2.2-taptweak.ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "import random\n",
    "from io import BytesIO\n",
    "\n",
    "import util\n",
    "from test_framework.address import program_to_witness\n",
    "from test_framework.key import ECKey, ECPubKey, SECP256K1_ORDER, generate_key_pair, generate_bip340_key_pair, generate_schnorr_nonce, int_or_bytes\n",
    "from test_framework.messages import COutPoint, CTxIn, CTxInWitness, CTxOut, sha256\n",
    "from test_framework.musig import generate_musig_key, aggregate_schnorr_nonces, sign_musig, aggregate_musig_signatures, musig_digest\n",
    "from test_framework.script import CScript, CTransaction, OP_RETURN, SIGHASH_ALL_TAPROOT, TaprootSignatureHash, tagged_hash"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# 2.2 TapTweak\n",
    "\n",
    "* Part 1: Tweaking the public key; commitment schemes with tweaks\n",
    "* Part 2: Spending a (tweaked) taproot output along the key path\n",
    "* Part 3 (Case Study): contract commitments\n",
    "\n",
    "The linear property of BIP340 means that we can encode a commitment into a public key, and then reveal that commitment when signing with the private key. We do that by _tweaking_ the private key with the commitment, and using the associated _tweaked_ pubkey. When signing, we can reveal that the original keys were tweaked by the commitment.\n",
    "\n",
    "In part 1, we'll learn about how private/public key pairs can be tweaked, and how we can use that to create a secure commitment scheme. In part 2, we'll create a segwit v1 output and spend it along the key path, using a tweaked private and public key. Part 3 of this chapter is a case study, showing how pay-to-contract with tweaked keys can be used instead of OP_RETURN outputs to create timestamped commitments."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Part 1: Tweaking the public key\n",
    "\n",
    "Instead of using our original public key as the witness program, we use a tweaked public key.\n",
    "\n",
    "* `[01] [32B Tweaked Public Key]`\n",
    "\n",
    "Tweaking a public key means to alter it with a value (the tweak) such that it remains spendable with knowledge of the original private key and tweak.\n",
    "\n",
    "* `x` / `P`: Original private key / public key pair\n",
    "* `t` / `T`: Tweak value / tweak point\n",
    "* Output script: `[01] [P + T]` = `[01] [xG + tG]`\n",
    "* Spendable by the tweaked private key: `x + t`\n",
    "\n",
    "An observer cannot distinguish between a tweaked and untweaked public key."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Example 2.2.1: Signing with a tweaked keypair\n",
    "\n",
    "In this example, we generate a key pair as before, and then tweak both the private key and public key. We then sign with the tweaked private key and verify that the signature is valid.\n",
    "\n",
    "A _tweak_ is positive scalar value `t` where `0 < t < SECP256K1_ORDER`. There is an associated tweak point `T` such that `T = t*G`.\n",
    "\n",
    "The private key is tweaked by the tweak scalar: `x' = x + t` and the public key is tweaked by the tweak point: `P' = P + T`.\n",
    "\n",
    "The tweaked private key `x'` can be used to produce a valid signature for the tweaked pubkey `P'`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Generate a key pair\n",
    "privkey, pubkey = generate_bip340_key_pair()\n",
    "\n",
    "print(\"Private key: {}\\nPublic key: {}\\n\".format(privkey.secret, pubkey.get_bytes().hex()))\n",
    "\n",
    "# Generate a random tweak scalar 0 < t < SECP256K1_ORDER and derive its associated tweak point\n",
    "tweak = random.randrange(1, SECP256K1_ORDER)\n",
    "tweak_private = ECKey().set(tweak)\n",
    "tweak_point = tweak_private.get_pubkey()\n",
    "print(\"Tweak scalar: {}\\nTweak point: {}\\n\".format(tweak_private.secret, tweak_point.get_bytes().hex()))\n",
    "\n",
    "# Derive the tweaked private key and public key\n",
    "privkey_tweaked = privkey + tweak_private\n",
    "pubkey_tweaked = pubkey + tweak_point\n",
    "print(\"Tweaked private key: {}\\nTweaked pubkey: {}\\n\".format(privkey_tweaked.secret, pubkey_tweaked.get_bytes().hex()))\n",
