Explaining Taproot - NADO 2

Aaron van Wirdum Live from Utrecht, this is the Van Wirdum Sjorsnado.

Sjors Provoost Yes, podcast. I'm very happy we're not actually doing this live.

Aaron van Wirdum Yeah, indeed. I just killed my laptop, apparently, it seemed like.

Sjors Provoost You may have killed it.

Aaron van Wirdum We were happy recording this podcast, and then I dropped a glass of water on my... laptop, and now it's not working anymore at all.

Sjors Provoost Which means we're not sure if the first half of this recording was there or not, so we're just going to do it again.

Aaron van Wirdum Let's start over.

Sjors Provoost So this better be awesome.

Aaron van Wirdum We're doing great. We're never going to beat what we did.

Sjors Provoost Yeah, that was an amazing podcast. Maybe one day we'll sell it on DVD, that first 15 minutes, manually signed, and you can buy it.

Aaron van Wirdum We have to recover my hard drive.

Sjors Provoost Yeah, it should be possible. All right. How are you doing?

Aaron van Wirdum Not bad, not bad. I'm still slightly in shock, but I think I'll... I'm fine, I'm fine. We can do this podcast now.

Sjors Provoost I think so. And we've practiced this podcast three or four times now, so I think...

Aaron van Wirdum So we moved inside this time?

Sjors Provoost Yep.

Aaron van Wirdum We were getting a lot of complaints for... For background noise, I guess rightfully so. We were inside because of Corona. That was sort of the reason we were inside, right?

Sjors Provoost We were outside because of Corona.

Aaron van Wirdum That's what I mean.

Sjors Provoost Exactly. We wanted to be in the fresh air. Now we are risking our lives, although the windows are open.

Aaron van Wirdum Risking our lives for you, dear listener.

Sjors Provoost That's right.

Aaron van Wirdum So, you better enjoy.

Sjors Provoost Indeed. Okay.

Aaron van Wirdum We're going to discuss Taproot today. We're going to dive head first into technical topics, I guess. Well, the second episode, but Taproot is one of the biggest technical projects in development today for Bitcoin. This week, there was a lot of discussion about Taproot activation. How are we going to activate this thing, if we're going to activate it? We're not actually going to get into that this episode. This episode, we're going to get into Taproot itself first. So what is it? Why is it interesting? What does it do? I wrote about Taproot myself at one point for Bitcoin Magazine. When I wrote about Taproot, I sort of cut it into several pieces to make it sort of easy to understand, I think. At least it seemed to sort of work. People seem to like that article. So we're going to do something similar for this podcast. We're sort of going to cut Taproot into... A couple of different parts, and then hopefully that will make it clear why it works as a whole.

Sjors Provoost All right.

Aaron van Wirdum Right? Are you good to go?

Sjors Provoost I'm ready. What's part one?

Aaron van Wirdum Part one. Part one is pay to script hash.

Sjors Provoost Okay.

Aaron van Wirdum Which was itself a protocol upgrade, which activated on Bitcoin. I'm pretty sure it was 2012. So let's get into what it is. Do you want to take a lead?

Sjors Provoost Yes, I will. Okay, so when you want to receive Bitcoin... You tell the other person how to send that Bitcoin, and you do that by adding some constraints.

Aaron van Wirdum Right, which sounds like a bad thing.

Sjors Provoost But it's not. It's an awesome thing. Constraints are great. So basically, people tend to think about a wallet, and it's not really a well-chosen word, because it's like a wallet, but everybody can touch whatever is inside your wallet. And so the constraint that people tend to add is, only I can spend these coins.

Aaron van Wirdum Right. Or to be more precise, these coins can only be spent if the transaction includes a signature that's made with this specific public key.

Sjors Provoost Right. So what you do is you tell the other person, here's my public key or the hash of the public key, and put that on the blockchain with the note on it that only the owner of that public key can spend it. And that's what you mean by sending to me. So you're not really... sending me a file or anything. You're just publishing something on the blockchain that says, whoever has this public key can now spend these coins. And that happens to be the recipient's public key.

