Public key recovery for EC leaves in P2MR (BIP-360)

This innovation introduces a recoverable EC leaf, which eliminates the need to include an explicit EC public key script in the witness. Instead, the public key is reconstructed directly from the signature using a tailored Schnorr verification equation. This approach not only reduces the witness size for EC spends—potentially matching or surpassing the efficiency of Pay-to-Witness-Public-Key-Hash (P2WPKH)—but also avoids increasing quantum exposure.

This optimization fundamentally changes the signature challenge, binding it to the P2MR root hash rather than the public key. By incorporating the root hash into the challenge, the design thwarts related-key attacks and breaks circular dependencies, thus enhancing the security posture against cryptographic vulnerabilities. The recovered public key must be validated against the P2MR Merkle root to ensure its integrity and to prevent tampering that could compromise other leaves in the tree. These modifications necessitate updates to the witness parsing and validation logic, as the recoverable EC leaf dispenses with the traditional script component, streamlining the witness to essential elements like the signature and a control block defining the leaf version and Merkle path.

From a cryptographic perspective, substituting the public key with a root hash plus Merkle branch in the signature challenge maintains many of the security properties found in BIP340 and related standards. While this configuration is suitable for most applications, more complex protocols such as MuSig2 would require additional security checks. Including the Merkle path in the challenge can mitigate malleation attacks, though it does eliminate the possibility of batch validation—a significant trade-off given its importance in BIP 340–342. In terms of data efficiency, the new scheme offers a balanced compromise between privacy and size: public keys are withheld until needed, and spend sizes compare favorably with existing schemes. For example, in a two-leaf output scenario, the proposed method incurs less overhead than P2MR while achieving much of the "happy-path" benefit of P2TR, albeit with the drawback of losing batch validation capabilities.

Detailed analysis of potential vulnerabilities, particularly those involving trees with related EC keys across different leaves, uncovers the risk of signature forgery if the challenge computation fails to bind to the control block. Such flaws allow adversaries to exploit knowledge of related keys and their relationship to forge signatures, emphasizing the necessity for robust commitment mechanisms in the signature calculation. The distinction between single-leaf and two-leaf P2TR outputs is crucial; additional script leaves increase spend data requirements and alter transaction processing, underlying the complexity of secure cryptographic system design.

To further harden P2MR constructions against quantum threats, it is advised that all EC keys be non-derivable from extended public keys (xpubs). Hardening ensures that even if xpubs remain confidential, they do not become a vector for quantum-enabled attacks. Secure management of chaincodes is equally vital, as any exposure could undermine the very security benefits sought with hardened keys. Key reuse must be scrupulously avoided to maintain robust defenses against advanced adversaries.

There is a growing interest in leveraging public key hashes instead of raw public keys within Schnorr challenges. This adjustment could streamline pubkey recovery not just in P2MR but also in taproot script paths, potentially through future soft fork upgrades. However, this shift introduces complexities for batch validation, requiring careful consideration of weight unit adjustments and resource trade-offs between CPU and bandwidth, especially for nodes validating transactions in real time.

The transition from BIP32 to new derivation schemes capable of supporting post-quantum cryptography, such as SHRINCS, presents formidable challenges. Migrating users to these standards will require a redefinition of wallet concepts and user experiences, likely retaining BIP39 seeds but adopting fresh derivation standards to support modern cryptographic practices. The ubiquitous reliance on xpub and public key sharing in current multisig, escrow, watch-only wallets, and indexing services complicates this migration, and full compatibility post-Q-day may be unattainable without substantial systemic change.

Within this evolving landscape, alternative address types like P2QR, P2MR, and P2TRv2 are being examined for their capacity to offer robust security in the face of quantum computing. P2QR stands out for never allowing EC spending, thereby removing certain risks entirely, but its high cost and limited appeal restrict widespread adoption. P2MR, offering both PQ and EC spend paths, provides a fallback should weaknesses emerge in PQ algorithms before EC is fully phased out. There is skepticism about the rapid adoption of stringent quantum-resistant types like P2QR absent a clear, imminent threat.

Strategic deployment of outputs like P2MR and P2TRH requires balancing complexity, privacy, and user experience. Combining these formats into a unified output type risks increased complexity