dd2615e0100000000ffffffff0280d1f00800000000160014fc7250a211deddc70ee5a2738de5f07817351cef80f0fa0200000000160014531260aa2a199e228c537dfa42c82bea2c7c1f4d03408624784388d931c6155db7f44ef7a503a10e36cea2c2354cdbdbf8b8d6ade9d3ef2e5f173299768e56d66bdb1ccc2d32eebf1cabfb435a1001343425219fb42c2220731bbf2e7163d87b12d66d3795655790691e59802fd1c578c2e06287555e3c28ac61c1031845925dcca99bc5689ce422b9204ff9721de8416b984b8a6b930e30352225a1494f24cfdfc93532412675eece318c63414dd02b8750947177b141e082076e2b71b71e05a8cd9771485b9248025e46871caa6585164a1fdf9e634d61023fd800000000\n"
     ]
    }
   ],
   "source": [
    "witness = (\n",
    "    bytes.fromhex(\"03\") \n",
    "    + varint_len(signatureA)\n",
    "    + signatureA\n",
    "    + varint_len(scriptA)\n",
    "    + scriptA\n",
    "    + varint_len(control_block)\n",
    "    + control_block\n",
    ")\n",
    "\n",
    "# the final signed transaction\n",
    "signed_script_path_tx = (\n",
    "    version\n",
    "    + marker\n",
    "    + flag\n",
    "    + input_count\n",
    "    + inputs\n",
    "    + output_count\n",
    "    + outputs\n",
    "    + witness\n",
    "    + locktime\n",
    ")\n",
    "\n",
    "print(\"signed transaction: \",signed_script_path_tx.hex())"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 16,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "[{'txid': '92a4387f65646140ccb75a611874d58defb94a3a7bb46b0ba4d59ef87e29aec9', 'wtxid': 'bdeeda66b862d30a3dffecc9fad27c46490bc677b96e550c265ff7e1101830ef', 'allowed': True, 'vsize': 130, 'fees': {'base': Decimal('0.00100000')}}]\n"
     ]
    }
   ],
   "source": [
    "result = node.testmempoolaccept(rawtxs=[signed_tx.hex()])\n",
    "print(result)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Quiz\n",
    "\n",
    "1. How are the signature opcodes`OP_CHECKSIG` and `OP_CHECKSIGVERIFY` treated in taproot inputs compared to non-taproot inputs.\n",
    "2. What are tagged hashed, and what is the advantage of using them compared to regular hashes?\n",
    "3. In the case of a key-path spend, is it possible to tell from the output whether the public key had been tweaked to "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    " ## Answers\n",
    "\n",
    "1. For taproot inputs, the opcodes`OP_CHECKSIG` and `OP_CHECKSIGVERIFY` are used to verify Schnorr signatures rather than ECDSA signatures.\n",
    "2. A tagged hash is a hash that includes an additional piece of information called a \"tag\" in addition to the regular data being hashed. An advantage of using tagged hashes is that it ensures the hash can only be used in the way it was intended by the creator. For example, in a tap tree, the \"TapLeaf\" and \"TapBranch\" tags prevent a hash for a branch being interpreted as a leaf.\n",
    "3. No. It is impossible to tell from a key-path spend transaction whether the public key had been tweaked or not."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Exercise\n",
    "\n",
    "Try replacing Carla's script `scriptC` with a script of a 2-of-2 multisig. Note that taproot uses a new opcode for multisig, `CHECKSIGADD` [BIP342](https://github.com/bitcoin/bips/blob/master/bip-0342.mediawiki#rules-for-signature-opcodes). This [Stack Exchange Answer](https://bitcoin.stackexchange.com/questions/114465/how-does-the-checksigadd-opcode-work-how-does-it-compare-to-its-predecessor-che) may be helpful."
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.7.0"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}