Aaron van Wirdum Right. So that's a very common type of constraint. There are all sorts of other types of constraints, for example.

Sjors Provoost Right. Because this constraint is expressed as a script and a script can say a lot of different things. It could also say, well, I can spend this, but my mom also needs to sign it. But after 35 years, maybe I can sign it alone.

Aaron van Wirdum Yeah, so it's possible to send bitcoins to someone or to put it differently to receive bitcoins and do this under certain constraints. And these can be multiple constraints.

Sjors Provoost Yes.

Aaron van Wirdum So either... me and my mom have to sign it or I can send it alone after 35 years or my mom can sign it alone can spend it alone if she has some sort of secret you know which I could put on my will or I'm just sort of thinking out loud here but you can have several different constraints and if you want to spend the money you only need to fulfill one of these constraints and you can sort of pick one and that's the one you publish that's the one that the blockchain and the world will recognize as the one it's using out of several that it could have used

Sjors Provoost Yeah, but to go back to why script hash, because it's paid to script hash, not paid to script. If I want to receive coins from you, I would have to tell you exactly what script to use. And it's kind of weird, because now I'm telling you how I want to spend my coins. And if this was put in an address, it would be a very long address.

Aaron van Wirdum Yes, and not only how you want to spend your coins, but all the different ways in which your coins could potentially be spent, even if you don't use them.

Sjors Provoost Yes. So the idea is now instead of sending to the script, you send to the hash of the script. So you're giving me, because you want money from me, you're giving me the hash of your script, which is always the same length and happens to be the same length of a normal address. So the address will start with a 3. rather than a one. But otherwise, it looks kind of the same. And for you, you just copy-paste it, put it in your Bitcoin wallet, send money to it, and it works. Now, when I want to spend that money... Now I need to reveal the actual script, but that's my wallet that has to do that, so I don't have to bother anyone else with the complexity of remembering what the script was and correctly sending to it.

Aaron van Wirdum Yes. Yeah, I was skipping ahead one step just now, but that's the point we're trying to explain here, is that if you receive money, you only got to share a hash. The person that's sending you doesn't need to care what this hash actually hides.

Sjors Provoost Right.

Aaron van Wirdum And then only when you spend the coins do you need to reveal... the different ways in which you could have spent it, or the single way in which you could have spent it, whatever.

Sjors Provoost And so from a privacy point of view, that's much better than immediately putting the script on the chain, but it is still unfortunate that when you're spending, you have to reveal all these other options, because maybe I'd rather not reveal the world what my backup plan was.

Aaron van Wirdum Right, that's the step I was sort of skipping ahead to, which is, yes, if you are spending the coins... alone after 35 years, then their whole world doesn't need to know that you could have also spent it with your mom. Like why do they need to know that? There's no reason for them to know.

Sjors Provoost And much more importantly, if I could have spent it, if I spent it with my mom, the whole world should not have known that they could have, you know, waited 35 years and stolen it.

Aaron van Wirdum By kidnapping you or something.

Sjors Provoost Whatever.

Aaron van Wirdum Yeah. Okay. So the point is anyways, like regardless of specific examples, the point is once you spend money, You should only have to reveal the solution you're using, not all of the other options.

Sjors Provoost Now, if only there was a way to do that.

Aaron van Wirdum If only, Sjors.

Sjors Provoost Aaron. Wouldn't that be great? Tell us about this amazing invention.

Aaron van Wirdum So, for the past couple of years, this has been in the works for a couple of years.

Sjors Provoost You want to get to MAST, right?

Aaron van Wirdum Exactly. Yes, we want to get to MAST. For a couple of years, there was this idea called MAST, which stands for Merkleized Abstract Syntax Tree.

Sjors Provoost That's right. Merkleized Abstract Syntax Tree.

Aaron van Wirdum Perfect. This is essentially a Merkle tree of... Well, of hashes and therefore of the different ways to spend Bitcoin. So of the scripts. So a Merkle tree, are you going to explain it or should I?

