WEBVTT - Automatic transcript; recognition may contain errors. Reviewed for technical wording and speaker labels. Times match the published episode. 00:00:06.540 --> 00:00:09.880 Live from Utrecht, this is the Van Wirdum Sjorsnado. 00:00:10.440 --> 00:00:14.560 Yes, podcast. I'm very happy we're not actually doing this live. 00:00:14.960 --> 00:00:19.340 Yeah, indeed. I just killed my laptop, apparently, it seemed like. 00:00:19.520 --> 00:00:21.460 You may have killed it. 00:00:21.460 --> 00:00:24.520 We were happy recording this podcast, and then I dropped a glass of water on 00:00:24.520 --> 00:00:26.850 my... laptop, and now it's not working anymore at all. 00:00:27.030 --> 00:00:30.450 Which means we're not sure if the first half of this recording was there or not, 00:00:30.550 --> 00:00:32.150 so we're just going to do it again. 00:00:32.370 --> 00:00:33.170 Let's start over. 00:00:33.330 --> 00:00:34.170 So this better be awesome. 00:00:34.410 --> 00:00:35.210 We're doing great. 00:00:36.850 --> 00:00:38.470 We're never going to beat what we did. 00:00:39.710 --> 00:00:45.390 Yeah, that was an amazing podcast. Maybe one day we'll sell it on DVD, 00:00:45.870 --> 00:00:50.310 that first 15 minutes, manually signed, and you can buy it. 00:00:50.770 --> 00:00:53.690 We have to recover my hard drive. 00:00:54.200 --> 00:00:58.300 Yeah, it should be possible. All right. How are you doing? 00:00:58.900 --> 00:01:04.340 Not bad, not bad. I'm still slightly in shock, but I think I'll... 00:01:05.010 --> 00:01:07.790 I'm fine, I'm fine. We can do this podcast now. 00:01:07.950 --> 00:01:12.070 I think so. And we've practiced this podcast three or four times now, so I think... 00:01:12.070 --> 00:01:13.330 So we moved inside this time? 00:01:13.730 --> 00:01:13.910 Yep. 00:01:13.950 --> 00:01:18.870 We were getting a lot of complaints for... For background noise, I guess 00:01:18.870 --> 00:01:22.350 rightfully so. We were inside because of Corona. That was sort of the reason we 00:01:22.350 --> 00:01:23.070 were inside, right? 00:01:23.090 --> 00:01:24.470 We were outside because of Corona. 00:01:24.650 --> 00:01:25.450 That's what I mean. 00:01:25.510 --> 00:01:29.970 Exactly. We wanted to be in the fresh air. Now we are risking our lives, although 00:01:29.970 --> 00:01:30.730 the windows are open. 00:01:32.030 --> 00:01:33.850 Risking our lives for you, dear listener. 00:01:34.250 --> 00:01:34.790 That's right. 00:01:35.090 --> 00:01:36.430 So, you better enjoy. 00:01:36.910 --> 00:01:38.350 Indeed. Okay. 00:01:38.830 --> 00:01:44.670 We're going to discuss Taproot today. We're going to dive head first 00:01:44.670 --> 00:01:49.730 into technical topics, I guess. Well, the second episode, but Taproot is one of 00:01:49.730 --> 00:01:53.190 the biggest technical projects in development today for Bitcoin. 00:01:54.670 --> 00:02:00.170 This week, there was a lot of discussion about Taproot activation. How are we 00:02:00.170 --> 00:02:03.710 going to activate this thing, if we're going to activate it? We're not actually 00:02:03.710 --> 00:02:07.350 going to get into that this episode. This episode, we're going to get into 00:02:07.350 --> 00:02:12.710 Taproot itself first. So what is it? Why is it interesting? What does it do? 00:02:13.820 --> 00:02:19.020 I wrote about Taproot myself at one point for Bitcoin Magazine. When I wrote 00:02:19.020 --> 00:02:24.820 about Taproot, I sort of cut it into several pieces 00:02:24.820 --> 00:02:29.980 to make it sort of easy to understand, I think. At least it seemed to sort of 00:02:29.980 --> 00:02:33.600 work. People seem to like that article. So we're going to do something similar 00:02:33.600 --> 00:02:38.060 for this podcast. We're sort of going to cut Taproot into... A couple of 00:02:38.060 --> 00:02:42.940 different parts, and then hopefully that will make it clear why it 00:02:42.940 --> 00:02:44.600 works as a whole. 00:02:45.480 --> 00:02:45.840 All right. 00:02:46.020 --> 00:02:47.810 Right? Are you good to go? 00:02:48.050 --> 00:02:49.350 I'm ready. What's part one? 00:02:49.970 --> 00:02:53.890 Part one. Part one is pay to script hash. 00:02:54.630 --> 00:02:55.050 Okay. 00:02:55.650 --> 00:03:01.550 Which was itself a protocol upgrade, which activated on Bitcoin. I'm 00:03:01.550 --> 00:03:02.490 pretty sure it was 2012. 00:03:03.810 --> 00:03:07.730 So let's get into what it is. Do you want to take a lead? 00:03:08.420 --> 00:03:13.720 Yes, I will. Okay, so when you want to receive 00:03:13.720 --> 00:03:14.600 Bitcoin... 