2.1-segwit-version-1.ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "import util\n",
    "from test_framework.address import program_to_witness\n",
    "from test_framework.key import generate_key_pair, generate_bip340_key_pair, generate_schnorr_nonce\n",
    "from test_framework.messages import CTxInWitness, sha256\n",
    "from test_framework.musig import aggregate_musig_signatures, aggregate_schnorr_nonces, generate_musig_key, sign_musig\n",
    "from test_framework.script import CScript, CScriptOp, hash160, OP_0, OP_2, OP_CHECKMULTISIG, SegwitV0SignatureHash, SIGHASH_ALL, SIGHASH_ALL_TAPROOT, TaprootSignatureHash"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# 2.1 Taproot Outputs\n",
    "\n",
    "* Part 1 (Example): Sending to and spending from a single-signer segwit v1 output\n",
    "* Part 2 (Case Study): Migrating from a 2-of-2 P2WSH output to a MuSig segwit v1 output\n",
    "\n",
    "In this chapter, we introduce segwit v1 outputs, which are defined in [BIP341](https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki). Segwit v1 outputs can be spent in two ways:\n",
    "\n",
    "* **Key path** spending, which treats the witness program as a public key, and permits spending using a signature from that public key.\n",
    "* **Script path** spending, which allows a pre-committed script to be used to spend the output. Script path spending will be fully described in chapters 2.2, 2.3 and 2.4.\n",
    "\n",
    "By using the MuSig pubkey and signature aggregation protocol described in chapter 1.2, key path spending can be used to encumber an output to an n-of-n multisig policy in a way that is indistinguishable from a single-key output and spend.\n",
    "\n",
    "Part 1 of this chapter is an example of sending funds to a segwit v1 address using the Bitcoin Core wallet, and then manually constructing a transaction that spends that output using the new BIP341 key path spending rules.\n",
    "\n",
    "Part 2 of this chapter is a case study, showing how using a segwit v1 output with MuSig can provide cost and privacy benefits over using a segwit P2WSH output."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Part 1 (Example): Single-signer segwit v1 output\n",
    "\n",
    "Segwit v1 follows the same output script pattern as segwit v0:\n",
    "\n",
    "* Segwit output: **`[1B Version]` `[segwit program]`**\n",
    "* Segwit v0 output: **`[00]` `[20-Byte public key digest]`** (P2WPKH) or **`[00]` `[32-Byte script digest]`** (P2WSH)\n",
    "* Segwit v1 output: **`[01]` `[32-Byte public key]`**"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Spending a segwit v1 output with the key path\n",
    "\n",
    "Unlike segwit v0 outputs, v1 outputs look the same for script or key paths(unlike v0 which separates into P2WPKH and P2WSH). In this chapter we will focus on spending the key path.\n",
    "\n",
    "![test](images/segwit_version1_0.jpg)\n",
    "\n",
    "The output can be spent along the **key path** by providing a valid signature for the pubkey in the output's scriptPubKey. The spending witness is simply **`[sig]`**.\n",
    "\n",
    "The output can be spent along the **script path** if public key was tweaked with a valid taproot. See chapters 2.2 and 2.3 for further details."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### 2.1.1 Example: Constructing a segwit v1 output\n",
    "\n",
    "In this example, we construct segwit v1 output for spending along the key path. We generate a key pair, encode the public key using the BIP340 and BIP341 pubkey encoding rules, and then encode the witness version and witness program to a bech32m address."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Key pair generation\n",
    "privkey, pubkey = generate_bip340_key_pair()\n",
    "print(\"Pubkey is {}\\n\".format(pubkey.get_bytes().hex()))\n",
    "\n",
    "# Create witness program ([32B x-coordinate])\n",
    "program = pubkey.get_bytes()\n",
    "print(\"Witness program is {}\\n\".format(program.hex()))\n",
    "\n",
    "# Create (regtest) bech32m address\n",
    "version = 0x01\n",
    "address = program_to_witness(version, program)\n",
    "print(\"bech32m address is {}\".format(address))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Sending funds from the Bitcoin Core wallet\n",
    "\n",
