<p>There are 4 issues:</p>
<ol>
<li>Missing <code>0x00</code> prefix byte (epoch byte)</li>
<li>The message needs to be hashed before it can be signed. It should be a tagged hash with the tag &quot;TapSighash&quot;.</li>
<li>The txid in your prevouts is backwards. It should be byteswapped from what is displayed (i.e. it is the actual result of the hash)</li>
<li>The sequence in your input is <code>0xfdffffff</code>, not <code>0xffffff</code></li>
</ol>
<p>Here is what I have computed for each part:</p>
<div class="s-table-container">
<table class="s-table">
<thead>
<tr>
<th>Message part</th>
<th>Serialization</th>
</tr>
</thead>
<tbody>
<tr>
<td>Epoch</td>
<td>00</td>
</tr>
<tr>
<td>hash_type</td>
<td>00</td>
</tr>
<tr>
<td>nVersion</td>
<td>02000000</td>
</tr>
<tr>
<td>nLockTime</td>
<td>00000000</td>
</tr>
<tr>
<td>sha_prevouts</td>
<td>1da888957df6ce1ac5462fc1b08fe98f2f211026b4b91b71dbd8470239495faf</td>
</tr>
<tr>
<td>sha_amounts</td>
<td>3e1f6dbf626619317d04b24ac25799871709e0f3e35cc0e05dae4da21bc5a162</td>
</tr>
<tr>
<td>sha_scriptpubkeys</td>
<td>1e43f82396d787c36855662b53aa84af812f10cb9bdca5f2328b12ffea3f833c</td>
</tr>
<tr>
<td>sha_sequencues</td>
<td>23e9829bfb4e23fbd3c4848baa035af15d73bcb83e510f7f097f90a21a4280d2</td>
</tr>
<tr>
<td>sha_outputs</td>
<td>fd984a928339e11d1dcda5174c34ddfc8bcc976edceb919d0f52f127d0cd0bf7</td>
</tr>
<tr>
<td>spend_type</td>
<td>00</td>
</tr>
<tr>
<td>input_index</td>
<td>00000000</td>
</tr>
</tbody>
</table>
</div>
<p>The entire thing that you hash should be</p>
<pre><code>000002000000000000001da888957df6ce1ac5462fc1b08fe98f2f211026b4b91b71dbd8470239495faf3e1f6dbf626619317d04b24ac25799871709e0f3e35cc0e05dae4da21bc5a1621e43f82396d787c36855662b53aa84af812f10cb9bdca5f2328b12ffea3f833c23e9829bfb4e23fbd3c4848baa035af15d73bcb83e510f7f097f90a21a4280d2fd984a928339e11d1dcda5174c34ddfc8bcc976edceb919d0f52f127d0cd0bf70000000000
</code></pre>
<p>and you should get a hash of</p>
<pre><code>1b9589328e6c5d8b71288ee5f93a78d655b724ffa0f5ebf23f88983dda8c5676
</code></pre>