Sjors Provoost I'll explain it once and then you'll correct my explanation. Because it's kind of hard to wrap your head around it. But the idea is that it's basically just, you could see it as a list. There might be eight conditions. But instead of, you don't want to show all eight of those conditions. So what you do is you group them in a tree. You put, well, eight of them at the bottom. Then you put... Each of them, you combine them. So then you have four. And each of those four, you combine them. So you have two. And then you combine those two, and you have one. So that's your pyramid.

Aaron van Wirdum Yes, and by combine, you mean hash.

Sjors Provoost You hash, exactly.

Aaron van Wirdum So you have hashes already of the scripts, of the conditions to spend your coins. These are hashed. And then you... bundle each of the eight hashes in this example into couples. So now you have four couples of hashes. And these are themselves hashed. So now you have four hashes. And these are couples. And then they are hashed. So then you have two hashes. And these are couples and hashed. Well, they're couples. It's two left. So that's one couple. You hash them. And they have one hash left. And this is the hash you share. And that's where the coins are spent to. In this case, the coins are sort of spent to this hash tree.

Sjors Provoost Yeah, and basically what you do is when you want to spend it, you say, this is the part of the tree that I want to spend, which could just be a number. And then you give that script, plus you give the neighbor script, because they come in pairs. And you give a hash of every other point in the tree. So if the tree is four high, you need to give four hashes and a script, which is a lot less than all eight of them. And you keep everything else secret. So you still prove that you didn't change the script. Now, Merkle trees are very common, of course. They're used in blocks, too. For the blocks themselves, they were used for file sharing, BitTorrent, all those sort of things. They all have these little chunks, and you can just ask for one chunk, and you know for sure that the chunk is actually part of the original file and not some made-up thing.

Aaron van Wirdum Yeah. So if I want to simplify that... By quite a bit, then it just means you only reveal the script you care about. You only reveal the scripts that you're using to spend the coins. The rest remains hashed. You just add some extra data to prove that it was in that tree somewhere.

Sjors Provoost Yeah, and it scales very nicely, so you could have millions of scripts, potential scripts, but in order to reveal any one of those millions, you don't need to reveal a lot of extra data.

Aaron van Wirdum Would it literally scale that well, millions? Would that be possible?

Sjors Provoost I don't know. There's probably a limit to it, but a million is two to the power of 20. So that's 20 layers of the, roughly.

Aaron van Wirdum Right.

Sjors Provoost So that's still big because you'd have to reveal 20 times 32 bytes, I think. So that's 600 bytes. So you probably don't want to have millions of options. But yeah, it's not too bad.

Aaron van Wirdum Is it doable or not?

Sjors Provoost I don't know. You'd have to ask me that before the podcast and I can look up the answer. Or we could pause again and break another computer and we'll be back.

Aaron van Wirdum Fair enough. Anyways, you can hide a lot of...

Sjors Provoost You can hide a lot of...

Aaron van Wirdum So that's good for privacy, like we mentioned. So yeah, the other thing you're mentioning now is it's good for scale as well. Because you don't need to include all of the possible scripts into the blockchain. The blockchain is a scarce resource. It costs a lot of fees to include all of that. Even if you're only including it when spending, you still got to pay all of these fees. With something like MAST, you can keep the vast majority of it hidden. It makes it much cheaper as well as private.

Sjors Provoost Great. And this could have just been another opcode, so another instruction in the script, which has been debated for quite a while. But in comes magic.

Aaron van Wirdum Just wouldn't it be great if we could hide that we're even using MAST itself?

Sjors Provoost Exactly. Because there is a so-called ultimate condition, which is that everybody agrees. So if everybody agrees, everybody signs, you don't have to reveal that there was a script.

Aaron van Wirdum Yeah. So let's take the example.

Sjors Provoost But how would you do that?

Aaron van Wirdum Okay. Yeah. So let's take the example we just had where you're receiving coins and it's you and your mom. But after 35 years, you can spend it on your own.

Sjors Provoost Right.

Aaron van Wirdum Or she can spend it if she has some sort of secrets that you've put in your will. I don't know. That was something I just made up.

Sjors Provoost Yeah.