    "Next, we send funds to the segwit v1 address that we just generated. We'll create send the funds from a Bitcoin Core wallet, which is able to send outputs to segwit v1 addresses."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Example 2.1.2: Start Bitcoin Core node and send coins to the taproot address\n",
    "\n",
    "Only run setup once, or after a clean shutdown."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Start node\n",
    "test = util.TestWrapper()\n",
    "test.setup()\n",
    "node = test.nodes[0]\n",
    "\n",
    "# Generate coins and create an output\n",
    "tx = node.generate_and_send_coins(address)\n",
    "print(\"Transaction {}, output 0\\nsent to {}\\n\".format(tx.hash, address))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Constructing a transaction to spend the segwit v1 output\n",
    "\n",
    "We are now going to manually contruct, sign and broadcast a transaction which spends the segwit v1 output.\n",
    "\n",
    "To do that we create a `CTransaction` object and populate the data members:\n",
    "\n",
    " * `nVersion`\n",
    " * `nLocktime`  \n",
    " * `tx_vin` (list of `CTxIn` objects)\n",
    " * `tx_vout` (list of `CTxOut` objects)\n",
    " * `tx.wit.vtxinwit` (list of `CTxInWitness` objects)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Example 2.1.3: Construct `CTransaction` and populate fields\n",
    "\n",
    "We use the `create_spending_transaction(node, txid)` convenience function."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Create a spending transaction\n",
    "spending_tx = test.create_spending_transaction(tx.hash)\n",
    "print(\"Spending transaction:\\n{}\".format(spending_tx))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Example 2.1.4: Sign the transaction with a schnorr signature\n",
    "\n",
    "BIP341 defines the following sighash flags:\n",
    "* Legacy sighash flags:\n",
    "  * `0x01` - **SIGHASH_ALL**\n",
    "  * `0x02` - **SIGHASH_NONE**\n",
    "  * `0x03` - **SIGHASH_SINGLE**\n",
    "  * `0x81` - **SIGHASH_ALL | SIGHASH_ANYONECANPAY**\n",
    "  * `0x82` - **SIGHASH_NONE | SIGHASH_ANYONECANPAY**\n",
    "  * `0x83` - **SIGHASH_SINGLE | SIGHASH_ANYONECANPAY**\n",
    "* New sighash flag:\n",
    "  * `0x00` - **SIGHASH_ALL_TAPROOT** same semantics `0x01` **SIGHASH_ALL**\n",
    "\n",
    "Append the sighash flag to the signature `[R_x, s]` with the sighash byte if not `0x00`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Generate the taproot signature hash for signing\n",
    "# SIGHASH_ALL_TAPROOT is 0x00\n",
    "sighash = TaprootSignatureHash(spending_tx, [tx.vout[0]], SIGHASH_ALL_TAPROOT, input_index=0)\n",
    " \n",
    "# All schnorr sighashes except SIGHASH_ALL_TAPROOT require\n",
    "# the hash_type appended to the end of signature\n",
    "sig = privkey.sign_schnorr(sighash)\n",
    "\n",
    "print(\"Signature: {}\".format(sig.hex()))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Example 2.1.5: Add the witness and test acceptance of the transaction"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Construct transaction witness\n",
    "spending_tx.wit.vtxinwit.append(CTxInWitness([sig]))\n",
    "\n",
    "print(\"Spending transaction:\\n{}\\n\".format(spending_tx))\n",
    " \n",
    "# Test mempool acceptance\n",
    "node.test_transaction(spending_tx)\n",
    "print(\"Success!\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Example 2.1.6: Shutdown the TestWrapper (and all bitcoind instances)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "test.shutdown()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Part 2 (Case Study): 2-of-2 multisig\n",
    "\n",
    "Alice stores her bitcoin using a combination of an offline hardware wallet and online wallet. She currently uses P2WSH 2-of-2 multisig, which has some drawbacks:\n",
    "\n",
    "- spending a P2WSH multisig output is more expensive than spending a single signature P2WPKH output, since multiple pubkeys and signatures need to be included in the witness\n",
    "- spending from the P2WSH output reveals that the coins were encumbered using a multisig setup. Anyone who transacted with Alice (paid or was paid by) can see this easily, and even entities who do not transact directly with Alice can discover this with some chain analysis. Revealing her wallet setup may be bad for Alice's privacy and safety.\n",
    "\n",
    "In this chapter, we'll show how Alice can move to using a MuSig aggregated public key, eventually saving her transaction fees and protecting her privacy."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Spending a segwit v0 P2SH 2-of-2 multisig\n",
