TapTweak Demo — Taproot Output Key Derivation

Taproot's output key Q is not the signer's raw public key. It is a tweaked key that commits to an optional script tree without revealing anything about it. This tool shows how Q is derived from an internal key P and (optionally) a Merkle root c.

1 Lift x-only P.x to full point P

P.y = —

Solve y² = x³ + 7 (mod p) and pick the even-y solution (BIP 340 convention).

2 Build the tagged-hash input

data = —

—

3 Compute the tweak scalar t — unpacking tagged_hash

BIP 340 defines tagged_hash(tag, x) as SHA-256(SHA-256(tag) ‖ SHA-256(tag) ‖ x). The double-prepended tag hash gives domain separation — a hash computed with tag "TapTweak" can never collide with one computed with tag "BIP0340/challenge" or "TapLeaf", even if the underlying x is identical. Pre-hashing the tag (instead of prepending it raw) also aligns the preimage to a 64-byte SHA-256 block boundary, so the first block is cached across repeated calls with the same tag.

3a. tag_hash = SHA-256("TapTweak")

tag_hash = —

32 bytes. Constant for this tag — every TapTweak computation reuses it.

3b. preimage = tag_hash ‖ tag_hash ‖ data

preimage = —

—

3c. raw hash = SHA-256(preimage)

t_raw = —

256-bit output interpreted as a big-endian integer.

3d. reduce mod n (secp256k1 group order)

t = t_raw mod n = —

—

4 Scalar-multiply the tweak by G

tG.x = —

tG.y = —

Standard double-and-add on secp256k1. Same operation any Schnorr signer performs.

5 Point-add: Q = P + t·G

Q.x = —

Q.y = —

Q is a new curve point whose private scalar is p + t where p is the internal private key. The signer can still sign with Q because they know p; no one else knows either P or c.

⊕ TapTweak Demo

Inputs

Output key Q (what goes on-chain)