Aaron van Wirdum This means that in this smart contract, because that's essentially what we have here, that's what it's called, there is this option where your mom and, or was it my mom or your mom?

Sjors Provoost Whatever. Yeah. Both our moms.

Aaron van Wirdum Your mom and yourself are in agreement and both of you agree, just let's spend this money so you don't have to wait 35 years and you don't have to include the secret. In most smart contracts, there's almost always there is or should be this condition where, okay, everyone who's involved with this smart contract just agrees that let's spend the money.

Sjors Provoost That's right.

Aaron van Wirdum That's almost always the case or it should be the case.

Sjors Provoost Yeah, almost always, yeah.

Aaron van Wirdum Right. So, are we skipping?

Sjors Provoost So it would be nice if there was a way to express that, right? It would be nice if you could just not show any of these scripts, not show a whole tree, but just show a signature. And the way you could do that is by tweaking an existing – is by tweaking a public key. So instead of saying send this to my public key, you roughly would say send this to my public key plus my mom's public key plus this MAST key. So the idea is that you can tweak keys, and it's very oversimplified because cryptography is very subtle, but in theory you can add up keys, and then you can also add up signatures, and it kind of looks to the outside world as if it's just a regular signature. And so you can hide a bunch of stuff in there. The problem, however, is that in an ideal world, you can just add these signatures, but in practice we have this... quite a difficult signature algorithm called ECDSA.

Aaron van Wirdum In Bitcoin.

Sjors Provoost Yes. And there was something before that, which is called Schnorr.

Aaron van Wirdum Schnorr signatures.

Sjors Provoost Yes. Mr. Schnorr is a German professor, I believe, who invented a really nice way to do digital signatures. Unfortunately... he patented it. And so nobody wanted to use it. And so a bunch of lawyers, basically, together with engineers and cryptographers, tried to figure out if there was a way to maim Schnorr's algorithm so far that it would legally not fall under the patent, but still kind of work. And that is what is ECDSA. And that got really standardized. You know, the NSA published some nice numbers for it. And OpenSSL, the cryptographic library that many programs use. which is also maintained, I think, by just one person. It used that. And so when Satoshi, probably when he was working on Bitcoin, he had to pick a curve, a cryptographic curve, and he just picked something from OpenSSL, namely ECDSA, and not Schnorr because he, first of all, he knew it was patented or maybe just the patent maybe just ran out. But second, there was just no implementation of it. And it's much easier to just use a library because writing your own cryptography is really, really hard. And whatever this massive team was that Satoshi supposedly had did not have a cryptographer that could do that.

Aaron van Wirdum So the nice thing about Schnorr, I guess, if I would put it in one sentence, is that you can perform math on it.

Sjors Provoost Yeah, you can add signatures in Schnorr trivially. Whereas with ECDSA, because of this maiming that they did to get around the patent, you can kind of add signatures if you spend a lot of time and you're very careful. But it's very complicated.

Aaron van Wirdum If you simplify it a lot, I would say, or this is sort of how it was explained to me, I think, at some point. Simplify it a lot. Or maybe I just made this up at some point. It's also possible. Anyways, the sort of simplified example is that a public key plus one would correspond to a private key plus one.

Sjors Provoost Exactly.

Aaron van Wirdum Like a signature plus one. Like you can do math stuffy things with it.

Sjors Provoost Yes.

Aaron van Wirdum And then it still makes sense.

Sjors Provoost Yeah.

Aaron van Wirdum Right?

Sjors Provoost Well, a public key plus another public key. And then if you take a...

Aaron van Wirdum And it can be combined with the private key plus the private key here.

Sjors Provoost Exactly. And the signatures can be added. All of it can be added.

Aaron van Wirdum Yeah.

Sjors Provoost But not with ECDSA. Or at least not easily with ECDSA.

Aaron van Wirdum But with Schnorr, it still works. Bitcoin developers have been wanting to add Schnorr to the protocol anyways. This was a project even before Taproot was thought of. People were thinking of adding Schnorr because you can do all sort of cool stuff with it. Yeah. And then at some point, Greg Maxwell... The former Bitcoin Core developer, I guess we'll call him.