    "\n",
    "We'll first show Alice's current setup: P2WSH 2-of-2 multisig."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Example 2.1.7: Construct a 2-of-2 P2WSH output\n",
    "\n",
    "In this example, we'll construct a 2-of-2 P2WSH output and address"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Generate individual key pairs\n",
    "privkey1, pubkey1 = generate_key_pair()\n",
    "privkey2, pubkey2 = generate_key_pair()\n",
    "\n",
    "# Create the spending script\n",
    "multisig_script = CScript([CScriptOp(OP_2), pubkey1.get_bytes(bip340=False), pubkey2.get_bytes(bip340=False), CScriptOp(OP_2), CScriptOp(OP_CHECKMULTISIG)])\n",
    "\n",
    "# Hash the spending script\n",
    "script_hash = sha256(multisig_script)\n",
    "\n",
    "# Generate the address\n",
    "version = 0\n",
    "address = program_to_witness(version, script_hash)\n",
    "print(\"bech32 address is {}\".format(address))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Example 2.1.8: Start a Bitcoind node and send funds to the segwit v0 address\n",
    "\n",
    "We'll use the `generate_and_send_coins()` function."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "test = util.TestWrapper()\n",
    "test.setup()\n",
    "node = test.nodes[0]\n",
    "\n",
    "# Generate coins and create an output\n",
    "tx = node.generate_and_send_coins(address)\n",
    "print(\"Transaction {}, output 0\\nsent to {}\\n\".format(tx.hash, address))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Example 2.1.9 : Construct CTransaction, sign and check validity\n",
    "\n",
    "In this example we:\n",
    "- create a `CTransaction` object\n",
    "- create signatures for both public keys\n",
    "- create a valid witness using those signatures and add it to the transaction\n",
    "- test transaction validity"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Create a spending transaction\n",
    "spending_tx = test.create_spending_transaction(tx.hash)\n",
    "\n",
    "# Generate the segwit v0 signature hash for signing\n",
    "sighash = SegwitV0SignatureHash(script=multisig_script,\n",
    "                                txTo=spending_tx,\n",
    "                                inIdx=0,\n",
    "                                hashtype=SIGHASH_ALL,\n",
    "                                amount=100_000_000)\n",
    "\n",
    "# Sign using ECDSA and append the SIGHASH byte\n",
    "sig1 = privkey1.sign_ecdsa(sighash) + chr(SIGHASH_ALL).encode('latin-1')\n",
    "sig2 = privkey2.sign_ecdsa(sighash) + chr(SIGHASH_ALL).encode('latin-1')\n",
    "\n",
    "print(\"Signatures:\\n- {},\\n- {}\\n\".format(sig1.hex(), sig2.hex()))\n",
    "\n",
    "# Construct witness and add it to the script.\n",
    "# For a multisig P2WSH input, the script witness is the signatures and the scipt\n",
    "witness_elements = [b'', sig1, sig2, multisig_script]\n",
    "spending_tx.wit.vtxinwit.append(CTxInWitness(witness_elements))\n",
    "\n",
    "print(\"Spending transaction:\\n{}\\n\".format(spending_tx))\n",
    "\n",
    "print(\"Transaction weight: {}\\n\".format(node.decoderawtransaction(spending_tx.serialize().hex())['weight']))\n",
    "\n",
    "# Test mempool acceptance\n",
    "assert node.test_transaction(spending_tx)\n",
    "print(\"Success!\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Example 2.1.10: Shutdown the TestWrapper (and all bitcoind instances)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "test.shutdown()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Spending a segwit v1 output with a MuSig public key\n",
    "\n",
    "Now, we'll use Alice's same keys to create a MuSig aggregate key, and spend a segwit v1 output using that aggregate key."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### 2.1.11 _Programming Exercise:_ Generate segwit v1 addresses for a 2-of-2 MuSig aggregate pubkey\n",
    "\n",
    "In this exercise, we create a 2-of-2 aggregate MuSig public key"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Generate a 2-of-2 aggregate MuSig key using the same pubkeys as before\n",
    "# Method: generate_musig_key(ECPubKey_list)\n",
    "c_map, agg_pubkey =  # TODO: implement\n",
    "\n",
    "# Multiply individual keys with challenges\n",
    "privkey1_c =  # TODO: implement\n",
    "privkey2_c =  # TODO: implement\n",