CC BY-SA 4.0
2023-10-27T11:49:50.023Z
Still something is missing despite replacing the big-endian with little-endian txid. Thanks for a response.
Greg Tonoski
CC BY-SA 4.0
2023-10-27T14:48:59.947Z
I've updated my answer to include Pieter's comment and the remaining issue I found.
Ava Chow
CC BY-SA 4.0
2023-10-26T21:38:52.783Z
2023-10-27T14:48:38.770Z
2023-10-27T14:48:38.770Z
Ava Chow
<p>Elaborating on the answer:</p>
<div class="s-table-container">
<table class="s-table">
<thead>
<tr>
<th>Position</th>
<th>Name of a message part</th>
<th>Explanatory expression</th>
<th>Value before SHA-256</th>
<th>Final value (hex)</th>
</tr>
</thead>
<tbody>
<tr>
<td>1</td>
<td>hash_type</td>
<td>0x00</td>
<td>not applicable</td>
<td>00</td>
</tr>
<tr>
<td>2</td>
<td>nVersion</td>
<td>LE( 0x00000002 )</td>
<td>not applicable</td>
<td>02000000</td>
</tr>
<tr>
<td>3</td>
<td>nLockTime</td>
<td>LE( 0x00000000 )</td>
<td>not applicable</td>
<td>00000000</td>
</tr>
<tr>
<td>4</td>
<td>sha_prevouts</td>
<td>sha256( LE( predecessor_txid ) || LE( predecessor_vout ) )</td>
<td>sha256( 5f1ab0cd64d050721e4bcd63ffee5c1b4f6224b5fa8f7343062d1f0e32ab87eb00000000 )</td>
<td>1da888957df6ce1ac5462fc1b08fe98f2f211026b4b91b71dbd8470239495faf</td>
</tr>
<tr>
<td>5</td>
<td>sha_amounts</td>
<td>sha256( LE( predecessor_tx_amount ) )</td>
<td>sha256( LE( 0000000000001f40 ) )</td>
<td>3e1f6dbf626619317d04b24ac25799871709e0f3e35cc0e05dae4da21bc5a162</td>
</tr>
<tr>
<td>6</td>
<td>sha_scriptpubkeys</td>
<td>sha256( predecessor_scriptpubkey_length || predecessor_scriptpubkey )</td>
<td>sha256( 22512055355ca83c973f1d97ce0e3843c85d78905af16b4dc531bc488e57212d230116 )</td>
<td>1e43f82396d787c36855662b53aa84af812f10cb9bdca5f2328b12ffea3f833c</td>
</tr>
<tr>
<td>7</td>
<td>sha_sequences</td>
<td>sha256( LE( predecessor_tx_sequences )</td>
<td>sha256( LE( fffffffd ) )</td>
<td>23e9829bfb4e23fbd3c4848baa035af15d73bcb83e510f7f097f90a21a4280d2</td>
</tr>
<tr>
<td>8</td>
<td>sha_outputs</td>
<td>sha256( LE( new_tx_amount ) || new_tx_scriptpubkey_length || new_tx_scriptpubkey</td>
<td>sha256( e8030000000000001600140bc6dda83a5c6346d31808f685c7cbf1ae20a23e )</td>
<td>fd984a928339e11d1dcda5174c34ddfc8bcc976edceb919d0f52f127d0cd0bf7</td>
</tr>
<tr>
<td>9</td>
<td>spend_type</td>
<td>0x00</td>
<td>not applicable</td>
<td>00</td>
</tr>
<tr>
<td>10</td>
<td>input_index</td>
<td>LE( 0x00000000)</td>
<td>not applicable</td>
<td>00000000</td>
</tr>
</tbody>
</table>
</div>
<pre><code>message digest = hashTapSighash( 0x00 || SigMsg( 0x00, 0 ) ) = sha256( sha256( &quot;TapSighash&quot; ) || sha256( &quot;TagSighash&quot; ) || sighash_epoch || message_parts_above ) = sha256( sha256( 0x54617053696768617368 ) || sha256( 0x54617053696768617368 ) || 0x00 || 0x0002000000000000001da888957df6ce1ac5462fc1b08fe98f2f211026b4b91b71dbd8470239495faf3e1f6dbf626619317d04b24ac25799871709e0f3e35cc0e05dae4da21bc5a1621e43f82396d787c36855662b53aa84af812f10cb9bdca5f2328b12ffea3f833c23e9829bfb4e23fbd3c4848baa035af15d73bcb83e510f7f097f90a21a4280d2fd984a928339e11d1dcda5174c34ddfc8bcc976edceb919d0f52f127d0cd0bf70000000000 ) = 0x1b9589328e6c5d8b71288ee5f93a78d655b724ffa0f5ebf23f88983dda8c5676
</code></pre>
<p><a href="https://github.com/bitcoin/bips/blob/master/bip-0340/reference.py" rel="nofollow noreferrer">Reference.py</a> used to compute the signature:</p>
<pre><code>reference.schnorr_sign(b'\x1b\x95\x892\x8el]\x8bq(\x8e\xe5\xf9:x\xd6U\xb7$\xff\xa0\xf5\xeb\xf2?\x88\x98=\xda\x8cVv', b'\xdf\xf1\xc8\xc2\xc0\x16\xa5r\x91KLZ\xdb\x87\x91\xd6+Gh\xae\x9d\na\xbe\x8a\xb9L\xf5\x03\x8d}\x90', b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00')
</code></pre>
<p>Signature=<code>0x082779351eb8509993140dbcb9c6d1d4928c6cf397569c49891334ba6d6c9c0bbe6312d4f7af558f3d83398c4dfdf6caabb1b6bcd7cba216141450e240746299</code></p>
<p>Verification:</p>
<pre><code>testmempoolaccept '[&quot;020000000001015f1ab0cd64d050721e4bcd63ffee5c1b4f6224b5fa8f7343062d1f0e32ab87eb0000000000fdffffff01e8030000000000001600140bc6dda83a5c6346d31808f685c7cbf1ae20a23e0140082779351eb8509993140dbcb9c6d1d4928c6cf397569c49891334ba6d6c9c0bbe6312d4f7af558f3d83398c4dfdf6caabb1b6bcd7cba216141450e24074629900000000&quot;]'