    "\n",
    "# Sign the message with tweaked key pair and verify the signature\n",
    "msg = sha256(b'msg')\n",
    "sig = privkey_tweaked.sign_schnorr(msg)\n",
    "assert pubkey_tweaked.verify_schnorr(sig, msg)\n",
    "print(\"Success!\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### _Programming Exercise 2.2.2:_  Signing with a tweaked 2-of-2 MuSig key pair\n",
    "\n",
    "In this exercise, we tweak an MuSig aggregate pubkey, and then sign for it using the individual participant keys. The MuSig pubkey aggregation step is done for you.\n",
    "\n",
    "_Question: How is the tweak incorporated into the final signature?_"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Generate key pairs\n",
    "privkey1, pubkey1 = generate_key_pair()\n",
    "privkey2, pubkey2 = generate_key_pair()\n",
    "\n",
    "# Create an aggregate MuSig pubkey\n",
    "c_map, agg_pubkey = generate_musig_key([pubkey1, pubkey2])\n",
    "\n",
    "# Apply challenge factors to keys\n",
    "privkey1_c = privkey1 * c_map[pubkey1]\n",
    "privkey2_c = privkey2 * c_map[pubkey2]\n",
    "pubkey1_c = pubkey1 * c_map[pubkey1]\n",
    "pubkey2_c = pubkey2 * c_map[pubkey2]\n",
    "\n",
    "# Negate if needed\n",
    "if agg_pubkey.get_y()%2 != 0:\n",
    "    agg_pubkey.negate()\n",
    "    privkey1_c.negate()\n",
    "    privkey2_c.negate()\n",
    "    pubkey1_c.negate()\n",
    "    pubkey2_c.negate()\n",
    "    \n",
    "# Tweak musig public key\n",
    "# Method: ECPubKey.tweak_add()\n",
    "tweak = random.randrange(1, SECP256K1_ORDER)\n",
    "agg_pubkey_tweaked =  # TODO: implement\n",
    "\n",
    "# Nonce generation & aggregation\n",
    "# Remember to negate the individual nonce values if required\n",
    "# Method: generate_schnorr_nonce()\n",
    "# Method: aggregate_schnorr_nonces()\n",
    "k1 =  # TODO: implement\n",
    "k2 =  # TODO: implement\n",
    "R_agg, negated =  # TODO: implement\n",
    "if negated:\n",
    "    # TODO: implement\n",
    "\n",
    "# Signing and signature aggregation\n",
    "msg = sha256(b'msg')\n",
    "\n",
    "# Sign individually and then aggregate partial signatures. A factor (e * tweak)\n",
    "# needs to be added to the list of partial signatures\n",
    "# Method: sign_musig(private_key, nonce_key, nonce_point, public_key, msg)\n",
    "# Method: aggregate_musig_signatures(partial_signature_list, aggregate nonce)\n",
    "e = musig_digest(R_agg, agg_pubkey_tweaked, msg)\n",
    "s1 =  # TODO: implement\n",
    "s2 =  # TODO: implement\n",
    "sig_agg =  # TODO: implement\n",
    "\n",
    "assert agg_pubkey_tweaked.verify_schnorr(sig_agg, msg)\n",
    "print(\"Success!\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Commitment schemes with tweaks\n",
    "\n",
    "Taproot uses the tweak as a commitment for spending script paths. However, simply applying the committed value as a public key tweak is not sufficient, as this does not represent a secure cryptographic commitment.\n",
    "\n",
    "![test](images/taptweak0.jpg)\n",
    "\n",
    "Instead, the committed value must first be hashed with the untweaked public key point. This commitment scheme is called *pay-to-contract*. **It does not allow the modification of a committed value for a given public key point Q.**"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Example 2.2.3: Tweaking a public key Q with commitment data\n",
    "\n",
    "In this example we demonstrate an insecure commitment scheme. The committed value `c` can be trivially modified to `c'`, and by setting `x'` to `x + c - c'`, the public key point equation `Q = x'G + c'G` still holds.\n",
    "\n",
    "First, we commit a contract between Alice and Bob and then demonstrate how this unsafe commitment can be changed.\n",
    "\n",
    "* The initial committed contract is: `Alice agrees to pay 10 BTC to Bob`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Alice generates a key pair\n",
    "x_key, P_key = generate_key_pair()\n",
    "print(\"Private key: {}\\nPublic key: {}\\n\".format(x_key.secret, P_key.get_bytes().hex()))\n",
    "\n",
    "# Alice generates the tweak from the contract\n",
    "contract = \"Alice agrees to pay 10 BTC to Bob\"\n",