Sjors Provoost He's still a Bitcoin Core developer. He still reviews code.

Aaron van Wirdum He's still contributing?

Sjors Provoost Yeah, yeah. He mostly reviews code, but he's there.

Aaron van Wirdum Okay, well, that's definitely a contributor then. I thought he was sort of...

Sjors Provoost No, he's not loud on Twitter because he's not on Twitter, but that doesn't mean he's not there.

Aaron van Wirdum No, I thought he kind of retired, or he was just lurking on IRC or something. Anyways, he came up with this idea to use Schnorr in this very clever way in combination with MAST, and that brings us to Taproot.

Sjors Provoost Yes.

Aaron van Wirdum Right?

Sjors Provoost So basically, because you can add anything to a public key, you can also add a script to a public key, because a script is essentially just a number, and a private key is essentially just a number. So you can just add numbers.

Aaron van Wirdum Yeah, or a hash.

Sjors Provoost Well, a hash is a number, too. And a Merkle root is also just a number. In fact, everything is a number. But yeah.

Aaron van Wirdum Can I just explain what's cool about this?

Sjors Provoost Yeah.

Aaron van Wirdum So let's say we've been taking this example with me and my mom or you and your mom. Either way, someone and his mom.

Sjors Provoost Yeah. Well, let's simplify that example because that's multi-signature. Let's just say it's just you. Or if you forgot your own key, you can use some sort of secret, which is a very bad idea. But let's say you would do that. But if you, so your script, your MAST would contain two options. Either it's you, your signature, or it's this secret piece of information that you wrote down somewhere else without a signature. Like I said, do not do this, but imagine it was that. If you know your key, if you still have your private key, it's kind of a shame to reveal the fact that you could have revealed the secret number. And so what you can do now is in Taproot, thanks to Schnorr, you can actually take this MAST and hide it inside your public key. And then when you're signing the actual transaction, you are just signing a public key and you're not even revealing the fact that there is a Taproot out there. you're basically just ignoring it because you've added, you just add the hash to your private key and you've added the hash to the public key and nobody needs to know.

Aaron van Wirdum Yes. For the outside world, they don't see any difference between tweaked public key and...

Sjors Provoost Right.

Aaron van Wirdum The original public key. So if you've tweaked your public key with this MAST structure, it looks the same to the rest of the world.

Sjors Provoost Exactly. If you do want to use this MAST structure, what you do is instead of revealing the tweaked key, you reveal the original key and you reveal the script, one of them.

Aaron van Wirdum Which you use to tweak.

Sjors Provoost Yes. And therefore, the person verifying it can take that script, calculate the hash, calculate the other hash. add it up to the public key. Now they know that they can see that that's the tweaked public key and they can see that the signature is valid for the whole thing. So it's kind of nice. You can choose to not reveal anything, not even the tree itself, or you can reveal any part of the tree. So this is much better. It's also more space efficient. But it also means that if you're sending coins to somebody, it doesn't matter if you are sending to a single person with just one key or some super complicated exchange or some other condition. It all looks the same.

Aaron van Wirdum Or me and my mom.

Sjors Provoost Yes.

Aaron van Wirdum I do want to give that example because just for extra clarity. Like if I would accept Bitcoin with my mother with this, using this trick, then we would combine our public keys.

Sjors Provoost Yes.

Aaron van Wirdum And then we would also have a MAST structure that says, okay, I can... which includes I can spend it after 35 years and my mom can spend it with the secret number. That's all in the MAST structure.

Sjors Provoost Yes.

Aaron van Wirdum And we have the Merkle root for that. Now, if we want to spend the coin, we both agree. So we just both sign, combine the signature and tweak it with this MAST Merkle root. And therefore, what we publish to the outside world just looks like a regular signature spending the regular public key, which we... which was always public. And the rest of the world would just think, okay, well, that makes total sense. We'll accept that. Now, if my mom can't sign for whatever reason, or if I can't sign for whatever reason, and she has that secret, then let's take the example where my mom can't sign for some reason. And five years pass. At that point, I reveal that it was actually a tweaked public key. I reveal the tweak. I show the world, look, this hash, this MAST structure was hidden. Under this hash, which I used to tweak, the rest of the world can look at that and see, yep, that adds up, the math makes total sense, that was what you were always doing, we just never were able to see it, and yep, 35 years have passed, so you're... totally allowed to spend this money now on your own.