[
  {
    &quot;txid&quot;: &quot;466474502a15ca2258cf5cadcfec6743c499720843cd51c2c646ad501befffe2&quot;,
    &quot;wtxid&quot;: &quot;9fbcd4eb32f2811786d46ff5272347891badba07b7b7d1d02d64d71430a2778f&quot;,
    &quot;allowed&quot;: true,
    &quot;vsize&quot;: 99,
    &quot;fees&quot;: {
      &quot;base&quot;: 0.00007000,
      &quot;effective-feerate&quot;: 0.00070707,
      &quot;effective-includes&quot;: [
        &quot;9fbcd4eb32f2811786d46ff5272347891badba07b7b7d1d02d64d71430a2778f&quot;
      ]
    }
  }
]
deriveaddresses &quot;rawtr(cV628xvqToz45dwdPmTcJ9RgEVnWMwP8dpZBGzb9LfTk3sBHFNwc)#5u2k7u2l&quot;
[
  &quot;tb1p2564e2pujul3m97wpcuy8jza0zg94uttfhznr0zg3etjztfrqytq7n93n2&quot;
]
</code></pre>

CC BY-SA 4.0
2023-10-31T10:05:46.367Z
2023-10-31T10:20:29.523Z
2023-10-31T10:20:29.523Z
Greg Tonoski
<p>Is there an example of key-path BIP-0341 signature message computation, perhaps? Or, could you tell what is incorrect in the example below, please?</p>
<pre><code>deriveaddresses &quot;rawtr(cV628xvqToz45dwdPmTcJ9RgEVnWMwP8dpZBGzb9LfTk3sBHFNwc)#5u2k7u2l&quot;
[
  &quot;tb1p2564e2pujul3m97wpcuy8jza0zg94uttfhznr0zg3etjztfrqytq7n93n2&quot;
]
testmempoolaccept '[&quot;020000000001015f1ab0cd64d050721e4bcd63ffee5c1b4f6224b5fa8f7343062d1f0e32ab87eb0000000000fdffffff01e8030000000000001600140bc6dda83a5c6346d31808f685c7cbf1ae20a23e0140caf56a13c54a7d786579ad9b92868082685dafa4c7d97ee5d031d80105de0eea501548e63812806ec1adaf2fab6de48ec59a59701c5cdfa2e9f84e9a3c4109d900000000&quot;]'

[
  {
    &quot;txid&quot;: &quot;466474502a15ca2258cf5cadcfec6743c499720843cd51c2c646ad501befffe2&quot;,
    &quot;wtxid&quot;: &quot;c3808cff6390357ed24705c470d4da0e3608fdcb43d34b5283a933bccb439c84&quot;,
    &quot;allowed&quot;: false,
    &quot;reject-reason&quot;: &quot;non-mandatory-script-verify-flag (Invalid Schnorr signature)&quot;
  }
]
</code></pre>
<p>The rest of the text has been truncated.</p>

<taproot><schnorr-signatures><sighash>
Example of key-path BIP-0341 signature message computation
Greg Tonoski
# Example of key-path BIP-0341 signature message computation

(Asked by: username_0 on 2023-10-24)

