<p><a href="https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki#constructing-and-spending-taproot-outputs" rel="nofollow noreferrer">BIP 341</a> answers this. It is generally important to be able to prove that the internal public key that you choose is a point with an unknown private key. Otherwise a malicious party could hide a key path spend in the P2TR address, pretend not to have the private key for that internal public key but actually possess it.</p>
<p>BIP 341 also provides instructions on how to avoid leaking the fact that the P2TR address had no possible key path spend when it is spent from. If you don't care about this privacy leak you could just take the suggested point H.</p>
<blockquote>
<p>Pick as internal key a point with unknown discrete logarithm. One
example of such a point is H =
lift_x(0x0250929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803ac0)
which is constructed by taking the hash of the standard uncompressed
encoding of the secp256k1 base point G as X coordinate.</p>
<p>In order to avoid leaking the information that key path spending is
not possible it is recommended to pick a fresh integer r in the range
0...n-1 uniformly at random and use H + rG as internal key. It is possible to prove that this internal key does not have a known
discrete logarithm with respect to G by revealing r to a verifier who
can then reconstruct how the internal key was created.</p>
</blockquote>
<p>A closely related <a href="https://bitcoin.stackexchange.com/questions/99325/i-want-to-create-a-p2tr-pay-to-taproot-address-but-i-just-need-a-key-path-spen">question</a> is on how to grant access to a key path spend but not a script path spend.</p>

CC BY-SA 4.0
2020-10-29T22:17:43.557Z
Thanks! I publicly need to prove the fact that key-path spending is not possible at all. So either pick a point with an unknown discrete logarithm or pick a public key whose private key cannot be constructed.
Brqoo
CC BY-SA 4.0
2021-06-10T16:33:55.107Z
The internal public key needs to be a point on the curve, different from infinity. So that implies that it _has_ a discrete logarithm.
Pieter Wuille
CC BY-SA 4.0
2023-06-27T16:41:05.033Z
Hey, can you point out how to achieve this in JS, please? I'm having a hard time finding a library that does lift_X.
pxr_64
CC BY-SA 4.0
2020-10-29T21:49:44.840Z
2020-10-29T21:55:07.933Z
2020-10-29T21:55:07.933Z
Michael Folkson
<p>I want to struct a transaction output the key-path of which I want to be eliminated, so enforcing only the script path. In order to eliminate key-path, in my opinion, I should set &quot;Internal Public Key&quot; to &quot;0xFFFFFFFFFFF..&quot; making the corresponding &quot;Internal Private Key&quot; unknown so the key-path signature is. By doing so anyone interested in unlocking this output, including me, must follow the script path by fulfilling its conditions. Correct me if I'm wrong. Thanks.</p>
<p><a href="https://i.sstatic.net/JWcQ0.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/JWcQ0.png" alt="enter image description here" /></a></p>

<bitcoin-core><script><bitcoin-core-development><taproot><secp256k1>
Taproot - Eliminating Key Path
Brqoo
# Taproot - Eliminating Key Path

(Asked by: username_0 on 2020-10-29)

I want to struct a transaction output the key-path of which I want to be eliminated, so enforcing only the script path. In order to eliminate key-path, in my opinion, I should set "Internal Public Key" to "0xFFFFFFFFFFF.." making the corresponding "Internal Private Key" unknown so the key-path signature is. By doing so anyone interested in unlocking this output, including me, must follow the script path by fulfilling its conditions. Correct me if I'm wrong. Thanks.

[![enter image description here](https://i.sstatic.net/JWcQ0.png)](https://i.sstatic.net/JWcQ0.png)

**Tags:** bitcoin-core, script, bitcoin-core-development, taproot, secp256k1


---

## 1 answers

### Answer by username_1 on 2020-10-29. Score: 4 | Accepted answer

[BIP 341](https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki#constructing-and-spending-taproot-outputs) answers this. It is generally important to be able to prove that the internal public key that you choose is a point with an unknown private key. Otherwise a malicious party could hide a key path spend in the P2TR address, pretend not to have the private key for that internal public key but actually possess it.

BIP 341 also provides instructions on how to avoid leaking the fact that the P2TR address had no possible key path spend when it is spent from. If you don't care about this privacy leak you could just take the suggested point H.

> Pick as internal key a point with unknown discrete logarithm. One
> example of such a point is H =
> lift\_x(0x0250929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803ac0)
> which is constructed by taking the hash of the standard uncompressed
> encoding of the secp256k1 base point G as X coordinate.
>
> In order to avoid leaking the information that key path spending is
> not possible it is recommended to pick a fresh integer r in the range
> 0...n-1 uniformly at random and use H + rG as internal key. It is possible to prove that this internal key does not have a known
> discrete logarithm with respect to G by revealing r to a verifier who
> can then reconstruct how the internal key was created.

A closely related [question](https://bitcoin.stackexchange.com/questions/99325/i-want-to-create-a-p2tr-pay-to-taproot-address-but-i-just-need-a-key-path-spen) is on how to grant access to a key path spend but not a script path spend.

> **Comments:**
> **username_0**: Thanks! I publicly need to prove the fact that key-path spending is not possible at all. So either pick a point with an unknown discrete logarithm or pick a public key whose private key cannot be constructed.  
> **username_2**: The internal public key needs to be a point on the curve, different from infinity. So that implies that it _has_ a discrete logarithm.  
> **username_3**: Hey, can you point out how to achieve this in JS, please? I'm having a hard time finding a library that does lift_X.  

---

