BIP draft: CISA for Taproot Key Path Spends

The email discusses a technical evaluation of a blockchain proposal, specifically addressing the integration and potential conflicts between different Bitcoin Improvement Proposals (BIPs). The sender initially notes a conflict between the reserved segwit version 2 in the current proposal and BIP-360, which also proposes to use the same version. The primary focus is on how to effectively implement Post-Quantum Cryptography (PQC) migration within the framework of existing proposals.

One key area of concern raised involves the use of aggregated signatures and their compatibility with future PQC mechanisms. The question posed is whether the current framework that verifies aggregated signatures could be adapted to support future aggregated PQC signatures, assuming an appropriate PQC signature algorithm becomes available.

Another significant issue discussed is the method of handling Elliptic Curve (EC) public keys within transaction outputs. The current proposal suggests placing a bare EC public key directly in the script-pubkey, which presents challenges. This setup prevents the use of Boris' EC recovery trick due to the nature of signature aggregation; public keys cannot be recovered individually and thus cannot be obscured behind a hash. Two potential solutions are proposed: coupling the Current Implementer SigAgg (CISA) tightly with P2TRv2 or hiding the EC public keys behind a hash in the ScriptPubKey (SPK), with specific details given about how each method would impact the witness weight in transactions.

The first option promotes migrating users to a wallet supporting PQC but retains vulnerabilities related to quantum safety and timing issues associated with quantum computing (referred to as Q-day). The second option, which involves hiding EC public keys behind a hash and attaching them in the witness for verification, offers increased security by relaxing these timing constraints but does not provide as much savings in transaction weight. Detailed calculations are provided to compare the witness weight across different implementations, illustrating the trade-offs between security and efficiency in each approach.

Overall, the discussion highlights the complexities of integrating advanced cryptographic techniques into blockchain protocols, especially in terms of ensuring forward compatibility with emerging technologies like quantum computing while maintaining current system efficiencies and security.