Is there an example of key-path BIP-0341 signature message computation, perhaps? Or, could you tell what is incorrect in the example below, please?
deriveaddresses "rawtr(cV628xvqToz45dwdPmTcJ9RgEVnWMwP8dpZBGzb9LfTk3sBHFNwc)#5u2k7u2l"
[
  "tb1p2564e2pujul3m97wpcuy8jza0zg94uttfhznr0zg3etjztfrqytq7n93n2"
]
testmempoolaccept '["020000000001015f1ab0cd64d050721e4bcd63ffee5c1b4f6224b5fa8f7343062d1f0e32ab87eb0000000000fdffffff01e8030000000000001600140bc6dda83a5c6346d31808f685c7cbf1ae20a23e0140caf56a13c54a7d786579ad9b92868082685dafa4c7d97ee5d031d80105de0eea501548e63812806ec1adaf2fab6de48ec59a59701c5cdfa2e9f84e9a3c4109d900000000"]'

[
  {
    "txid": "466474502a15ca2258cf5cadcfec6743c499720843cd51c2c646ad501befffe2",
    "wtxid": "c3808cff6390357ed24705c470d4da0e3608fdcb43d34b5283a933bccb439c84",
    "allowed": false,
    "reject-reason": "non-mandatory-script-verify-flag (Invalid Schnorr signature)"
  }
]

The rest of the text has been truncated.

**Tags:** taproot, schnorr-signatures, sighash


---

## 2 answers

### Answer by username_1 on 2023-10-26. Score: 1 | Accepted answer

There are 4 issues:

Missing 0x00 prefix byte (epoch byte)
The message needs to be hashed before it can be signed. It should be a tagged hash with the tag "TapSighash".
The txid in your prevouts is backwards. It should be byteswapped from what is displayed (i.e. it is the actual result of the hash)
The sequence in your input is 0xfdffffff, not 0xffffff

Here is what I have computed for each part:




Message part
Serialization




Epoch
00


hash_type
00


nVersion
02000000


nLockTime
00000000


sha_prevouts
1da888957df6ce1ac5462fc1b08fe98f2f211026b4b91b71dbd8470239495faf


sha_amounts
3e1f6dbf626619317d04b24ac25799871709e0f3e35cc0e05dae4da21bc5a162


sha_scriptpubkeys
1e43f82396d787c36855662b53aa84af812f10cb9bdca5f2328b12ffea3f833c


sha_sequencues
23e9829bfb4e23fbd3c4848baa035af15d73bcb83e510f7f097f90a21a4280d2


sha_outputs
fd984a928339e11d1dcda5174c34ddfc8bcc976edceb919d0f52f127d0cd0bf7


spend_type
00


input_index
00000000




The entire thing that you hash should be
000002000000000000001da888957df6ce1ac5462fc1b08fe98f2f211026b4b91b71dbd8470239495faf3e1f6dbf626619317d04b24ac25799871709e0f3e35cc0e05dae4da21bc5a1621e43f82396d787c36855662b53aa84af812f10cb9bdca5f2328b12ffea3f833c23e9829bfb4e23fbd3c4848baa035af15d73bcb83e510f7f097f90a21a4280d2fd984a928339e11d1dcda5174c34ddfc8bcc976edceb919d0f52f127d0cd0bf70000000000

and you should get a hash of
1b9589328e6c5d8b71288ee5f93a78d655b724ffa0f5ebf23f88983dda8c5676

> **Comments:**
> **username_0**: Still something is missing despite replacing the big-endian with little-endian txid. Thanks for a response.  
> **username_1**: I've updated my answer to include Pieter's comment and the remaining issue I found.  

---

### Answer by username_0 on 2023-10-31. Score: 0

Elaborating on the answer:




Position
Name of a message part
Explanatory expression
Value before SHA-256
Final value (hex)




1
hash_type
0x00
not applicable
00


2
nVersion
LE( 0x00000002 )
not applicable
02000000


3
nLockTime
LE( 0x00000000 )
not applicable
00000000


4
sha_prevouts
sha256( LE( predecessor_txid ) || LE( predecessor_vout ) )
sha256( 5f1ab0cd64d050721e4bcd63ffee5c1b4f6224b5fa8f7343062d1f0e32ab87eb00000000 )
1da888957df6ce1ac5462fc1b08fe98f2f211026b4b91b71dbd8470239495faf


5
sha_amounts
sha256( LE( predecessor_tx_amount ) )
sha256( LE( 0000000000001f40 ) )
3e1f6dbf626619317d04b24ac25799871709e0f3e35cc0e05dae4da21bc5a162