00:03:16.580 --> 00:03:20.960 You tell the other person how to send that Bitcoin, and you do that by adding 00:03:20.960 --> 00:03:21.820 some constraints. 00:03:22.380 --> 00:03:25.700 Right, which sounds like a bad thing. 00:03:25.960 --> 00:03:30.160 But it's not. It's an awesome thing. Constraints are great. So basically, people 00:03:30.160 --> 00:03:34.100 tend to think about a wallet, and it's not really a well-chosen word, because 00:03:34.100 --> 00:03:39.720 it's like a wallet, but everybody can touch whatever is inside your wallet. And 00:03:39.720 --> 00:03:44.000 so the constraint that people tend to add is, only I can spend these coins. 00:03:45.640 --> 00:03:51.380 Right. Or to be more precise, these coins can only be 00:03:51.380 --> 00:03:57.340 spent if the transaction includes a signature that's made 00:03:57.340 --> 00:03:58.660 with this specific public key. 00:03:58.780 --> 00:04:02.740 Right. So what you do is you tell the other person, here's my public key or the 00:04:02.740 --> 00:04:07.780 hash of the public key, and put that on the blockchain with the note on it that 00:04:07.780 --> 00:04:11.240 only the owner of that public key can spend it. And that's what you mean by 00:04:11.240 --> 00:04:15.800 sending to me. So you're not really... sending me a file or anything. You're just 00:04:15.800 --> 00:04:19.840 publishing something on the blockchain that says, whoever has this public key can 00:04:19.840 --> 00:04:23.220 now spend these coins. And that happens to be the recipient's public key. 00:04:23.380 --> 00:04:27.080 Right. So that's a very common type of constraint. There are all sorts of other 00:04:27.080 --> 00:04:29.000 types of constraints, for example. 00:04:29.300 --> 00:04:32.720 Right. Because this constraint is expressed as a script and a script can say a 00:04:32.720 --> 00:04:37.640 lot of different things. It could also say, well, I can spend this, but my mom 00:04:37.640 --> 00:04:42.420 also needs to sign it. But after 35 years, maybe I can sign it alone. 00:04:43.210 --> 00:04:48.550 Yeah, so it's possible to send bitcoins to someone or to put it differently to 00:04:48.550 --> 00:04:54.450 receive bitcoins and do this under certain constraints. And these can be multiple 00:04:54.450 --> 00:04:55.030 constraints. 00:04:55.450 --> 00:04:55.650 Yes. 00:04:55.850 --> 00:05:01.020 So either... me and my mom have to sign it or I can send it alone after 35 years 00:05:01.020 --> 00:05:06.680 or my mom can sign it alone can spend it alone if she has some sort of secret you 00:05:06.680 --> 00:05:10.260 know which I could put on my will or I'm just sort of thinking out loud here but 00:05:10.260 --> 00:05:14.700 you can have several different constraints and if you want to spend the money you 00:05:14.700 --> 00:05:18.300 only need to fulfill one of these constraints and you can sort of pick one and 00:05:18.300 --> 00:05:21.820 that's the one you publish that's the one that the blockchain and the world will 00:05:21.820 --> 00:05:25.540 recognize as the one it's using out of several that it could have used 00:05:25.650 --> 00:05:30.590 Yeah, but to go back to why script hash, because it's paid to script hash, not 00:05:30.590 --> 00:05:35.190 paid to script. If I want to receive coins from you, I would have to tell you 00:05:35.190 --> 00:05:39.550 exactly what script to use. And it's kind of weird, because now I'm telling you 00:05:39.550 --> 00:05:43.570 how I want to spend my coins. And if this was put in an address, it would be a 00:05:43.570 --> 00:05:44.410 very long address. 00:05:44.810 --> 00:05:48.610 Yes, and not only how you want to spend your coins, but all the different ways in 00:05:48.610 --> 00:05:51.510 which your coins could potentially be spent, even if you don't use them. 00:05:51.980 --> 00:05:57.900 Yes. So the idea is now instead of sending to the script, 00:05:58.100 --> 00:06:02.240 you send to the hash of the script. So you're giving me, because you want money 00:06:02.240 --> 00:06:06.080 from me, you're giving me the hash of your script, which is always the same 00:06:06.080 --> 00:06:09.860 length and happens to be the same length of a normal address. So the address will 00:06:09.860 --> 00:06:15.820 start with a 3. rather than a one. But otherwise, it looks kind of the same. And 00:06:15.820 --> 00:06:19.860 for you, you just copy-paste it, put it in your Bitcoin wallet, send money