Taproot proposal

[Karartma1]

I can't wait for improved fungibility, better tx speed, increasingly difficult analytics and indistinguishable transactions.

this case is overstated


it's only going to be the 'base case'/'cooperative case' that will become indistinguishable, e.g. Lightning channel opening transactions and cooperatively closed channels, because Schnorr "additivity" (which is not a real word ) makes such transactions appear the same as a regular [1 (or more) inputs -> 2 outputs] tx, because there is only 1 aggregated signature (because additive signatures, despite 2 parties signing the tx). Currently, spending outputs from that kind of transactions reveals it to be a 2 of 2 multisig that had alternate script paths, not so with the same script using Taproot/schnorr.

But ,uncooperative closes are still distinguishable from the regular [1+ in -> 2 out] transactions, because of the atypical script they use will (necessarily) be revealed if they are broadcast/confirmed in a block. I know, uncooperative channel closures are not common, but they will still sometimes happen when using Taproot/schnorr based channels/contracts.

And so, all other atypical scripts will still be distinguishable from regular transactions too. It's just nice that the construction of many contracts involve using the [1+ in -> 2 out] regular pattern as the base case.

I love new words, mainly if the are not real ones. 
Always great to have your take on all things bitcoin, much appreciated. You clarified that very nicely.

Possibly another stupid question from me here, but can the Lightning Network then be leveraged as a use case for tumbling/mixing/hiding our UTXOs after the upgrade?

Isn't it that way already? 

[1714136139]

1714136139

[1714136139]

1714136139

[1714136139]

1714136139

[Carlton Banks]

Possibly another stupid question from me here, but can the Lightning Network then be leveraged as a use case for tumbling/mixing/hiding our UTXOs after the upgrade?

It's already possible. The real advantage of Taproot on LN is hiding other condition of the HTLC which isn't executed.

The only downside is that you must leave the channel reserve in a channel.


Workflow is as follows:

1. Open 2 Lightning nodes; one with outgoing liquidity and the other with an equal amount of incoming liquidity (minus the 1% reserve + ln fees)
2. Send everything from the node with 100% outgoing to the 100% incoming node

You just did an ad-hoc Coinswap over lightning.

n.b. I think eltoo channels remove the reserve requirement, so that would mean you could perform this without the "loose end" constituted by the reserve balance left over on one node


However, a 'real' coinswap is better. It's probably less traceable (at least than HTLC based Coinswap-over-LN) and the LN technnique might spark a trend of people closing both channels and both nodes once they finish the swap (which is a little anti-social, payment channels are intended to be long lived).

[gmaxwell]

it's only going to be the 'base case'/'cooperative case' that will become indistinguishable, e.g. Lightning channel opening transactions and cooperatively closed channels, because Schnorr "additivity" (which is not a real word ) makes such transactions appear the same as a regular [1 (or more) inputs -> 2 outputs] tx, because there is only 1 aggregated signature (because additive signatures, despite 2 parties signing the tx). Currently, spending outputs from that kind of transaction reveals it to be a 2 of 2 multisig that had alternate script paths, not so with the same tx script using Taproot/schnorr.

This is perhaps ignoring the forest for the trees, those distinguishable lightning txn are relatively uncommon.  2 of 3 multisig and various multisig or timeout keys are about half of all transactions.   Taproot should eventually allow most of those to look just like single key wallets.  It'll also let users improve their security by using multisig without increasing their fees or making their transactions stand out at all.

It's hard to reason about all the benefits because it also makes possible some things that aren't possible today so we don't know how common or how valuable they'd be.  For scripts with a compatible structure taproot increases the maximum script size a factor of 10^43 or so...   If you happened to know a pubkey for every resident of california you could make an output with taproot that could be claimed by any of them.  The signature would just be a few hundred bytes.   Without taproot that would take a 1.3GB transaction.

[Carlton Banks]

This is perhaps ignoring the forest for the trees, those distinguishable lightning txn are relatively uncommon.

yep, i mentioned that

It's hard to reason about all the benefits because it also makes possible some things that aren't possible today so we don't know how common or how valuable they'd be.  For scripts with a compatible structure taproot increases the maximum script size a factor of 10^43 or so...   If you happened to know a pubkey for every resident of california you could make an output with taproot that could be claimed by any of them.  The signature would just be a few hundred bytes.   Without taproot that would take a 1.3GB transaction.

strangely, Taproot re-defines what "the script" actually means. In your example, which is the script? The whole tree, paying to any pubkey of every californian, or the script that gets redeemed on the blockchain? A taproot script is potentially an entire litter of Schrodingers scripts, only one of which becomes an observable cat on the blockchain o_O

the answer is, of course, that there is a "script tree" and an executed "script leaf", where the script tree is never publicly known.