Sjors Provoost Exactly. And so that condition is only revealed if you actually use it. And otherwise it would have forever been a secret unless somebody hacked your wallet.

Aaron van Wirdum Exactly. So as long as my mom is able to sign and I'm able to sign, no one ever needs to know that there were other ways to spend this coin. So that's great for privacy, fungibility.

Sjors Provoost Yeah, and so this tweaking, this ability to hide is Schnorr, and the fact that you can have multiple conditions and only reveal one of those conditions, that is MAST. But this magic is combined, like Captain Planet, and now you can do all these things. This is why Taproot is a fairly large proposal.

Aaron van Wirdum What's that sentence?

Sjors Provoost It was Earth, Wind, Fire, blah, blah, blah. Captain Planet. So combining all this...

Aaron van Wirdum Is that the next point, or did we forget something?

Sjors Provoost So people can use this for the complicated scenarios we described. Is there anything new that's possible now? Well, a couple of things. One is you can do multi-signatures without script because you can actually just combine multiple signatures.

Aaron van Wirdum Right.

Sjors Provoost And there's some protocols for that.

Aaron van Wirdum Different trees, different parts of the tree which allows different people to...

Sjors Provoost No, not even the tree. Even without using the MAST structure, the taproot itself, It can be one signature, but it can also be a multisig, but just an N-of-N multisig. Because there's just general math that you can use to combine signatures. And that was sort of possible. It's called threshold signatures in ECDSA. But there's lots of papers about it, and it's all very complicated. But with Schnorr, it should be slightly easier. And by easier, I mean there's still only five people on the planet who can understand the math. But they can write tools.

Aaron van Wirdum Collaborative spend that's what we're calling it?

Sjors Provoost Yeah.

Aaron van Wirdum that can have a sort of multi-sig n of m kind of?

Sjors Provoost So the easiest, I think there's a proposal called MuSig, which does, what it does is it adds the signatures.

Aaron van Wirdum M-U-S-I-G.

Sjors Provoost Exactly. It combines signatures.

Aaron van Wirdum M-U-S-I-C. Anyways, go on.

Sjors Provoost So to the outside world, it will look like a regular signature. It just looks like a regular public key and a regular signature, but really it's a combination of public keys. that are then all signing, and you can add them up. And in theory, I believe you can also do threshold things with that that will still look like a single signature and a single public key, but actually it's two out of three signatures. And that stuff is, you don't have to bake it into the protocol. So as long as you support Schnorr, then somebody can come up with a way to combine these signatures, and to the outside world, it will just look the same. So that's not actually part of the protocol, but that math. it still needs a lot of verification and people need to make tools around it. But Taproot enables that sort of stuff.

Aaron van Wirdum Right. What I really like about Taproot is how it makes Lightning more private. like opening

Sjors Provoost Yes.

Aaron van Wirdum and closing channels. All that stuff just looks like regular transactions.

Sjors Provoost Yes.

Aaron van Wirdum There's no way to tell that people are using Lightning at all. Right?

Sjors Provoost Correct. Because Lightning, again, is an example of usually both parties agree and both sides of the channel agree on an operation. And for the rest of the world, it will just look like a normal transaction. But if they disagree, there's all these additional timeout conditions. Those can be nicely hidden inside the taproot. So that's very nice. And the other benefit is that if you have a payment on Lightning, it goes from hop to hop to hop. Right now, you're revealing a pre -image, which is just something that you hash. And that thing is the same for every hop. So somebody who can see all the nodes can see that one payment belongs to the same person.

Aaron van Wirdum Or if you're like a spy on a route, on different parts of the route, you can see, you can sort of connect.

