So far, we've seen many types of scriptPubKey in the previous modules: P2PKH, P2WPKH, P2SH, and P2WSH.

In this lesson, we will learn about a new type of scriptPubKey called P2TR.

P2TR has the following format:

• OP_1 means segwit version 1
• <32B tweaked key> is what we are going to spend the next lessons explaining

So far, P2TR looks like a simple script.

One way to spend it is with the private key corresponding to the <32B tweaked key>. This is called a key-path spend.

But the tweaked key is built in a way that makes it interesting. Let's see how.

Tweaking a public key

The term "tweak" means we start with an original public key and make a change to it to get a tweaked public key.

And that's exactly what we are going to do here.

Let's say we have an original public key $P$.

Tweaking it means altering it with a value, which we call the tweak $t$, to get a new tweaked public key $Q$:

There's a lot going on here, so let's break this equation into two parts: $P$, the original public key, and $t \cdot G$.

Part 1: $P$

$P$ is our original public key. Let's call its private key $d$.

That's just scalar multiplication, the operation that turns a private key $d$ into a public key $P$. We can think of it as adding the generator point $G$ to itself $d$ times.

$P$ is also a point on the secp256k1 curve.

Part 2: $t \cdot G$

Now notice the second part of the equation: $t \cdot G$.

Doesn't this also look like a normal point on the secp256k1 curve, with $t$ acting like a private key?

That's exactly what it is mathematically. $t \cdot G$ is a point made by adding $G$ to itself $t$ times.

We are going to call this point $T$, so it is easier to reference:

• $T$ is the tweak point
• $t$ is the tweak value

Putting it back together

So $Q$, the tweaked public key, is just the addition of two points: $P$, the original public key, and $T$, the tweak point.

Adding the two curve points $d \cdot G$ and $t \cdot G$ gives us a point whose private key is the sum of $d$ and $t$.

The tweaked private key is therefore:

Here, $n$ is the order of the secp256k1 generator point.

That means if we have funds locked to the tweaked public key $Q$, one way to spend them is by signing with the tweaked private key $q$.

This works because $Q$ is just another point on the curve, created through point addition.

The P2TR output

Remember the scriptPubKey we saw at the beginning:

That <32B tweaked key> is the $Q$ we just computed.

Right now, the tweak $t$ looks like just an arbitrary value. In the next lessons, we will see how we make it commit to data.

That is where Taproot gets interesting.

In this example, the verifier only sees $Q$. It has no idea that the key was built by adding a tweak.

In the next lessons, we will make that tweak commit to data, which is where Taproot gets powerful.