Public key recovery for EC leaves in P2MR (BIP-360)

The discussion revolves around the intricacies of using hardened elliptic curve (EC) keys in Pay-to-Merkle-root (P2MR) constructions, underscoring the necessity for these keys to be non-derivable from an extended public key (xpub). This measure is critical as exposing the public key to quantum-capable attackers could undermine the security benefits of employing P2MR. Additionally, the concept of calculating t for the P vs P' case is highlighted, clarifying that this calculation necessitates access to the private keys associated with both public keys involved, thus negating any notion of signature forgery under regular circumstances.

Further, the email touches upon the comparative benefits and drawbacks of adopting such a cryptographic approach. While P2MR recovers some advantages akin to those of Pay-to-Taproot (P2TR), such as withholding the public key disclosure until necessary, it sacrifices others like batch validation and straightforward usage of the signature scheme. Despite these trade-offs, there are notable efficiencies discussed. Reference is made to a pull request on the Bitcoin Core library secp256k11134, which originally suggested a potential 20% performance enhancement through batch validation. However, this figure has been revised to indicate possible improvements between 55%-80%. The comparison of costs in weight units between batchable and non-batchable signatures provides a detailed examination, suggesting that even with increased costs for non-batchable signatures, the outcomes remain within acceptable limits based on existing metrics.

In conclusion, while the introduction of hardened keys in P2MR setups presents certain operational challenges, particularly in terms of performance and usability, the strategic benefits, especially concerning security against quantum threats, justify these complexities. Moreover, recent developments and updates to related cryptographic libraries highlight ongoing improvements and optimizations, which could further mitigate some of the initial concerns regarding efficiency and cost.