consensus: Pay to Schnorr Key Hash (P2SKH) #34826

Summary

This PR is a PoC of BIP: Pay to Schnorr Key Hash (P2SKH), a new native SegWit output type that combines the compact 20-byte program of P2WPKH with the Schnorr signature efficiency of P2TR key-path spending.

Motivation

Existing single-key output types present an unresolved trade-off:

• P2WPKH achieves a 22-byte scriptPubKey by hashing the key, but uses ECDSA and requires the full 33-byte compressed pubkey in the witness (~108 witness bytes).
• P2TR adopts Schnorr signatures (64-byte witness), but embeds the full 32-byte x-only pubkey in the scriptPubKey, producing a 34-byte output — 12 bytes larger than P2WPKH — and exposing the key in every unspent output.

P2SKH closes this gap. The locking script commits to hash160(P.x) (20 bytes); spending requires a single 64-byte Schnorr signature. The verifier recovers the public key from the signature and checks its hash against the program — no key exposure in the UTXO set.

Key properties:

P2SKH achieves the smallest combined on-chain footprint of any current single-key type, reducing output sizes and UTXO set pressure while retaining the full efficiency of Schnorr signing.

Open Questions

1. Witness version conflict with BIP360. BIP360 currently claims witness version 2. If both proposals advance, one must cede its version number. The authors consider version 3 (OP_3) a viable alternative for P2SKH; the tradeoffs (address prefix, deployment ordering) should be discussed here.

2. Naming. "P2SKH" (Pay to Schnorr Key Hash) is the working name and follows the established P2*KH pattern. "P2TRKH" (Pay to Taproot Key Hash) has been suggested as an alternative to emphasise lineage from the Taproot family of Schnorr-based schemes. Other suggestions are welcome.

Thanks for taking a look.

♻️ Automatically closing for now based on heuristics. Please leave a comment, if this was erroneous. Generally, please focus on creating high-quality, original content that demonstrates a clear understanding of the project's requirements and goals.

📝 Moderators: If this is spam, please replace the title with ., so that the thread does not appear in search results.

<!--e57a25ab6845829454e8d69fc972939a-->

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

<!--021abf342d371248e50ceaed478a90ca-->

Reviews

See the guideline for information on the review process. A summary of reviews will appear here.

<!--5faf32d7da4f0f540f40219e4f7537a3-->

LLM Linter (✨ experimental)

Possible places where named args for integral literals may be used (e.g. func(x, /*named_arg=*/0) in C++, and func(x, named_arg=0) in Python):

• [secp256k1_ge_set_xo_var(&r, &rx, 0)] in src/secp256k1/src/modules/p2skh/main_impl.h

^{2026-03-15 18:37:44}