Public key recovery for EC leaves in P2MR (BIP-360)

The proposed cryptographic method involves a modification of the traditional taproot structure, introducing "P2TRH" where public key recovery plays a central role. The approach uses the equation Q=P + H(P; S)*G, consistent with taproot practices, but adds a novel commitment to H(Q) within the scriptPubKey. This adjustment allows for the verification of the public key Q through its signature without incurring the typical 32-byte overhead associated with such processes.

The primary advantage of this method is its efficiency in space utilization, as it circumvents the need to store additional data for public key authenticity verification. Furthermore, the at-rest state of H(Q) does not compromise the security of the public key Q, thereby preventing potential coin theft through collision-resistant quantum computing (CRQC) attacks. However, the approach also introduces specific vulnerabilities and constraints. For instance, the requirement to reveal the original public key P during the script spend path exposes the system to risks in scenarios where widespread quantum decryption capabilities (Q-day) become available. In such events, coins could be temporarily frozen until keypath spends are disabled to mitigate threats. Once these measures are taken, revealing P no longer presents a security risk, restoring the ability to execute script paths safely. This balance between enhanced efficiency and potential security challenges is crucial for implementing this method in environments susceptible to quantum computing threats.