    "pubkey1_c =  # TODO: implement\n",
    "pubkey2_c =  # TODO: implement\n",
    "\n",
    "# Negate the private and public keys if needed\n",
    "if # TODO: implement\n",
    "    # TODO: implement\n",
    "    \n",
    "# Create a segwit v1 address for the MuSig aggregate pubkey\n",
    "# Method: address = program_to_witness(version_int, program_bytes)\n",
    "program_musig =  # TODO: implement\n",
    "address_musig =  # TODO: implement\n",
    "print(\"2-of-2 musig: \", address_musig)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Example 2.1.12: Create a transaction in the Bitcoin Core wallet sending an output to the segwit v1 addresses"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "test = util.TestWrapper()\n",
    "test.setup()\n",
    "node = test.nodes[0]\n",
    "\n",
    "# Generate coins and create an output\n",
    "tx = node.generate_and_send_coins(address_musig)\n",
    "print(\"Transaction {}, output 0\\nsent to {}\\n\".format(tx.hash, address_musig))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Example 2.1.13 : Construct CTransaction and populate fields"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Create a spending transaction\n",
    "spending_tx = test.create_spending_transaction(tx.hash)\n",
    "print(\"Spending transaction:\\n{}\".format(spending_tx))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### 2.1.14 _Programming Exercise:_ Create a valid BIP340 signature for the MuSig aggregate pubkey\n",
    "\n",
    "In this exercise, we create a signature for the aggregate pubkey, add it to the witness, and then test that the transaction is accepted by the mempool."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Create sighash for ALL (0x00)\n",
    "sighash_musig = TaprootSignatureHash(spending_tx, [tx.vout[0]], SIGHASH_ALL_TAPROOT, input_index=0)\n",
    "\n",
    "# Generate individual nonces for participants and an aggregate nonce point\n",
    "# Remember to negate the individual nonces if necessary\n",
    "# Method: generate_schnorr_nonce()\n",
    "# Method: aggregate_schnorr_nonces(nonce_list)\n",
    "nonce1 = # TODO: implement\n",
    "nonce2 = # TODO: implement\n",
    "R_agg, negated =  # TODO: implement\n",
    "\n",
    "# Create an aggregate signature\n",
    "# Method: sign_musig(privkey, nonce, R_agg, agg_pubkey, sighash_musig)\n",
    "# Method: aggregate_musig_signatures(partial_signature_list, R_agg)\n",
    "s1 = # TODO: implement\n",
    "s2 = # TODO: implement\n",
    "sig_agg =  # TODO:implement\n",
    "print(\"Aggregate signature is {}\\n\".format(sig_agg.hex()))\n",
    "\n",
    "# Add witness to transaction\n",
    "spending_tx.wit.vtxinwit.append(CTxInWitness(  # TODO: implement\n",
    "\n",
    "# Get transaction weight\n",
    "print(\"Transaction weight: {}\\n\".format(node.decoderawtransaction(spending_tx.serialize().hex())['weight']))\n",
    "\n",
    "# Test mempool acceptance\n",
    "assert node.test_transaction(spending_tx)\n",
    "print(\"Success!\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Benefits of using segwit v1 MuSig over segwit v0 P2WSH\n",
    "\n",
    "You can see that the transaction weight of the transaction spending the v1 MuSig output is about 30% lower than the transaction spending the v0 P2WSH output. For larger n-of-n multisig, the weight savings is even larger. Since transaction fees are based on the transaction weight, these weight savings translate directly to fee savings.\n",
    "\n",
    "In addition, by using a MuSig aggregate key and signature, Alice does not reveal that she is using a multisignature scheme, which is good for her privacy and security."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Example 2.1.15: Shutdown the TestWrapper (and all bitcoind instances)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "test.shutdown()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "**Congratulations!** In this chapter, you have:\n",
    "\n",
    "- Learned how to create a segwit v1 output and derive its bech32m address.\n",
    "- Sent bitcoin to a segwit v1 address, and then constructed a transaction that spends the segwit v1 output back to the wallet using the key path.\n",
    "- Shown how using a segwit v1 MuSig output saves fees and improves privacy over using P2WSH multisig."
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.6.5"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}