    "t = sha256(contract.encode('utf-8'))\n",
    "print(\"Tweak from original contract: {}\\n\".format(t.hex()))\n",
    "\n",
    "# Alice tweaks her key pair\n",
    "Q_key = P_key.tweak_add(t)\n",
    "q_key = x_key.add(t)\n",
    "print(\"Tweaked private key: {}\\nTweaked public key: {}\\n\".format(q_key.secret, Q_key.get_bytes().hex()))\n",
    "\n",
    "# Alice produces a valid signature for this tweaked public key\n",
    "msg = sha256(b'I agree to the committed contract')\n",
    "sig = q_key.sign_schnorr(msg)\n",
    "\n",
    "# Bob can verify that sig is a valid signature for the public key Q:\n",
    "verify_sig = Q_key.verify_schnorr(sig, msg)\n",
    "print(\"Alice has produced a valid signature for Q: {}\".format(verify_sig))\n",
    "\n",
    "# Alice provides the untweaked public key P to Bob.\n",
    "# Bob believes he can verify that the signature committed to the tweak t:\n",
    "verify_tweak = P_key.tweak_add(sha256(contract.encode('utf-8'))) == Q_key\n",
    "print(\"The signature appears to commit to '{}': {}\".format(contract, verify_tweak))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Example 2.2.4: Modifying the commitment tweak of public key Q\n",
    "\n",
    "However, note that is possible for Alice to modify this insecure commitment without changing the value of pub key `Q`.\n",
    "* The committed contract is changed to : `Alice agrees to pay 0.1 BTC to Bob`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Alice modifies the contract and produces an alternative tweak\n",
    "alternative_contract = \"Alice agrees to pay 0.1 BTC to Bob\"\n",
    "t2 = sha256(alternative_contract.encode('utf-8'))\n",
    "print(\"Tweak from original contract: {}\".format(t.hex()))\n",
    "print(\"Tweak from modified contract: {}\\n\".format(t2.hex()))\n",
    "\n",
    "# Alice modifies her original private key and public key\n",
    "# x2 = x - t2 + t\n",
    "x_int = x_key.as_int()\n",
    "t_int = int.from_bytes(t, \"big\") \n",
    "t2_int = int.from_bytes(t2, \"big\") \n",
    "x2_key, P2_key = generate_key_pair((x_int - t2_int + t_int) % SECP256K1_ORDER)\n",
    "\n",
    "# Alice can still produce a valid signature for Q\n",
    "msg2 = sha256(b'I agree to the committed contract')\n",
    "sig2 = q_key.sign_schnorr(msg2)\n",
    "\n",
    "# Bob can verify that sig is a valid signature for the public key Q:\n",
    "verify_sig = Q_key.verify_schnorr(sig, msg)\n",
    "print(\"Alice has produced a valid signature for Q: {}\".format(verify_sig))\n",
    "\n",
    "# Alice claims that P2 is the untweaked public key.\n",
    "# Bob believes he can verify that the signature committed to the tweak t:\n",
    "verify_tweak = P2_key.tweak_add(sha256(alternative_contract.encode('utf-8'))) == Q_key\n",
    "print(\"The signature appears to commit to '{}': {}\".format(alternative_contract, verify_tweak))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Summary of 2.2.3, 2.2.4: Insecure practice of tweaking a public key with commitment data\n",
    "\n",
    "We have demonstrated how a simple key tweak with commitment data does not work as a commitment scheme.\n",
    "* Tweaking the original public key `P` with commitment data hides the commitment.\n",
    "* However, the original public key `P` can be recomputed (`P2`) for any modified commitment, without altering the tweaked public key `Q`.\n",
    "\n",
    "To any observer, both original and modified \"commitments\" appear to be valid for the same public key `Q`."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Example 2.2.5 - Pay-to-contract: Tweaking the pubkey with `H(P|msg)`\n",
    "\n",
    "In this example, we demonstrate a _secure_ commitment scheme called pay-to-contract. The private key is tweaked with the scalar `H(P|c)`. Since `P` appears both inside and outside the hash, it isn't possible to solve for a different contract `c` by modifying `x`.\n",
    "\n",
    "* Alice can now no longer invalidate her previous contract commitment with Bob."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Alice generates a key pair\n",
    "x_key, P_key = generate_key_pair()\n",
