<p>Finally, I found the problem.</p>
<ol>
<li><p>The signature is generated with the <code>default</code> sig type, aka <code>0x00</code>. But I use the <code>sighash_all</code>, aka <code>0x01</code> to generate the sighash.</p>
</li>
<li><p>I missed the <a href="https://github.com/bitcoin/bips/blob/master/bip-0342.mediawiki#common-signature-message-extension" rel="nofollow noreferrer">extension part</a>. Which is &lt;tapleaf_hash_of_script&gt; &lt;0x00&gt; &lt;0xFFFFFFFF&gt;, and should be appended at the end of sigmsg.</p>
</li>
<li><p>As Peter commented, we need the internal pubkey to verify the script path spending.</p>
</li>
</ol>

CC BY-SA 4.0
2023-05-30T11:31:42.880Z
Not the internal pubkey, but the pubkey in the script. In this case they are the same, but they don't have to be.
Pieter Wuille
CC BY-SA 4.0
2023-05-30T09:47:12.950Z
2023-05-30T09:47:12.950Z
lj zn
<p>I am trying to verify the witness of a P2TR transaction, but the signature verification failed, could you please help?</p>
<p>The raw transaction:</p>
<pre><code>010000000001016dacbb729930a8ba699a4188880d1b3525f430e52ad0c01fb4f6eae7987febd50300000000fdffffff014a01000000000000225120e2bc122cdb981a985074e182db9120e52c79b96710d517f84ab186c6ab092c4a0340318bd919ead99017116322d9b861fef0e1f7d26a115dcc7b48fba34bfd5be023ef6d5ab364861b99bd0950ff74b3e93e50c6fd6d17751336f0cf435bb0738c5d8e2064a5ee88fba503623726eabb0aa54bcced4eb2328d30dd05c8088bf5ed26fc41ac0063036f7264010118746578742f706c61696e3b636861727365743d7574662d3800487b2270223a226f72632d3230222c20227469636b223a226d656d65222c20226964223a2233333838303736222c20226f70223a226d696e74222c2022616d74223a2231303030227d6821c064a5ee88fba503623726eabb0aa54bcced4eb2328d30dd05c8088bf5ed26fc4100000000
</code></pre>
<p>The <code>scriptpubkey</code> of input: <code>5120dde70c00d3aec1533bd7f8b6f704ec21e6ed0a0de317a0ccf8199abde58d3062</code> , and the value: <code>4677</code>.</p>
<p>Above are arguments, and I generate a <code>sigmsg</code> from those arguments:</p>
<pre><code>000101000000000000009d9a573f31fa9eb2787db1c5d2162e36d76d21b0ecfa8c1e65617a4f5ca4a54bb4e368d5ab0ab9129e0c72ac46249d5bb8dc63b28638ebbc35bb69f62bae4ef4e342cce0133cd546aca2580d6f5bc5a184674e8dadda449fcfd073f503a44fe423e9829bfb4e23fbd3c4848baa035af15d73bcb83e510f7f097f90a21a4280d2386a04a2c1c490d8709f4b2bdf3d0d95d2aca0b6052ecc4a4c6a93fa33fba6ff0200000000
</code></pre>
<p>Then <code>sighash</code>: <code>54383836474379391a2ef0151bdbd9dc0e3b0e770f5052c433952082b09a2d7d</code>.</p>
<p>The <code>merkle_root</code>: <code>ec24ababd925ccbc309ce2684694fa32d17a8263b0a3f2d2999febfdfc7e5d28</code>.</p>
<p>And the <code>tweaked_pubkey</code>: <code>dde70c00d3aec1533bd7f8b6f704ec21e6ed0a0de317a0ccf8199abde58d3062</code>.</p>
<p>In the end, I use signature <code>318bd919ead99017116322d9b861fef0e1f7d26a115dcc7b48fba34bfd5be023ef6d5ab364861b99bd0950ff74b3e93e50c6fd6d17751336f0cf435bb0738c5d</code> to verify with <code>sighash</code> and <code>tweaked_pubkey</code>, but failed.</p>