[Wind_FURY]

46.80%, https://taproot.watch/miners

How much time does it typically take before those other miners start to signal for an upgrade? Do they take their time until the last, maybe 500 blocks, before we see 90%? Or can anyone tell that for this round, it is slow?

[NeuroticFish]

46.80%, https://taproot.watch/miners

I don't understand what is Poolin doing. They signal Taproot in certain blocks and don't signal it on other blocks.
I guess that they have more than one pool and not all those are upgraded in the same way, but I still find it odd...

How much time does it typically take before those other miners start to signal for an upgrade? Do they take their time until the last, maybe 500 blocks, before we see 90%? Or can anyone tell that for this round, it is slow?

Switch to the main tab and it'll tell that we're already late for this 2016 blocks period, since over 90% of the blocks should be signaled and it's not longer possible.
Somehow we should rise awareness, maybe more pools join before the next difficulty period.

[nibor]

I don't understand what is Poolin doing. They signal Taproot in certain blocks and don't signal it on other blocks.

Seems a lot of pools are doing that. There was even one block from btc.com that did signal - all others did not.

I like you assume they have multiple setups and have only partially upgraded - and btc.com was just a test before putting live?

As you say this period is already a no. And next is looking unlikely unless the other 4 big pools upgrade and the existing ones that are signalling start signalling with all their bocks in the next few days.

90% is a high threshold - so unless we are up to almost 90% at the start of the next period on 13th (ish) May unlikely to lock in during that period either.

[BrewMaster]

big mining pools always have more than one server that are located in separate locations so they operate separately also. sometimes their coinbase transactions also includes the name of that particular server alongside the name of the pool (something like Antpool.Server1, Antpool.Server2). this is why some of their blocks have the change and are signalling while others don't.
they did the same thing during segwit activation in 2017.

[Karartma1]

46.80%, https://taproot.watch/miners

How much time does it typically take before those other miners start to signal for an upgrade? Do they take their time until the last, maybe 500 blocks, before we see 90%? Or can anyone tell that for this round, it is slow?

Just wild guessing: smaller pools want to wait until the end only to be able to then unlock the upgrade and be remembered before going back to the void 
Anyway, if that's the case about having separate locations, they need to get the ball rolling and start signalling everywhere they operate.
I'm hoping Jimmy Song was right about Thanksgiving...

[gmaxwell]

strangely, Taproot re-defines what "the script" actually means.

The script is the rules that specify the conditions required to spend the coins.  Taproot makes it so that most of the script doesn't need to be published-- which is often a scalability improvement sometimes a massive one,  just like P2SH made it so that the script didn't need to be published until spending time (and never published, in case you happened to lose the keys ).

[Wind_FURY]

46.80%, https://taproot.watch/miners

I don't understand what is Poolin doing. They signal Taproot in certain blocks and don't signal it on other blocks.
I guess that they have more than one pool and not all those are upgraded in the same way, but I still find it odd...

How much time does it typically take before those other miners start to signal for an upgrade? Do they take their time until the last, maybe 500 blocks, before we see 90%? Or can anyone tell that for this round, it is slow?

Switch to the main tab and it'll tell that we're already late for this 2016 blocks period, since over 90% of the blocks should be signaled and it's not longer possible.

Somehow we should rise awareness, maybe more pools join before the next difficulty period.

You already know how we can raise awareness.

https://bitcoincore.org/en/download/

BUT as gmaxwell has already said in the topic, we first wait for the miner’s true intentions. With most of the Bitcoin Core developers remaining neutral, there should be a user-led campaign for the upgrade.

[stompix]

46.80%, https://taproot.watch/miners

How is the signaling calculated on that website, the Ok sign, not the percentage?
Pollin with 35/118 and 1Tash with 8/35 are a no and SBI Crypto with 2/11 is green?
Or it is based on the status of the block mined?

Well, at least the only ones big enough block that hasn't done a thing yet don't have that much hashing power of their own, so miners could switch to another pool for an epoch, I must say I'm pretty surprised to find out AntPool was one of the first to change. If ViatBtc is the next one the surprise would be complete.

You already know how we can raise awareness.
https://bitcoincore.org/en/download/

Switching miners away from silent pools would work better, unfortunately a few hundred th/s are a drop in the ocean. 

[gmaxwell]

With most of the Bitcoin Core developers remaining neutral,

You say a lot of weird stuff.   Bitcoin Core developers pushed this out, they're not "remaining neutral", that would be a terrible abdication of their responsibility as technical experts.

