<p><a href="https://www.secg.org/sec1-v2.pdf" rel="nofollow noreferrer">SEC</a> encoded public keys are either:</p>
<ul>
<li><strong>Uncompressed</strong> 65-byte encoding: 0x04 + [32-byte X coordinate] + [32-byte Y coordinate]</li>
<li><strong>Compressed</strong> 33-byte encoding:
<ul>
<li>0x02 + [32-byte X coordinate] (if Y coordinate is even)</li>
<li>0x03 + [32-byte X coordinate] (if Y coordinate is odd).</li>
</ul>
</li>
</ul>
<p>P2TR outputs don't use SEC encoded public keys at all, but raw &quot;x-only&quot; public keys, in which only the 32-byte X coordinate itself is revealed. The used <a href="https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki" rel="nofollow noreferrer">BIP340</a> signature scheme is constructed in such a way that the Y coordinate does not matter.</p>

CC BY-SA 4.0
2023-01-23T15:25:16.330Z
2023-01-24T14:28:50.193Z
2023-01-24T14:28:50.193Z
Pieter Wuille
<p>Pay to Taproot uses x-only pubkeys.</p>
<p>In Bitcoin, a private key <em>d</em> is a scalar, and its corresponding public key <em>Q</em> is the elliptic curve point found by multiplying <em>d</em> with the generator <em>G</em> of secp256k1: <em>Q = d×G</em></p>
<p>For every x-coordinate on the secp256k1 curve, there exist exactly two y-coordinates that are each other’s negations: <em>Q = d×G</em> and <em>-Q = -d×G</em></p>
<p>The authors of the Taproot proposal <a href="https://blog.blockstream.com/reducing-bitcoin-transaction-sizes-with-x-only-pubkeys/" rel="noreferrer">noticed</a> that they could save a whole byte by dropping what essentially amounts to the sign of the public key at <a href="https://bitcoin.stackexchange.com/questions/90118/why-is-no-security-lost-by-using-32-byte-public-keys-in-schnorr-signatures-inste">no loss of security</a> by introducing a new serialization format called <em>x-only pubkeys</em>.</p>

CC BY-SA 4.0
2023-01-23T15:39:00.323Z
2023-01-23T16:05:20.130Z
2023-01-23T16:05:20.130Z
Murch
<p>From what I understand, a public key can be compressed from 64 bytes into 32 bytes, but an additional byte is needed for the sign, so it usually winds up being 33 bytes total. But P2TR addresses only do a PUSHBYTES_32. Am I incorrect in my understanding how compressed public keys work?</p>

<public-key><taproot><p2tr><x-only-pubkeys>
Is a P2TR address a compressed public key?
Hunter Beast
# Is a P2TR address a compressed public key?

(Asked by: username_0 on 2023-01-23)

From what I understand, a public key can be compressed from 64 bytes into 32 bytes, but an additional byte is needed for the sign, so it usually winds up being 33 bytes total. But P2TR addresses only do a PUSHBYTES\_32. Am I incorrect in my understanding how compressed public keys work?

**Tags:** public-key, taproot, p2tr, x-only-pubkeys


---

## 2 answers

### Answer by username_2 on 2023-01-23. Score: 7 | Accepted answer

Pay to Taproot uses x-only pubkeys.

In Bitcoin, a private key *d* is a scalar, and its corresponding public key *Q* is the elliptic curve point found by multiplying *d* with the generator *G* of secp256k1: *Q = d×G*

For every x-coordinate on the secp256k1 curve, there exist exactly two y-coordinates that are each other’s negations: *Q = d×G* and *-Q = -d×G*

The authors of the Taproot proposal [noticed](https://blog.blockstream.com/reducing-bitcoin-transaction-sizes-with-x-only-pubkeys/) that they could save a whole byte by dropping what essentially amounts to the sign of the public key at [no loss of security](https://bitcoin.stackexchange.com/questions/90118/why-is-no-security-lost-by-using-32-byte-public-keys-in-schnorr-signatures-inste) by introducing a new serialization format called *x-only pubkeys*.


---

### Answer by username_1 on 2023-01-23. Score: 9

[SEC](https://www.secg.org/sec1-v2.pdf) encoded public keys are either:

* **Uncompressed** 65-byte encoding: 0x04 + [32-byte X coordinate] + [32-byte Y coordinate]
* **Compressed** 33-byte encoding:
  + 0x02 + [32-byte X coordinate] (if Y coordinate is even)
  + 0x03 + [32-byte X coordinate] (if Y coordinate is odd).

P2TR outputs don't use SEC encoded public keys at all, but raw "x-only" public keys, in which only the 32-byte X coordinate itself is revealed. The used [BIP340](https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki) signature scheme is constructed in such a way that the Y coordinate does not matter.


---