6
sha_scriptpubkeys
sha256( predecessor_scriptpubkey_length || predecessor_scriptpubkey )
sha256( 22512055355ca83c973f1d97ce0e3843c85d78905af16b4dc531bc488e57212d230116 )
1e43f82396d787c36855662b53aa84af812f10cb9bdca5f2328b12ffea3f833c


7
sha_sequences
sha256( LE( predecessor_tx_sequences )
sha256( LE( fffffffd ) )
23e9829bfb4e23fbd3c4848baa035af15d73bcb83e510f7f097f90a21a4280d2


8
sha_outputs
sha256( LE( new_tx_amount ) || new_tx_scriptpubkey_length || new_tx_scriptpubkey
sha256( e8030000000000001600140bc6dda83a5c6346d31808f685c7cbf1ae20a23e )
fd984a928339e11d1dcda5174c34ddfc8bcc976edceb919d0f52f127d0cd0bf7


9
spend_type
0x00
not applicable
00


10
input_index
LE( 0x00000000)
not applicable
00000000




message digest = hashTapSighash( 0x00 || SigMsg( 0x00, 0 ) ) = sha256( sha256( "TapSighash" ) || sha256( "TagSighash" ) || sighash_epoch || message_parts_above ) = sha256( sha256( 0x54617053696768617368 ) || sha256( 0x54617053696768617368 ) || 0x00 || 0x0002000000000000001da888957df6ce1ac5462fc1b08fe98f2f211026b4b91b71dbd8470239495faf3e1f6dbf626619317d04b24ac25799871709e0f3e35cc0e05dae4da21bc5a1621e43f82396d787c36855662b53aa84af812f10cb9bdca5f2328b12ffea3f833c23e9829bfb4e23fbd3c4848baa035af15d73bcb83e510f7f097f90a21a4280d2fd984a928339e11d1dcda5174c34ddfc8bcc976edceb919d0f52f127d0cd0bf70000000000 ) = 0x1b9589328e6c5d8b71288ee5f93a78d655b724ffa0f5ebf23f88983dda8c5676

Reference.py used to compute the signature:
reference.schnorr_sign(b'\x1b\x95\x892\x8el]\x8bq(\x8e\xe5\xf9:x\xd6U\xb7$\xff\xa0\xf5\xeb\xf2?\x88\x98=\xda\x8cVv', b'\xdf\xf1\xc8\xc2\xc0\x16\xa5r\x91KLZ\xdb\x87\x91\xd6+Gh\xae\x9d\na\xbe\x8a\xb9L\xf5\x03\x8d}\x90', b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00')

Signature=0x082779351eb8509993140dbcb9c6d1d4928c6cf397569c49891334ba6d6c9c0bbe6312d4f7af558f3d83398c4dfdf6caabb1b6bcd7cba216141450e240746299
Verification:
testmempoolaccept '["020000000001015f1ab0cd64d050721e4bcd63ffee5c1b4f6224b5fa8f7343062d1f0e32ab87eb0000000000fdffffff01e8030000000000001600140bc6dda83a5c6346d31808f685c7cbf1ae20a23e0140082779351eb8509993140dbcb9c6d1d4928c6cf397569c49891334ba6d6c9c0bbe6312d4f7af558f3d83398c4dfdf6caabb1b6bcd7cba216141450e24074629900000000"]'


[
  {
    "txid": "466474502a15ca2258cf5cadcfec6743c499720843cd51c2c646ad501befffe2",
    "wtxid": "9fbcd4eb32f2811786d46ff5272347891badba07b7b7d1d02d64d71430a2778f",
    "allowed": true,
    "vsize": 99,
    "fees": {
      "base": 0.00007000,
      "effective-feerate": 0.00070707,
      "effective-includes": [
        "9fbcd4eb32f2811786d46ff5272347891badba07b7b7d1d02d64d71430a2778f"
      ]
    }
  }
]
deriveaddresses "rawtr(cV628xvqToz45dwdPmTcJ9RgEVnWMwP8dpZBGzb9LfTk3sBHFNwc)#5u2k7u2l"
[
  "tb1p2564e2pujul3m97wpcuy8jza0zg94uttfhznr0zg3etjztfrqytq7n93n2"
]


---