[Wind_FURY]

With most of the Bitcoin Core developers remaining neutral,

You say a lot of weird stuff.   Bitcoin Core developers pushed this out, they're not "remaining neutral", that would be a terrible abdication of their responsibility as technical experts.

From my point of view during the Segwit “Saga”, when the call for the USAF was obviously becoming very necessary, most of the Core developers were neutral because of the risks. But reading your reply makes me very confident for the UASF for Taproot, if it’s necessary.

[dkbit98]

We are over 20% Taproot signaling blocks and I am not surprised seeing that one of the largest pool Binance is doing nothing so far with 0/113 blocks.  

SatoshiLabs team wrote a nice article explaining how Taproot will benefit hardware wallets and it is easy to understand it even if you are not a tech expert.
Size of transactions with Taproot will be reduced resulting in more transactions per block, and it is especially important when there are higher number of inputs and outputs that will save a lot of time for something like coinjoin transactions and mixing coins.
For example if we have 100 inputs and two outputs time for transaction could be reduced up to 90%!
Multisig prvacy will also be much better with Taproot, but important thing is that more people need to use it if we want to have more benefits.
https://blog.trezor.io/how-taproot-will-benefit-hardware-wallets-fa43c0b6123e

[Coin-Keeper]

We are over 20% Taproot signaling blocks and I am not surprised seeing that one of the largest pool Binance is doing nothing so far with 0/113 blocks.  

SatoshiLabs team wrote a nice article explaining how Taproot will benefit hardware wallets and it is easy to understand it even if you are not a tech expert.
Size of transactions with Taproot will be reduced resulting in more transactions per block, and it is especially important when there are higher number of inputs and outputs that will save a lot of time for something like coinjoin transactions and mixing coins.
For example if we have 100 inputs and two outputs time for transaction could be reduced up to 90%!
Multisig prvacy will also be much better with Taproot, but important thing is that more people need to use it if we want to have more benefits.
https://blog.trezor.io/how-taproot-will-benefit-hardware-wallets-fa43c0b6123e

Agreed. I have been watching this and assumed Sat Labs would be onboard big time.  I read through the website before coming here and I was going to post the same thing you did, LOL!

[PrimeNumber7]

With most of the Bitcoin Core developers remaining neutral,

You say a lot of weird stuff.   Bitcoin Core developers pushed this out, they're not "remaining neutral", that would be a terrible abdication of their responsibility as technical experts.

From my point of view during the Segwit “Saga”, when the call for the USAF was obviously becoming very necessary, most of the Core developers were neutral because of the risks. But reading your reply makes me very confident for the UASF for Taproot, if it’s necessary.

USAF SegWit is not the same as SegWit. The former is a "forced" change, while the later is a change that was achieved via consensus. It is totally reasonable for the devs to advocate for Taproot to be activate, expected actually. For them to advocate for Taproot to activate without clear consensus is another story.

[fxsniper]

For now, Bitcoin it is update to full Taproot already or not yet?

[pooya87]

For now, Bitcoin it is update to full Taproot already or not yet?

Bitcoin, as in the protocol, does not yet have Taproot because the fork has not yet taken place. We have to first reach majority support (ie. 90% of hashrate or more precisely the blocks that were mined to signal their acceptance of it) then it activates. The signalling was just started.
The bitcoin core (reference implementation) has the code for it and is ready to accept the new blocks containing Tapscripts.

[Karartma1]

We are over 20% Taproot signaling blocks and I am not surprised seeing that one of the largest pool Binance is doing nothing so far with 0/113 blocks.  

SatoshiLabs team wrote a nice article explaining how Taproot will benefit hardware wallets and it is easy to understand it even if you are not a tech expert.
Size of transactions with Taproot will be reduced resulting in more transactions per block, and it is especially important when there are higher number of inputs and outputs that will save a lot of time for something like coinjoin transactions and mixing coins.
For example if we have 100 inputs and two outputs time for transaction could be reduced up to 90%!
Multisig prvacy will also be much better with Taproot, but important thing is that more people need to use it if we want to have more benefits.
https://blog.trezor.io/how-taproot-will-benefit-hardware-wallets-fa43c0b6123e

Agreed. I have been watching this and assumed Sat Labs would be onboard big time.  I read through the website before coming here and I was going to post the same thing you did, LOL!

Shouldn't that apply to all wallets after taproot takes place? You know I'm no geek but I understood that those improvements are for, basically, any wallet. In the end, the functioning is the same for any wallet.
Great read BTW, it's always nice to stack more knowledge on the matter. (now i'm going to stack more sats. no pun intended)