to it, 00:06:19.860 --> 00:06:24.180 and it works. Now, when I want to spend that money... Now I need to reveal the 00:06:24.180 --> 00:06:27.700 actual script, but that's my wallet that has to do that, so I don't have to 00:06:27.700 --> 00:06:31.420 bother anyone else with the complexity of remembering what the script was and 00:06:31.420 --> 00:06:32.700 correctly sending to it. 00:06:33.060 --> 00:06:37.460 Yes. Yeah, I was skipping ahead one step just now, but that's the point we're 00:06:37.460 --> 00:06:41.060 trying to explain here, is that if you receive money, you only got to share a 00:06:41.060 --> 00:06:44.780 hash. The person that's sending you doesn't need to care what this hash actually 00:06:44.780 --> 00:06:45.800 hides. 00:06:46.040 --> 00:06:46.360 Right. 00:06:46.480 --> 00:06:50.500 And then only when you spend the coins do you need to reveal... the different 00:06:50.500 --> 00:06:53.480 ways in which you could have spent it, or the single way in which you could have 00:06:53.480 --> 00:06:54.000 spent it, whatever. 00:06:54.300 --> 00:06:58.180 And so from a privacy point of view, that's much better than immediately putting 00:06:58.180 --> 00:07:02.120 the script on the chain, but it is still unfortunate that when you're spending, 00:07:02.440 --> 00:07:07.440 you have to reveal all these other options, because maybe I'd rather not reveal 00:07:07.440 --> 00:07:09.140 the world what my backup plan was. 00:07:09.400 --> 00:07:13.380 Right, that's the step I was sort of skipping ahead to, which is, yes, 00:07:14.780 --> 00:07:20.620 if you are spending the coins... alone after 35 years, then their whole world 00:07:20.620 --> 00:07:23.520 doesn't need to know that you could have also spent it with your mom. Like why do 00:07:23.520 --> 00:07:25.880 they need to know that? There's no reason for them to know. 00:07:25.920 --> 00:07:30.240 And much more importantly, if I could have spent it, if I spent it with my mom, 00:07:30.500 --> 00:07:33.600 the whole world should not have known that they could have, you know, waited 35 00:07:33.600 --> 00:07:35.360 years and stolen it. 00:07:36.050 --> 00:07:37.530 By kidnapping you or something. 00:07:37.890 --> 00:07:38.290 Whatever. 00:07:38.550 --> 00:07:43.050 Yeah. Okay. So the point is anyways, like regardless of specific examples, the 00:07:43.050 --> 00:07:44.710 point is once you spend money, 00:07:46.590 --> 00:07:51.070 You should only have to reveal the solution you're using, not all of the other options. 00:07:51.150 --> 00:07:53.050 Now, if only there was a way to do that. 00:07:53.730 --> 00:07:54.670 If only, Sjors. 00:07:54.950 --> 00:07:58.730 Aaron. Wouldn't that be great? Tell us about this amazing invention. 00:07:59.090 --> 00:08:02.690 So, for the past couple of years, this has been in the works for a couple of years. 00:08:02.730 --> 00:08:03.810 You want to get to MAST, right? 00:08:04.130 --> 00:08:08.460 Exactly. Yes, we want to get to MAST. For a couple of years, there was this idea 00:08:08.460 --> 00:08:13.340 called MAST, which stands for Merkleized Abstract Syntax Tree. 00:08:13.460 --> 00:08:16.040 That's right. Merkleized Abstract Syntax Tree. 00:08:16.300 --> 00:08:22.210 Perfect. This is essentially a Merkle tree of... Well, of hashes and therefore 00:08:22.210 --> 00:08:28.190 of the different ways to spend Bitcoin. So of the scripts. So a 00:08:28.190 --> 00:08:30.670 Merkle tree, are you going to explain it or should I? 00:08:31.030 --> 00:08:34.410 I'll explain it once and then you'll correct my explanation. Because it's kind of 00:08:34.410 --> 00:08:38.230 hard to wrap your head around it. But the idea is that it's basically just, you 00:08:38.230 --> 00:08:42.230 could see it as a list. There might be eight conditions. But instead of, you 00:08:42.230 --> 00:08:45.430 don't want to show all eight of those conditions. So what you do is you group 00:08:45.430 --> 00:08:50.290 them in a tree. You put, well, eight of them at the bottom. Then you put... Each 00:08:50.290 --> 00:08:54.630 of them, you combine them. So then you have four. And each of those four, you 00:08:54.630 --> 00:08:57.790 combine them. So you have two. And then you combine those two, and you have one. 00:08:57.850 --> 00:08:58.870 So that's your pyramid. 00:08:59.230 --> 00:09:01.090 Yes, and by combine, you mean hash. 00:09:01.290 --> 00:09:01.990 You hash, exactly. 