    "print(\"Private key: {}\\nPublic key: {}\\n\".format(x_key.secret, P_key.get_bytes().hex()))\n",
    "\n",
    "# Alice computes the tweak from H(P|msg)\n",
    "contract = \"Alice agrees to pay 10 BTC to Bob\"\n",
    "t = tagged_hash(\"TapTweak\", P_key.get_bytes() + contract.encode('utf-8'))\n",
    "\n",
    "# Alice tweaks her key pair\n",
    "Q_key = P_key.tweak_add(t)\n",
    "q_key = x_key.add(t)\n",
    "print(\"Tweaked private key: {}\\nTweaked public key: {}\\n\".format(q_key.secret, Q_key.get_bytes().hex()))\n",
    "\n",
    "# Alice signs a valid message\n",
    "msg = sha256(b'I agree to the committed contract')\n",
    "sig = q_key.sign_schnorr(msg)\n",
    "\n",
    "# Bob can verify that sig is a valid signature for the public key Q:\n",
    "verify_sig = Q_key.verify_schnorr(sig, msg)\n",
    "print(\"Alice has produced a valid signature for Q: {}\".format(verify_sig))\n",
    "\n",
    "# Alice provides the untweaked public key P to Bob.\n",
    "# Bob believes he can verify that the signature committed to the tweak t:\n",
    "verify_tweak = P_key.tweak_add(t) == Q_key\n",
    "print(\"The signature commits to '{}': {}\".format(contract, verify_tweak))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Part 2: Spending a (tweaked) taproot output along the key path\n",
    "\n",
    "In this exercise, we'll create a segwit v1 output that sends to a tweaked public key. We'll then spend that output along the key path using the tweaked private key.\n",
    "\n",
    "Such as spend does not reveal the committed tweak to the observer and is indistinguishable from any other key path spend."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### _Programming Exercise 2.2.6:_ Construct taproot output with tweaked public key"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Example key pair\n",
    "privkey = ECKey().set(102118636618570133408735518698955378316807974995033705330357303547139065928052)\n",
    "internal_pubkey = privkey.get_pubkey()\n",
    "\n",
    "if internal_pubkey.get_y()%2 != 0:\n",
    "    privkey.negate()\n",
    "    internal_pubkey.negate()\n",
    "\n",
    "# Example tweak\n",
    "taptweak = bytes.fromhex('2a2fb476ec9962f262ff358800db0e7364287340db73e5e48db36d1c9f374e30')\n",
    "\n",
    "# Tweak the private key\n",
    "# Method: ECKey.add()\n",
    "tweaked_privkey = # TODO: implement\n",
    "\n",
    "# Tweak the public key\n",
    "# Method: use tweak_add()\n",
    "taproot_pubkey =  # TODO: implement\n",
    "taproot_pubkey_b =  # TODO: implement\n",
    "\n",
    "# Derive the bech32 address\n",
    "# Use program_to_witness(version_int, pubkey_bytes)\n",
    "address =  # TODO: implement\n",
    "\n",
    "assert address == \"bcrt1pjnux0f7037ysqv2aycfntus0t606sjyu0qe2xqewlmhulpdujqeq2z4st9\"\n",
    "print(\"Success! Address: {}\".format(address))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Example 2.2.7: Start Bitcoin Core node and send coins to the taproot address\n",
    "\n",
    "Only run setup once, or after a clean shutdown."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Start node\n",
    "test = util.TestWrapper()\n",
    "test.setup()\n",
    "node = test.nodes[0]\n",
    "\n",
    "# Generate coins and create an output\n",
    "tx = node.generate_and_send_coins(address)\n",
    "print(\"Transaction {}, output 0\\nsent to {}\\n\".format(tx.hash, address))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Example 2.2.8: Construct `CTransaction` and populate inputs\n",
    "\n",
    "We use the `create_spending_transaction(node, txid)` convenience function."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Create a spending transaction\n",
    "spending_tx = test.create_spending_transaction(tx.hash)\n",
    "print(\"Spending transaction:\\n{}\".format(spending_tx))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### _Programming Exercise 2.2.9:_ Spend taproot output with key path"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Sign transaction with tweaked private key\n",
    "# Method: TaprootSignatureHash(tx, output_list, hash_type=int, input_index=int, scriptpath=bool)\n",
    "sighash =  # TODO: implement\n",
    "sig =  # TODO: implement\n",
    "\n",
