BIP352: add taproot key-path spend with annex vector #2337

Eunovo commented at 7:56 AM on October 23, 2026: contributor

Add a BIP-352 test vector where a taproot input is spent via the key path with an annex (2-item witness). The annex must be stripped before deciding between key-path and script-path spends, so the input is still eligible and all expected values match the plain key-path case.

theStack commented at 9:35 AM on October 23, 2026: contributor

Concept ACK

fametrano commented at 3:35 PM on October 23, 2026: none

btclib-wallet, a BIP352 implementation I maintain, reproduces the new vector at 48493fa: sending and receiving both match the expected values.

I ran its BIP352 tests at commit 3b88201 with this file in place of its copy of the vectors, and all tests on the new vector pass.

The vector does not catch a missing annex strip, though. With the strip removed from btclib-wallet, those tests still pass: the annex 0x5000 is taken for a control block, but not one with the NUMS internal key, so the input stays eligible. With the annex set to 0x50 followed by BIP341's NUMS key H, 0x5050929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803ac0, the same change fails on both sending and receiving, and the unmodified code still matches the expected values. Only the witness changes; its signature has to be redone, since BIP341 signs the annex.

jonatack added the label Tests on Oct 23, 2026

in bip-0352/send_and_receive_test_vectors.json:5605 in 48493fad2c

5600 | +                    "vin": [
5601 | +                        {
5602 | +                            "txid": "f4184fc596403b9d638783cf57adfe4c75c605f6356fbc91338530e9831e9e16",
5603 | +                            "vout": 0,
5604 | +                            "scriptSig": "",
5605 | +                            "txinwitness": "0240c459b671370d12cfb5acee76da7e3ba7cc29b0b4653e3af8388591082660137d087fdc8e89a612cd5d15be0febe61fc7cdcf3161a26e599a4514aa5c3e86f47b025000",

jonatack commented at 8:42 PM on October 23, 2026:

                            "txinwitness": "0240c459b671370d12cfb5acee76da7e3ba7cc29b0b4653e3af8388591082660137d087fdc8e89a612cd5d15be0febe61fc7cdcf3161a26e599a4514aa5c3e86f47b215050929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803ac0",

Eunovo commented at 6:30 AM on October 24, 2026:

Done.

in bip-0352/send_and_receive_test_vectors.json:5659 in 48493fad2c

5654 | +                    "vin": [
5655 | +                        {
5656 | +                            "txid": "f4184fc596403b9d638783cf57adfe4c75c605f6356fbc91338530e9831e9e16",
5657 | +                            "vout": 0,
5658 | +                            "scriptSig": "",
5659 | +                            "txinwitness": "0240c459b671370d12cfb5acee76da7e3ba7cc29b0b4653e3af8388591082660137d087fdc8e89a612cd5d15be0febe61fc7cdcf3161a26e599a4514aa5c3e86f47b025000",

jonatack commented at 8:42 PM on October 23, 2026:

                            "txinwitness": "0240c459b671370d12cfb5acee76da7e3ba7cc29b0b4653e3af8388591082660137d087fdc8e89a612cd5d15be0febe61fc7cdcf3161a26e599a4514aa5c3e86f47b215050929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803ac0",

Eunovo commented at 6:30 AM on October 24, 2026:

Done.

jonatack commented at 8:45 PM on October 23, 2026: member

Concept ACK

Agree with @fametrano's stronger annex (0x50 + BIP-341 NUMS point H), see suggestions below.

Eunovo force-pushed on Oct 24, 2026

Eunovo commented at 6:32 AM on October 24, 2026: contributor

The vector does not catch a missing annex strip, though. With the strip removed from btclib-wallet, those tests still pass: the annex 0x5000 is taken for a control block, but not one with the NUMS internal key, so the input stays eligible. With the annex set to 0x50 followed by BIP341's NUMS key H, 0x5050929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803ac0, the same change fails on both sending and receiving, and the unmodified code still matches the expected values. Only the witness changes; its signature has to be redone, since BIP341 signs the annex.

Thanks for the review. Done!

theStack commented at 4:02 AM on October 25, 2026: contributor

LGTM, can you rebase on master (this PR branch is still based on BIP-352 version 1.1.0 from March), and add a small changelog entry with bumped PATCH version? (see e.g. #2142 for an example).

BIP352: add taproot key-path spend with annex vector

Add a BIP-352 test vector where a taproot input is spent via the key path with an annex (2-item witness). The annex must be stripped before deciding between key-path and script-path spends, so the input is still eligible and all expected values match the plain key-path case.

The annex is 0x50 followed by the BIP341 NUMS point H, so an implementation that fails to strip it reads it as a control block with the NUMS internal key and wrongly skips the input.

3c68d3f3a1

Eunovo force-pushed on Oct 25, 2026

in bip-0352.mediawiki:1 in b19b139644 outdated

T10876 commented at 8:08 PM on October 25, 2026:

تم

T10876 commented at 8:08 PM on October 25, 2026:

نم

theStack approved

theStack commented at 9:41 AM on October 26, 2026: contributor

ACK b19b13964424bc59a6add5fe51ba7ada671f904b

jonatack commented at 1:17 PM on October 26, 2026: member

@Eunovo would you please update the Version header on line 16 in your last commit and squash.

BIP352: add changelog for 1.1.2

Add key-spend with annex test vector log

f827c44063

Eunovo force-pushed on Oct 26, 2026

theStack approved

theStack commented at 2:01 AM on October 27, 2026: contributor

re-ACK f827c440636a93e6033a4e10705ca7762594265b

jonatack merged this on Oct 27, 2026

jonatack closed this on Oct 27, 2026