00:09:02.250 --> 00:09:07.510 So you have hashes already of the scripts, of the conditions 00:09:07.510 --> 00:09:13.050 to spend your coins. These are hashed. And then you... 00:09:13.290 --> 00:09:18.190 bundle each of the eight hashes in this example into couples. So now you have 00:09:18.190 --> 00:09:21.950 four couples of hashes. And these are themselves hashed. So now you have four 00:09:21.950 --> 00:09:25.990 hashes. And these are couples. And then they are hashed. So then you have two 00:09:25.990 --> 00:09:31.070 hashes. And these are couples and hashed. Well, they're couples. It's two left. 00:09:31.210 --> 00:09:36.390 So that's one couple. You hash them. And they have one hash left. And this is the 00:09:36.390 --> 00:09:40.390 hash you share. And that's where the coins are spent to. In this case, the coins 00:09:40.390 --> 00:09:42.310 are sort of spent to this hash tree. 00:09:43.080 --> 00:09:46.380 Yeah, and basically what you do is when you want to spend it, you say, this is 00:09:46.380 --> 00:09:50.720 the part of the tree that I want to spend, which could just be a number. And then 00:09:50.720 --> 00:09:55.380 you give that script, plus you give the neighbor script, because they come in 00:09:55.380 --> 00:10:01.100 pairs. And you give a hash of every other point in the tree. So if the tree is 00:10:01.100 --> 00:10:04.940 four high, you need to give four hashes and a script, which is a lot less than 00:10:04.940 --> 00:10:08.760 all eight of them. And you keep everything else secret. So you still prove that 00:10:08.760 --> 00:10:11.780 you didn't change the script. Now, Merkle trees are very common, of course. 00:10:11.920 --> 00:10:15.400 They're used in blocks, too. For the blocks themselves, they were used for file 00:10:15.400 --> 00:10:19.260 sharing, BitTorrent, all those sort of things. They all have these little chunks, 00:10:19.280 --> 00:10:22.900 and you can just ask for one chunk, and you know for sure that the chunk is 00:10:22.900 --> 00:10:26.340 actually part of the original file and not some made-up thing. 00:10:26.580 --> 00:10:31.650 Yeah. So if I want to simplify that... By quite a bit, then it just means you 00:10:31.650 --> 00:10:35.570 only reveal the script you care about. You only reveal the scripts that you're 00:10:35.570 --> 00:10:40.350 using to spend the coins. The rest remains hashed. You just add some extra data 00:10:40.350 --> 00:10:42.370 to prove that it was in that tree somewhere. 00:10:42.650 --> 00:10:47.170 Yeah, and it scales very nicely, so you could have millions of scripts, potential 00:10:47.170 --> 00:10:51.250 scripts, but in order to reveal any one of those millions, you don't need to 00:10:51.250 --> 00:10:52.210 reveal a lot of extra data. 00:10:53.230 --> 00:10:57.470 Would it literally scale that well, millions? Would that be possible? 00:10:58.010 --> 00:11:02.930 I don't know. There's probably a limit to it, but a million is two to the power 00:11:02.930 --> 00:11:04.010 of 20. 00:11:05.280 --> 00:11:08.200 So that's 20 layers of the, roughly. 00:11:08.640 --> 00:11:08.980 Right. 00:11:09.340 --> 00:11:15.100 So that's still big because you'd have to reveal 20 times 32 bytes, I think. 00:11:15.380 --> 00:11:20.840 So that's 600 bytes. So you probably don't want to have millions of options. But 00:11:20.840 --> 00:11:21.680 yeah, it's not too bad. 00:11:22.840 --> 00:11:23.680 Is it doable or not? 00:11:24.200 --> 00:11:24.880 I don't know. 00:11:26.220 --> 00:11:29.940 You'd have to ask me that before the podcast and I can look up the answer. Or we 00:11:29.940 --> 00:11:34.020 could pause again and break another computer and we'll be back. 00:11:34.240 --> 00:11:34.900 Fair enough. 00:11:36.190 --> 00:11:38.070 Anyways, you can hide a lot of... 00:11:38.800 --> 00:11:39.900 You can hide a lot of... 00:11:39.900 --> 00:11:43.780 So that's good for privacy, like we mentioned. So yeah, the other thing you're 00:11:43.780 --> 00:11:47.720 mentioning now is it's good for scale as well. Because you don't need to include 00:11:47.720 --> 00:11:52.200 all of the possible scripts into the blockchain. The blockchain is a scarce 00:11:52.200 --> 00:11:56.660 resource. It costs a lot of fees to include all of that. Even if you're only 00:11:56.660 --> 00:12:00.560 including it when spending, you still got to pay all of these fees. With 00:12:00.560 --> 00:12:05.440 something like MAST, you can keep the vast majority of it hidden. It makes it 00:12:05.440 --> 00:12:07.520 much cheaper as well as private. 