Taproot and Schnorr signatures

Wonder

1. Why does a complex multi-party agreement look exactly like a simple individual payment on the blockchain?
2. How can multiple private keys combine into a single public key without ever revealing their existence to observers?
3. What mathematical property allows a signature from ten people to be indistinguishable from one by a single person?

Explore

1. Before Taproot, a complex spending condition was revealed in full whenever coins were spent (and, for bare scripts, sat in the output itself): a multisig spend showed every participant’s key, a timelock its duration, a hashlock its structure. This public transparency created privacy risks for sophisticated users and bloated block space with redundant data. The network treated all scripts as open books, forcing complex arrangements to broadcast their full logic to every node and observer.
2. Taproot (BIP341) changes the commitment model. An output now points to a single 32-byte public key Q, calculated as P + t·G. Here, P is an internal key controlled by the primary spender, while t commits to the Merkle root of an optional tree of alternative scripts. On-chain the output looks like any single-key payment, hiding whatever complexity lies behind it.
3. Schnorr signatures (BIP340) underpin this efficiency. Unlike ECDSA, which uses variable-length DER encoding averaging 71–72 bytes, Schnorr produces a fixed-size 64-byte signature (65 with a non-default signature hash type). The fixed size simplifies parsing and reduces transaction weight. The linearity of the Schnorr scheme also enables key aggregation: with a protocol such as MuSig2, several public keys can be combined into one aggregate key, allowing groups to sign as if they were a single entity without revealing individual participants.
4. Spending proceeds via two distinct paths. In the key path, all parties cooperate and sign using their aggregate key; the resulting transaction is indistinguishable from any ordinary single-key payment. No scripts are revealed, and no extra data is attached. This preserves privacy for cooperative closes of Lightning channels or multisig wallets, ensuring that complex financial arrangements do not leak metadata to the blockchain’s public ledger.
5. If cooperation fails, the script path activates. The spender reveals one specific leaf from the Merkle tree along with a proof of its membership. Unused branches remain hidden, preserving the privacy of alternative conditions. This mechanism, known as Merkelized Abstract Syntax Trees (MAST), allows for diverse spending rules—such as delayed withdrawals or emergency keys—to coexist within a single output without exposing them until strictly necessary.
6. The practical impact is significant. Taproot addresses begin with ‘bc1p’. MuSig2 (BIP327) standardizes key aggregation, enabling interoperable multisig across different wallet vendors. Threshold schemes like FROST are under development for similar purposes. In November 2021, at block 709,632, the network adopted this structure, making complex scripts smaller, cheaper, and private by default when used cooperatively.

Key facts

Exercise nine, six, three, one

Fact check

Dates, figures and claims checked against the published sources listed below.

• BIP341: Taproot: SegWit version 1 spending rules
• BIP340: Schnorr Signatures for secp256k1
• BIP327: MuSig2 for BIP340-compatible Multi-Signatures
• Bitcoin Optech, 'Taproot' topic guide