<p>That's exactly right.</p>
<p>Compute the tweak <code>H(P||c)</code>, compute the &quot;public key&quot; corresponding to that tweak, and then add (elliptic curve point addition) the internal public key with that tweak public key.</p>

CC BY-SA 4.0
2021-10-26T14:16:18.257Z
2021-10-26T14:48:31.863Z
2021-10-26T14:48:31.863Z
Pieter Wuille
<p>From what I know, to tweak a public key, I can use:</p>
<pre><code>Q = P + H(P|c)G
</code></pre>
<p>where</p>
<pre><code>Q is the tweaked public key
P is the initial public key (P = xG where x is the private key)
H is the hash function
| is concatenation
c is the commitment to the script path spend
G is the generator point
</code></pre>
<p>This might seem like high school math but can I calculate the <code>H(P|c)G</code> part by using the result of <code>H(P|c)</code> as a private key and computing the public key from it? I think this might work because the <code>H()</code> returns a 32 byte array and the result could be casted as a private key then multiplied by generator point <code>G</code> to get the corresponding public key which is equal to <code>H(P|c)G</code>?</p>

CC BY-SA 4.0
2021-10-26T14:19:11.023Z
I don't understand the question. xG is the public key of x. So if you substitute H(P|c) for x then xG is now the public key of H(P|c). Is that what you are asking? You are effectively adding two public keys to get Q, the tweaked public key.
Michael Folkson
<taproot><key-tweaking>
How to tweak a public key for Taproot
Keijyu
# How to tweak a public key for Taproot

(Asked by: username_0 on 2021-10-26)

From what I know, to tweak a public key, I can use:
Q = P + H(P|c)G

where
Q is the tweaked public key
P is the initial public key (P = xG where x is the private key)
H is the hash function
| is concatenation
c is the commitment to the script path spend
G is the generator point

This might seem like high school math but can I calculate the H(P|c)G part by using the result of H(P|c) as a private key and computing the public key from it? I think this might work because the H() returns a 32 byte array and the result could be casted as a private key then multiplied by generator point G to get the corresponding public key which is equal to H(P|c)G?

**Tags:** taproot, key-tweaking

> **Comments:**
> **username_1**: I don't understand the question. xG is the public key of x. So if you substitute H(P|c) for x then xG is now the public key of H(P|c). Is that what you are asking? You are effectively adding two public keys to get Q, the tweaked public key.  

---

## 1 answers

### Answer by username_2 on 2021-10-26. Score: 7 | Accepted answer

That's exactly right.

Compute the tweak `H(P||c)`, compute the "public key" corresponding to that tweak, and then add (elliptic curve point addition) the internal public key with that tweak public key.


---