CC BY-SA 4.0
2023-05-29T13:12:45.963Z
If it's a script path spend, the signature in it should be verified against the public key at it appears in the script, not the tweaked pubkey (the latter is only for key path spends).
Pieter Wuille
CC BY-SA 4.0
2023-05-29T13:52:56.627Z
@peter Thank you. I tried the internal pubkey `64a5ee88fba503623726eabb0aa54bcced4eb2328d30dd05c8088bf5ed26fc41`, but still can't pass the schnorr signature verify.
lj zn
<taproot><schnorr-signatures><p2tr>
Taproot Script Path Spending can't pass signature verification
lj zn
# Taproot Script Path Spending can't pass signature verification

(Asked by: username_0 on 2023-05-29)

I am trying to verify the witness of a P2TR transaction, but the signature verification failed, could you please help?
The raw transaction:
010000000001016dacbb729930a8ba699a4188880d1b3525f430e52ad0c01fb4f6eae7987febd50300000000fdffffff014a01000000000000225120e2bc122cdb981a985074e182db9120e52c79b96710d517f84ab186c6ab092c4a0340318bd919ead99017116322d9b861fef0e1f7d26a115dcc7b48fba34bfd5be023ef6d5ab364861b99bd0950ff74b3e93e50c6fd6d17751336f0cf435bb0738c5d8e2064a5ee88fba503623726eabb0aa54bcced4eb2328d30dd05c8088bf5ed26fc41ac0063036f7264010118746578742f706c61696e3b636861727365743d7574662d3800487b2270223a226f72632d3230222c20227469636b223a226d656d65222c20226964223a2233333838303736222c20226f70223a226d696e74222c2022616d74223a2231303030227d6821c064a5ee88fba503623726eabb0aa54bcced4eb2328d30dd05c8088bf5ed26fc4100000000

The scriptpubkey of input: 5120dde70c00d3aec1533bd7f8b6f704ec21e6ed0a0de317a0ccf8199abde58d3062 , and the value: 4677.
Above are arguments, and I generate a sigmsg from those arguments:
000101000000000000009d9a573f31fa9eb2787db1c5d2162e36d76d21b0ecfa8c1e65617a4f5ca4a54bb4e368d5ab0ab9129e0c72ac46249d5bb8dc63b28638ebbc35bb69f62bae4ef4e342cce0133cd546aca2580d6f5bc5a184674e8dadda449fcfd073f503a44fe423e9829bfb4e23fbd3c4848baa035af15d73bcb83e510f7f097f90a21a4280d2386a04a2c1c490d8709f4b2bdf3d0d95d2aca0b6052ecc4a4c6a93fa33fba6ff0200000000

Then sighash: 54383836474379391a2ef0151bdbd9dc0e3b0e770f5052c433952082b09a2d7d.
The merkle_root: ec24ababd925ccbc309ce2684694fa32d17a8263b0a3f2d2999febfdfc7e5d28.
And the tweaked_pubkey: dde70c00d3aec1533bd7f8b6f704ec21e6ed0a0de317a0ccf8199abde58d3062.
In the end, I use signature 318bd919ead99017116322d9b861fef0e1f7d26a115dcc7b48fba34bfd5be023ef6d5ab364861b99bd0950ff74b3e93e50c6fd6d17751336f0cf435bb0738c5d to verify with sighash and tweaked_pubkey, but failed.

**Tags:** taproot, schnorr-signatures, p2tr

> **Comments:**
> **username_1**: If it's a script path spend, the signature in it should be verified against the public key at it appears in the script, not the tweaked pubkey (the latter is only for key path spends).  
> **username_0**: @peter Thank you. I tried the internal pubkey `64a5ee88fba503623726eabb0aa54bcced4eb2328d30dd05c8088bf5ed26fc41`, but still can't pass the schnorr signature verify.  

---

## 1 answers

### Answer by username_0 on 2023-05-30. Score: 1

Finally, I found the problem.

1. The signature is generated with the `default` sig type, aka `0x00`. But I use the `sighash_all`, aka `0x01` to generate the sighash.
2. I missed the [extension part](https://github.com/bitcoin/bips/blob/master/bip-0342.mediawiki#common-signature-message-extension). Which is  <0x00> <0xFFFFFFFF>, and should be appended at the end of sigmsg.
3. As Peter commented, we need the internal pubkey to verify the script path spending.

> **Comments:**
> **username_1**: Not the internal pubkey, but the pubkey in the script. In this case they are the same, but they don't have to be.  

---