Sjors Provoost Yes. And then there's some exploits based on that, actually. So that would be harder now. That would be more difficult because you can, instead of using a pre -image in a hash, you just use essentially public keys and private keys. So everything would just be points on the elliptic curve that you're adding up. And then every point along the route can tweak the number slightly differently. So to an outside observer that does not know the private keys, they just look like random numbers. Now they can still correlate the amounts, so there's still some problems remaining. But again, it's an increase in privacy, which is very nice. Yeah.

Aaron van Wirdum Yeah, I think one point I would say about Taproot is that it seems to me at least, but I'm probably going to be proven wrong on this. It seems to me like all of the things we want to do with Taproot are technically possible already. It's just right now it's much... It's just not very privacy-friendly or it costs a lot of data.

Sjors Provoost Some things are not technically possible because 16, I think the maximum for multi-sig is 15 right now.

Aaron van Wirdum Right.

Sjors Provoost So you can do infinitely large multi-sigs either by adding these signatures, as I just described, but also just by making a very large tree and you just put all the combinations in.

Aaron van Wirdum Right.

Sjors Provoost So you can, yeah, you can do, you can strictly do more, but I would also say that. For most people, you might not notice the difference, except your privacy is just going to be slightly better. And as these advanced options come along, you'll just use them, but you won't notice them. So I agree, it's not as dramatic. SegWit, when it was launched, SegWit 0, by the way, because SegWit is versioned. Taproot is SegWit 1, or uses SegWit 1. When that came along, it enabled Lightning, because Lightning was an absolute pain in the ass to do without SegWit. There were all these papers with trusted hardware modules and all sorts of weird stuff. It was really hard. And there came SegWit, and now we have Lightning. Now Taproot, again, improves things about Lightning. There's other software proposals that can improve things about Lightning. And those improvements should not be trivialized, because I think when Lightning gets, if it gets real big... and is under attack all the time, some of these things that we can currently ignore can't be ignored, and then it's very nice to have a bigger toolbox that can deal with all these problems.

Aaron van Wirdum Is Taproot technically done, ready? Do you know this? Is it still a work in progress, or is it at this point sort of...

Sjors Provoost Well, if you're saying that people are discussing deployment options, and I guess it's further along, in my own work reviewing Bitcoin Core stuff, I have not yet... reviewed the pull request that does any of the Taproot stuff I know that there is one I don't know if it's ready to review yet or whether it's still in like draft we're basically making a lot of changes to the wallet itself. We've been almost completely rewriting it with a couple of people to make it much more flexible. And that flexibility is a prerequisite for being able to add something like Taproot. Because what happened with SegWit is it was added to the blockchain, but the core wallet was not able to properly use SegWit. for I think at least a year after Segwit was released, which is kind of embarrassing. So hopefully this time the wallet will just be completely ready for all the magic, and then we just have to wait for the software to activate. So how far it is, I don't know. I have not followed all the mailing lists in detail. I went to a workshop in London by Optech in February, where we did a whole day of going through the protocol and all the little script things and signatures and how that all works, which was super useful. They have a Python workbook online too. I recommend reading it if you want to learn. And they've done review clubs where lots of people looked at it. But after that, I have kind of not paid as much attention to it. Partially because there was this little virus thing that distracted everybody. Partially because it's a huge thing. So for my own review habits, I find it easy to review smaller things as they come in. And they haven't been coming in yet. I'm not sure how to handle that.

Aaron van Wirdum And then the next question is how it's going to be activated.

Sjors Provoost Yeah.

Aaron van Wirdum We'll discuss.

Sjors Provoost Maybe next week.

Aaron van Wirdum Maybe the next episode.

Sjors Provoost Maybe another time.

Aaron van Wirdum No promises.

Sjors Provoost We'll see. Is this when you do the sign-off?

Aaron van Wirdum I think this is the part where you do the sign-off.

Sjors Provoost This was episode two.

Aaron van Wirdum Of the Van Wirdum Sjorsnado podcast.

Sjors Provoost Thank you for listening.

Aaron van Wirdum There you go.