7

From what I know, to tweak a public key, I can use:

Q = P + H(P|c)G

where

Q is the tweaked public key
P is the initial public key (P = xG where x is the private key)
H is the hash function
| is concatenation
c is the commitment to the script path spend
G is the generator point

This might seem like high school math but can I calculate the H(P|c)G part by using the result of H(P|c) as a private key and computing the public key from it? I think this might work because the H() returns a 32 byte array and the result could be casted as a private key then multiplied by generator point G to get the corresponding public key which is equal to H(P|c)G?

Murch
  • 71,155
  • 33
  • 180
  • 600
Keijyu
  • 85
  • 4
  • I don't understand the question. xG is the public key of x. So if you substitute H(P|c) for x then xG is now the public key of H(P|c). Is that what you are asking? You are effectively adding two public keys to get Q, the tweaked public key. – Michael Folkson Oct 26 '21 at 14:19

1 Answers1

5

That's exactly right.

Compute the tweak H(P||c), compute the "public key" corresponding to that tweak, and then add (elliptic curve point addition) the internal public key with that tweak public key.

Pieter Wuille
  • 98,249
  • 9
  • 183
  • 287