    "# Add witness to transaction\n",
    "spending_tx.wit.vtxinwit.append(CTxInWitness([sig]))\n",
    "\n",
    "# Test mempool acceptance\n",
    "assert node.test_transaction(spending_tx)\n",
    "print(\"Success!\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### _Shutdown TestWrapper_"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Shutdown\n",
    "test.shutdown()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Part 3 (Case Study): Contract commitments\n",
    "\n",
    "Alice currently commits contracts with Bob to unspendable OP_RETURN outputs, which contain 32B proof-of-existence commitments. Although this is a standard output with a zero amount, several disadvantages remain:\n",
    "\n",
    "* Committing data to an OP_RETURN output requires an additional output with a zero amount, resulting in a higher transaction fees.\n",
    "* The OP_RETURN output reveals the presence of a data commitment to any on-chain observer. This reduces the privacy of Alice's commitments.\n",
    "\n",
    "In this chapter, we'll show how Alice can move her contract commitments to public key tweaks to reduce fees and improve the privacy of her commitments."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Committing contract data to an OP_RETURN output\n",
    "\n",
    "We'll first show Alice's current setup: An OP_RETURN script containing commitment data."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Example 2.2.10: Create the contract commitment"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "contract_bytes = \"Alice pays 10 BTC to Bob\".encode('utf-8')\n",
    "commitment_bytes = sha256(contract_bytes)\n",
    "print(\"The contract commitment is: {}\".format(commitment_bytes.hex()))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Example 2.2.11: Start Bitcoin Core node and construct an unspent output\n",
    "\n",
    "Only run once, or after a clean shutdown. This constructs an unspent outpoint for example 2.2.12. "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Start node\n",
    "test = util.TestWrapper()\n",
    "test.setup()\n",
    "node = test.nodes[0]\n",
    "\n",
    "# Generate coins and send these to a new wallet address\n",
    "node.generatetoaddress(101, node.getnewaddress(address_type=\"bech32\"))\n",
    "\n",
    "# Fetch the oldest unspent outpoint in the Bitcoin Core wallet\n",
    "unspent_txid = node.listunspent(1)[-1][\"txid\"]\n",
    "unspent_outpoint = COutPoint(int(unspent_txid,16), 0)\n",
    "\n",
    "print(\"Unspent coin: txid:{}, n:{}\".format(unspent_outpoint.hash, unspent_outpoint.n))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Example 2.2.12: Create and broadcast a transaction with an OP_RETURN output\n",
    "\n",
    "We now construct a zero-value OP_RETURN output which contains the commitment data of Alice's contract with Bob. We also add a regular P2WPKH output back to Alice to return the funds from the transaction input (less the transaction fee)."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Construct transaction spending previously generated outpoint\n",
    "op_return_tx = CTransaction()\n",
    "op_return_tx.nVersion = 1\n",
    "op_return_tx.nLockTime = 0\n",
    "op_return_tx_in = CTxIn(outpoint=unspent_outpoint, nSequence=0)\n",
    "op_return_tx.vin = [op_return_tx_in]\n",
    "\n",
    "# Output 0) Alice's change address\n",
    "address_alice = node.getnewaddress(address_type=\"bech32\")\n",
    "p2wpkh_output_script = bytes.fromhex(node.getaddressinfo(address_alice)['scriptPubKey'])\n",
    "p2wpkh_output_amount_sat = 4_950_000_000  # remove transaction fee from output amount\n",
    "p2wpkh_output = CTxOut(nValue=p2wpkh_output_amount_sat, scriptPubKey=p2wpkh_output_script)\n",
    "\n",
    "# Output 1) OP_RETURN with Alice's commitment\n",
    "op_return_output_script = CScript([OP_RETURN, commitment_bytes])\n",
    "op_return_output = CTxOut(nValue=0, scriptPubKey=op_return_output_script)\n",
    "\n",
    "# Populate transaction with p2pkh and OP_RETURN outputs and add valid witness\n",
    "op_return_tx.vout = [p2wpkh_output, op_return_output]\n",
    "op_return_tx_hex_signed = node.signrawtransactionwithwallet(hexstring=op_return_tx.serialize().hex())['hex']\n",
