Public key recovery for EC leaves in P2MR (BIP-360)

[sipa]

@starius

If there is a tree with related EC keys P and P' = P + t⋅G in different leaves of the same tree and e does not commit to the control block (i.e. to the path in the tree), then it is possible to forge a signature for P' given a valid signature for P.

Right, nice catch.

@starius

UPD. I assume that in the P2TR case in the table there is only a single script leaf, because the key path is the key spend, not a leaf. For a literal 2-leaf P2TR output, the script spend would be 32 bytes larger.

Yeah, I just meant an output that allows spending through either a key or a script path. Whether that’s tweak-based of tree-based is an implementation detail of the scheme.