00:12:08.170 --> 00:12:12.450 Great. And this could have just been another opcode, so another instruction in 00:12:12.450 --> 00:12:17.550 the script, which has been debated for quite a while. But in comes magic. 00:12:18.370 --> 00:12:24.130 Just wouldn't it be great if we could hide that we're even using MAST 00:12:24.130 --> 00:12:24.550 itself? 00:12:25.090 --> 00:12:30.350 Exactly. Because there is a so-called ultimate condition, which is that everybody 00:12:30.350 --> 00:12:35.950 agrees. So if everybody agrees, everybody signs, you don't have to reveal that 00:12:35.950 --> 00:12:36.530 there was a script. 00:12:37.700 --> 00:12:39.300 Yeah. So let's take the example. 00:12:39.380 --> 00:12:40.040 But how would you do that? 00:12:40.700 --> 00:12:46.680 Okay. Yeah. So let's take the example we just had where you're receiving coins 00:12:46.680 --> 00:12:51.820 and it's you and your mom. But after 35 years, you can spend it on your own. 00:12:52.080 --> 00:12:52.420 Right. 00:12:52.520 --> 00:12:56.820 Or she can spend it if she has some sort of secrets that you've put in your will. 00:12:57.020 --> 00:12:58.420 I don't know. That was something I just made up. 00:12:58.700 --> 00:12:58.820 Yeah. 00:12:59.230 --> 00:13:03.630 This means that in this smart contract, because that's essentially what we have 00:13:03.630 --> 00:13:09.410 here, that's what it's called, there is this option where your mom and, or 00:13:09.410 --> 00:13:10.550 was it my mom or your mom? 00:13:10.830 --> 00:13:13.210 Whatever. Yeah. Both our moms. 00:13:13.570 --> 00:13:19.350 Your mom and yourself are in agreement and both of you agree, just let's spend 00:13:19.350 --> 00:13:24.550 this money so you don't have to wait 35 years and you don't have to include the 00:13:24.550 --> 00:13:30.270 secret. In most smart contracts, there's almost always there 00:13:30.330 --> 00:13:34.010 is or should be this condition where, okay, everyone who's involved with this 00:13:34.010 --> 00:13:36.810 smart contract just agrees that let's spend the money. 00:13:37.030 --> 00:13:37.330 That's right. 00:13:37.610 --> 00:13:39.830 That's almost always the case or it should be the case. 00:13:40.190 --> 00:13:41.530 Yeah, almost always, yeah. 00:13:41.890 --> 00:13:45.250 Right. So, are we skipping? 00:13:46.440 --> 00:13:50.520 So it would be nice if there was a way to express that, right? It would be nice 00:13:50.520 --> 00:13:54.640 if you could just not show any of these scripts, not show a whole tree, but just 00:13:54.640 --> 00:14:00.260 show a signature. And the way you could do that is by tweaking an existing – 00:14:00.260 --> 00:14:06.160 is by tweaking a public key. So instead of saying send this to my 00:14:06.160 --> 00:14:11.180 public key, you roughly would say send this to my public key plus my mom's public 00:14:11.180 --> 00:14:15.900 key plus this MAST key. 00:14:17.710 --> 00:14:21.930 So the idea is that you can tweak keys, and it's very oversimplified because 00:14:21.930 --> 00:14:26.810 cryptography is very subtle, but in theory you can add up keys, and then you can 00:14:26.810 --> 00:14:30.530 also add up signatures, and it kind of looks to the outside world as if it's just 00:14:30.530 --> 00:14:35.500 a regular signature. And so you can hide a bunch of stuff in there. The problem, 00:14:35.640 --> 00:14:40.500 however, is that in an ideal world, you can just add these signatures, but in 00:14:40.500 --> 00:14:46.150 practice we have this... quite a difficult signature algorithm called 00:14:46.150 --> 00:14:46.810 ECDSA. 00:14:48.030 --> 00:14:48.690 In Bitcoin. 00:14:48.970 --> 00:14:52.710 Yes. And there was something before that, which is called Schnorr. 00:14:53.550 --> 00:14:54.390 Schnorr signatures. 00:14:54.610 --> 00:14:59.530 Yes. Mr. Schnorr is a German professor, I believe, who invented a really nice way 00:14:59.530 --> 00:15:01.050 to do digital signatures. 00:15:03.030 --> 00:15:06.870 Unfortunately... he patented it. And so nobody wanted to use it. And so a bunch 00:15:06.870 --> 00:15:11.150 of lawyers, basically, together with engineers and cryptographers, tried to 00:15:11.150 --> 00:15:16.010 figure out if there was a way to maim Schnorr's algorithm so far that it would 00:15:16.010 --> 00:15:21.050 legally not fall under the patent, but still kind of work. And that is what is 00:15:21.050 --> 00:15:26.550 ECDSA. And that got really standardized. You know, the NSA published some nice 00:15:26.550 --> 00:15:31.630 numbers for it. And OpenSSL, the cryptographic library that many programs use. 00:15:32.240 --> 00:15:34.440 which is also maintained, I think, by just one person. 