<p>Yes, <code>ext_flag</code> is (currently) only <code>0</code> for key path spends. The only defined script path spend (Tapscript, <a href="https://github.com/bitcoin/bips/blob/master/bip-0342.mediawiki" rel="nofollow noreferrer">BIP342</a>) <a href="https://github.com/bitcoin/bips/blob/master/bip-0342.mediawiki#common-signature-message-extension" rel="nofollow noreferrer">sets <code>ext_flag</code> to <code>1</code></a>.</p>
<p>The size of a Taproot ScriptPubKey is indeed always 35 bytes because there is:</p>
<ul>
<li>1 byte for the size of the script</li>
<li>1 <code>OP_1</code></li>
<li>A 32 bytes push (which is 33 bytes accounting for the length prefix)</li>
</ul>

CC BY-SA 4.0
2023-05-04T11:04:01.843Z
2023-05-08T10:56:48.093Z
2023-05-08T10:56:48.093Z
Antoine Poinsot
<p><a href="https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki" rel="nofollow noreferrer">BIP-341</a> describes how to construct the message to be signed for taproot (subsection Common signature message). It mostly makes sense but I have a couple of quick questions:</p>
<ul>
<li><p>Is the ext_flag 0 when spending default key path and 1 if spending with a script?</p>
</li>
<li><p>In the 'Data about this input' it says that scriptPubKey is always 35 bytes. How so? I would assume it is (a) &quot;OP_1 OP_PUSHDATA(1) &lt;32 bytes&gt;&quot; so 34 bytes. Does &quot;serialized as script inside CTxOut&quot; mean that we need another byte for the length of (a), thus making it 35 bytes?</p>
</li>
</ul>

<taproot><schnorr-signatures>
Questions wrt taproot's message digest signing
karask
# Questions wrt taproot's message digest signing

(Asked by: username_0 on 2023-05-04)

[BIP-341](https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki) describes how to construct the message to be signed for taproot (subsection Common signature message). It mostly makes sense but I have a couple of quick questions:

* Is the ext\_flag 0 when spending default key path and 1 if spending with a script?
* In the 'Data about this input' it says that scriptPubKey is always 35 bytes. How so? I would assume it is (a) "OP\_1 OP\_PUSHDATA(1) <32 bytes>" so 34 bytes. Does "serialized as script inside CTxOut" mean that we need another byte for the length of (a), thus making it 35 bytes?

**Tags:** taproot, schnorr-signatures


---

## 1 answers

### Answer by username_1 on 2023-05-04. Score: 3 | Accepted answer

Yes, `ext_flag` is (currently) only `0` for key path spends. The only defined script path spend (Tapscript, [BIP342](https://github.com/bitcoin/bips/blob/master/bip-0342.mediawiki)) [sets `ext_flag` to `1`](https://github.com/bitcoin/bips/blob/master/bip-0342.mediawiki#common-signature-message-extension).

The size of a Taproot ScriptPubKey is indeed always 35 bytes because there is:

* 1 byte for the size of the script
* 1 `OP_1`
* A 32 bytes push (which is 33 bytes accounting for the length prefix)


---

