Public key recovery for EC leaves in P2MR (BIP-360)

This new approach utilizes a recoverable EC leaf to reduce the witness size in transactions involving EC public keys, enhancing efficiency without increasing quantum vulnerability. By eliminating the need for a script containing the EC public key in the witness, the optimization allows for the EC public key to be derived directly from the signature. This is achieved through a modified Schnorr verification equation, making the witness size comparable or even smaller than that of Pay-to-Witness-Public-Key-Hash (P2WPKH).

The cryptographic implications of this method are considerable, particularly in relation to BIP340 and related standards. While this approach retains important security properties and offers a balance between data size and privacy, it does forego batch validation capabilities, which is crucial in current designs. The inclusion of the Merkle path in the challenge reduces susceptibility to certain malleation attacks but introduces new complexities in terms of data encoding and efficiency.

Furthermore, a significant cryptographic vulnerability was noted concerning the potential forgery of signatures within a tree structure housing related EC keys. If an adversary understands the tree's structure and possesses knowledge of both related keys and their tweak, they could manipulate the system to forge signatures. This underscores a crucial flaw where the absence of commitment to the control block in signature computation could allow fraudulent reuse of the signature challenge across different contexts.

The discussion also highlights the necessity of hardening EC keys in P2MR constructions to avoid derivation from an extended public key (xpub), which could expose the public key to quantum-capable attackers. Additionally, the feasibility of using the hash of the public key in the Schnorr challenge poses intriguing possibilities for future enhancements in pubkey recovery processes within blockchain transactions.

Overall, while the proposed changes aim to streamline and secure EC transactions within a quantum-resistant framework, they also introduce specific trade-offs and challenges that need careful consideration, especially in light of potential quantum computing advancements. These optimizations could significantly impact blockchain space utilization and transaction costs, proposing a more efficient yet secure methodology in handling EC keys on the blockchain.