00:15:37.890 --> 00:15:42.810 It used that. And so when Satoshi, probably when he was working on Bitcoin, he 00:15:42.810 --> 00:15:46.090 had to pick a curve, a cryptographic curve, and he just picked something from 00:15:46.090 --> 00:15:52.030 OpenSSL, namely ECDSA, and not Schnorr because he, first of 00:15:52.030 --> 00:15:56.430 all, he knew it was patented or maybe just the patent maybe just ran out. But 00:15:56.430 --> 00:16:00.270 second, there was just no implementation of it. And it's much easier to just use 00:16:00.270 --> 00:16:03.610 a library because writing your own cryptography is really, really hard. 00:16:05.800 --> 00:16:09.960 And whatever this massive team was that Satoshi supposedly had did not have a 00:16:09.960 --> 00:16:11.140 cryptographer that could do that. 00:16:11.800 --> 00:16:16.480 So the nice thing about Schnorr, I guess, if I would put it in one sentence, is 00:16:16.480 --> 00:16:18.340 that you can perform math on it. 00:16:18.560 --> 00:16:23.220 Yeah, you can add signatures in Schnorr trivially. Whereas with ECDSA, because of 00:16:23.220 --> 00:16:27.420 this maiming that they did to get around the patent, you can kind of add 00:16:27.420 --> 00:16:32.190 signatures if you spend a lot of time and you're very careful. But it's very 00:16:32.190 --> 00:16:32.670 complicated. 00:16:32.910 --> 00:16:37.960 If you simplify it a lot, I would say, or this is sort of how it was explained to 00:16:37.960 --> 00:16:41.840 me, I think, at some point. Simplify it a lot. Or maybe I just made this up at 00:16:41.840 --> 00:16:47.360 some point. It's also possible. Anyways, the sort of simplified example is that a 00:16:47.360 --> 00:16:51.320 public key plus one would correspond to a private key plus one. 00:16:51.400 --> 00:16:51.660 Exactly. 00:16:51.860 --> 00:16:55.760 Like a signature plus one. Like you can do math stuffy things with it. 00:16:55.820 --> 00:16:55.980 Yes. 00:16:55.980 --> 00:16:57.220 And then it still makes sense. 00:16:57.700 --> 00:16:58.120 Yeah. 00:16:58.280 --> 00:16:58.520 Right? 00:16:58.740 --> 00:17:03.540 Well, a public key plus another public key. And then if you take a... 00:17:03.540 --> 00:17:06.560 And it can be combined with the private key plus the private key here. 00:17:06.640 --> 00:17:09.980 Exactly. And the signatures can be added. All of it can be added. 00:17:10.200 --> 00:17:10.300 Yeah. 00:17:10.440 --> 00:17:13.980 But not with ECDSA. Or at least not easily with ECDSA. 00:17:14.040 --> 00:17:16.680 But with Schnorr, it still works. Bitcoin developers have been wanting to add 00:17:16.680 --> 00:17:21.160 Schnorr to the protocol anyways. This was a project even before Taproot was 00:17:21.160 --> 00:17:24.700 thought of. People were thinking of adding Schnorr because you can do all sort of 00:17:24.700 --> 00:17:30.580 cool stuff with it. Yeah. And then at some point, Greg Maxwell... The 00:17:30.580 --> 00:17:33.040 former Bitcoin Core developer, I guess we'll call him. 00:17:33.040 --> 00:17:35.180 He's still a Bitcoin Core developer. He still reviews code. 00:17:35.260 --> 00:17:35.520 He's still contributing? 00:17:35.720 --> 00:17:40.080 Yeah, yeah. He mostly reviews code, but he's there. 00:17:40.240 --> 00:17:44.040 Okay, well, that's definitely a contributor then. I thought he was sort of... 00:17:44.110 --> 00:17:47.990 No, he's not loud on Twitter because he's not on Twitter, but that doesn't mean 00:17:47.990 --> 00:17:48.610 he's not there. 00:17:49.010 --> 00:17:52.410 No, I thought he kind of retired, or he was just lurking on IRC or something. 00:17:53.030 --> 00:17:58.830 Anyways, he came up with this idea to use Schnorr in this very clever way in 00:17:58.830 --> 00:18:01.350 combination with MAST, and that brings us to Taproot. 00:18:01.710 --> 00:18:02.130 Yes. 00:18:02.330 --> 00:18:02.490 Right? 00:18:02.630 --> 00:18:07.050 So basically, because you can add anything to a public key, you can also add a 00:18:07.050 --> 00:18:10.930 script to a public key, because a script is essentially just a number, and a 00:18:10.930 --> 00:18:14.490 private key is essentially just a number. So you can just add numbers. 