    "\n",
    "# Confirm details of the OP_RETURN output\n",
    "op_return_tx_decoded = node.decoderawtransaction(op_return_tx_hex_signed)\n",
    "op_return_vout = op_return_tx_decoded['vout'][1]\n",
    "print(\"The OP_RETURN output script is: {}\".format(op_return_vout['scriptPubKey']['asm']))\n",
    "print(\"The OP_RETURN output value is: {}\".format(int(op_return_vout['value'])))\n",
    "\n",
    "# Note the total weight of the transaction with a dedicated OP_RETURN commitment output\n",
    "print(\"The total transaction weight is: {}\\n\".format(op_return_tx_decoded['weight']))\n",
    "\n",
    "# Test mempool acceptance\n",
    "print(node.testmempoolaccept(rawtxs=[op_return_tx_hex_signed], maxfeerate=0))\n",
    "assert node.testmempoolaccept(rawtxs=[op_return_tx_hex_signed], maxfeerate=0)[0]['allowed']\n",
    "print(\"Success!\")"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### Committing contract data with the pay-to-contract scheme\n",
    "\n",
    "Next, we will commit Alice's contract to a spendable pay-to-pubkey output with the pay-to-contract commitment scheme."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### _Programming Exercise 2.2.13:_ Generate segwit v1 address for a pay-to-contract public key\n",
    "\n",
    "Commit the contract to Alice's public key with the pay-to-contract commitment scheme, and then generate the corresponding segwit v1 address."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Generate a key pair\n",
    "privkey, pubkey = generate_bip340_key_pair()\n",
    "\n",
    "# Generate the pay-to-contract tweak\n",
    "# Hint: Use tagged_hash(\"TapTweak\", P + bytes)\n",
    "contract_bytes = \"Alice pays 10 BTC to Bob\".encode('utf-8')\n",
    "tweak = int_or_bytes( # TODO: implement\n",
    "tweak_private, tweak_point = # TODO: implement\n",
    "\n",
    "# Tweak Alice's key pair with the pay-to-contract tweak\n",
    "tweaked_pubkey = # TODO: implement\n",
    "tweaked_privkey = # TODO: implement\n",
    "\n",
    "# Generate the segwit v1 address\n",
    "tweaked_pubkey_data = # TODO: implement\n",
    "tweaked_pubkey_program = # TODO: implement\n",
    "version = 1\n",
    "address = program_to_witness(version, tweaked_pubkey_program)\n",
    "print(\"Address encoding the segwit v1 output: \", address)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Example 2.2.14: Create a transaction with the Bitcoin Core wallet sending funds to the segwit v1 address\n",
    "\n",
    "The pay-to-contract output encoded in the segwit v1 address holds spendable value just like a regular, untweaked public key. It can be spent with the tweaked private key, as we learned in part 2 of this chapter."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Generate coins and send to segwit v1 address containing the pay-to-contract public key\n",
    "tx = node.generate_and_send_coins(address)\n",
    "print(\"Transaction {}, output 0\\nSent to {}\\n\".format(tx.hash, address))\n",
    "print(\"Transaction weight with pay-to-contract: {}\".format(node.decoderawtransaction(tx.serialize().hex())['weight']))\n",
    "print(\"Transaction weight with OP_RETURN: {}\\n\".format(op_return_tx_decoded['weight']))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### _Shutdown TestWrapper_"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Shutdown\n",
    "test.shutdown()"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "**Congratulations!** In this chapter, you have:\n",
    "\n",
    "- Learned how to tweak a public/private key pair with a value.\n",
    "- Created an _insecure_ commitment scheme (by tweaking the keys with the raw commitment value) and a _secure_ commitment scheme (by tweaking with a hash of the commitment and the public key).\n",
    "- Sent coins to a segwit v1 output with a tweaked public key, and later spent that output by signing with the tweaked private key.\n",
    "- Improved cost and privacy of a contract commitment by moving it from an unspendable OP_RETURN output to a pay-to-contract public key."
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.6.5"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}