Public key recovery for EC leaves in P2MR (BIP-360)

The examination of a cryptographic vulnerability involving EC keys within a tree structure where related keys P and P' are present in different leaves provides significant insights into potential security risks. This analysis reveals that an adversary with knowledge of the tree structure, both keys, and the tweak t, can exploit the system by forging signatures. The process involves querying for a signature under key P for a transaction, then using the relation between P and P' (P' = P + t⋅G) to compute a new signature that falsely verifies under P'. This is possible because the challenge e used in the signatures does not bind to the control block, thus remaining constant across computations.

This type of attack, identified by Conduition, highlights a critical flaw where the absence of commitment to the control block in the computation of e allows the reuse of e in multiple fraudulent contexts. It underscores the need for enhanced security measures in cryptographic protocols that use tree structures for managing keys.

Additionally, it's important to note the specific case of P2TR outputs discussed. In scenarios where there is only a single script leaf, the key path spends directly without involving additional leaves. However, if a literal 2-leaf P2TR output scenario were to occur, the script spend size would increase by 32 bytes, indicating a change in the structure and possibly affecting the security implications of the transaction processing and signature validation. This particular detail emphasizes the complexities involved in designing secure cryptographic systems that are resilient against such nuanced attacks.