00:18:14.970 --> 00:18:15.990 Yeah, or a hash. 00:18:16.270 --> 00:18:21.180 Well, a hash is a number, too. And a Merkle root is also just a number. In fact, 00:18:21.300 --> 00:18:23.000 everything is a number. But yeah. 00:18:25.470 --> 00:18:28.270 Can I just explain what's cool about this? 00:18:29.300 --> 00:18:29.520 Yeah. 00:18:29.720 --> 00:18:33.940 So let's say we've been taking this example with me and my mom or you and your 00:18:33.940 --> 00:18:36.160 mom. Either way, someone and his mom. 00:18:36.400 --> 00:18:39.980 Yeah. Well, let's simplify that example because that's multi-signature. Let's 00:18:39.980 --> 00:18:44.800 just say it's just you. Or if you forgot your own key, you can use some sort of 00:18:44.800 --> 00:18:50.140 secret, which is a very bad idea. But let's say you would do that. But if you, so 00:18:50.140 --> 00:18:56.040 your script, your MAST would contain two options. Either it's you, your 00:18:56.040 --> 00:19:00.920 signature, or it's this secret piece of information that you wrote down somewhere 00:19:00.920 --> 00:19:05.240 else without a signature. Like I said, do not do this, but imagine it was that. 00:19:05.900 --> 00:19:11.500 If you know your key, if you still have your private key, it's kind of a shame to 00:19:11.500 --> 00:19:14.940 reveal the fact that you could have revealed the secret number. And so what you 00:19:14.940 --> 00:19:20.300 can do now is in Taproot, thanks to Schnorr, you can actually take this 00:19:20.300 --> 00:19:25.760 MAST and hide it inside your public key. And then when you're signing the 00:19:25.760 --> 00:19:30.300 actual transaction, you are just signing a public key and you're not even 00:19:30.300 --> 00:19:34.130 revealing the fact that there is a Taproot out there. you're basically just 00:19:34.130 --> 00:19:38.570 ignoring it because you've added, you just add the hash to your private key and 00:19:38.570 --> 00:19:40.590 you've added the hash to the public key and nobody needs to know. 00:19:40.790 --> 00:19:45.470 Yes. For the outside world, they don't see any difference between tweaked public 00:19:45.470 --> 00:19:46.370 key and... 00:19:46.770 --> 00:19:47.250 Right. 00:19:47.570 --> 00:19:51.530 The original public key. So if you've tweaked your public key with this MAST 00:19:51.530 --> 00:19:53.790 structure, it looks the same to the rest of the world. 00:19:53.970 --> 00:19:58.430 Exactly. If you do want to use this MAST structure, what you do is instead of 00:19:58.430 --> 00:20:03.630 revealing the tweaked key, you reveal the original key and you reveal the script, 00:20:04.430 --> 00:20:05.850 one of them. 00:20:05.990 --> 00:20:06.990 Which you use to tweak. 00:20:07.290 --> 00:20:13.150 Yes. And therefore, the person verifying it can take that script, 00:20:13.490 --> 00:20:18.790 calculate the hash, calculate the other hash. add it up to the public key. Now 00:20:18.790 --> 00:20:21.410 they know that they can see that that's the tweaked public key and they can see 00:20:21.410 --> 00:20:26.130 that the signature is valid for the whole thing. So it's kind of nice. You can 00:20:26.130 --> 00:20:30.610 choose to not reveal anything, not even the tree itself, or you can reveal any 00:20:30.610 --> 00:20:34.570 part of the tree. So this is much better. It's also more space efficient. But it 00:20:34.570 --> 00:20:38.590 also means that if you're sending coins to somebody, it doesn't matter if you are 00:20:38.590 --> 00:20:43.730 sending to a single person with just one key or some super complicated exchange 00:20:43.730 --> 00:20:46.190 or some other condition. It all looks the same. 00:20:46.330 --> 00:20:47.110 Or me and my mom. 00:20:47.350 --> 00:20:47.750 Yes. 00:20:48.070 --> 00:20:53.410 I do want to give that example because just for extra clarity. Like if I would 00:20:53.410 --> 00:20:59.210 accept Bitcoin with my mother with this, using this trick, then we would combine 00:20:59.210 --> 00:21:00.170 our public keys. 00:21:00.370 --> 00:21:00.850 Yes. 00:21:01.010 --> 00:21:05.390 And then we would also have a MAST structure that says, okay, I can... which 00:21:05.390 --> 00:21:09.490 includes I can spend it after 35 years and my mom can spend it with the secret 00:21:09.490 --> 00:21:11.990 number. That's all in the MAST structure. 00:21:12.210 --> 00:21:12.450 Yes. 00:21:12.570 --> 00:21:17.050 And we have the Merkle root for that. Now, if we want to spend the coin, we both 00:21:17.050 --> 00:21:22.010 agree. So we just both sign, combine the signature and tweak it with this MAST 00:21:22.010 --> 00:21:26.930 Merkle root. And therefore, what we publish to the outside world just looks like 00:21:26.930 --> 00:21:32.180 a regular signature spending the regular public key, which we... which was always 00:21:32.180 --> 00:21:35.060 public. And the rest of the world would just think, okay, well, that makes total 00:21:35.060 --> 00:21:40.540 sense. We'll accept that. Now, if my mom can't sign for whatever reason, or if I 00:21:40.540 --> 00:21:44.980 can't sign for whatever reason, and she has that secret, then let's take the 00:21:44.980 --> 00:21:49.360 example where my mom can't sign for some reason. And five years pass. At that 00:21:49.360 --> 00:21:55.060 point, I reveal that it was actually a tweaked public key. I reveal the tweak. I 00:21:55.060 --> 00:22:00.000 show the world, look, this hash, this MAST structure was hidden. Under this hash, 00:22:00.220 --> 00:22:03.780 which I used to tweak, the rest of the world can look at that and see, yep, that 00:22:03.780 --> 00:22:08.100 adds up, the math makes total sense, that was what you were always doing, we just 00:22:08.100 --> 00:22:13.160 never were able to see it, and yep, 35 years have passed, so you're... 00:22:14.140 --> 00:22:16.740 totally allowed to spend this money now on your own. 00:22:16.980 --> 00:22:20.820 Exactly. And so that condition is only revealed if you actually use it. And 00:22:20.820 --> 00:22:24.100 otherwise it would have forever been a secret unless somebody hacked your wallet. 00:22:24.320 --> 00:22:28.640 Exactly. So as long as my mom is able to sign and I'm able to sign, no one ever 00:22:28.640 --> 00:22:32.020 needs to know that there were other ways to spend this coin. So that's great for 00:22:32.020 --> 00:22:33.520 privacy, fungibility. 00:22:34.180 --> 00:22:39.140 Yeah, and so this tweaking, this ability to hide is Schnorr, and the fact that 00:22:39.140 --> 00:22:42.240 you can have multiple conditions and only reveal one of those conditions, that is 00:22:42.240 --> 00:22:48.200 MAST. But this magic is combined, like Captain Planet, and now you can do all 00:22:48.200 --> 00:22:51.300 these things. This is why Taproot is a fairly large proposal. 00:22:51.700 --> 00:22:52.940 What's that sentence? 00:22:53.040 --> 00:22:57.440 It was Earth, Wind, Fire, blah, blah, blah. Captain Planet. 00:22:58.630 --> 00:23:00.630 So combining all this... 00:23:00.630 --> 00:23:03.270 Is that the next point, or did we forget something? 00:23:03.690 --> 00:23:08.390 So people can use this for the complicated scenarios we described. Is there 00:23:08.390 --> 00:23:14.190 anything new that's possible now? Well, a couple of things. One is you can 00:23:14.190 --> 00:23:19.950 do multi-signatures without script because you can actually 00:23:19.950 --> 00:23:21.430 just combine multiple signatures. 00:23:21.670 --> 00:23:21.890 Right. 00:23:22.310 --> 00:23:24.430 And there's some protocols for that. 00:23:24.910 --> 00:23:29.010 Different trees, different parts of the tree which allows different people to... 00:23:29.010 --> 00:23:33.270 No, not even the tree. Even without using the MAST structure, the taproot itself, 00:23:33.820 --> 00:23:38.560 It can be one signature, but it can also be a multisig, but just an N-of-N 00:23:38.560 --> 00:23:43.640 multisig. Because there's just general math that you can use to combine 00:23:43.640 --> 00:23:48.220 signatures. And that was sort of possible. It's called threshold signatures in 00:23:48.220 --> 00:23:53.940 ECDSA. But there's lots of papers about it, and it's all very complicated. But 00:23:53.940 --> 00:23:58.220 with Schnorr, it should be slightly easier. And by easier, I mean there's still 00:23:58.220 --> 00:24:02.730 only five people on the planet who can understand the math. But they can write tools. 00:24:02.730 --> 00:24:05.330 Collaborative spend that's what we're calling it? 00:24:05.330 --> 00:24:05.530 Yeah. 00:24:05.530 --> 00:24:10.090 that can have a sort of multi-sig n of m kind of? 00:24:10.450 --> 00:24:16.310 So the easiest, I think there's a proposal called MuSig, which does, what it 00:24:16.310 --> 00:24:19.070 does is it adds the signatures. 00:24:19.350 --> 00:24:20.610 M-U-S-I-G. 00:24:20.810 --> 00:24:23.470 Exactly. It combines signatures. 00:24:23.770 --> 00:24:25.630 M-U-S-I-C. Anyways, go on. 00:24:25.690 --> 00:24:29.310 So to the outside world, it will look like a regular signature. It just looks 00:24:29.310 --> 00:24:33.030 like a regular public key and a regular signature, but really it's a combination 00:24:33.030 --> 00:24:38.660