Taproot is the most anticipated Bitcoin protocol update. We will explain what novelties it brings and why they are important.

Taproot update will bring two notable new features to the Bitcoin protocol:

• MAST
• Schnorr signature scheme

Each of these is a big upgrade on its own, but together they dramatically increase privacy and smart contract capabilities.

What is MAST?

MAST is an abbreviation for Merkelized Abstract Syntax Tree. Before explaining what MAST is, we must first explain how Bitcoin currently handles smart contracts.

P2SH

Smart contracts are created with conditions (scripts) that need to be met in order for smart contracts to be triggered or processed.

For example, a first condition could be that the coins can only be moved after 1 day and a second condition could be that John can move them instantly. At least one of these conditions must be met for the coins to be moved.

These conditions inside smart contracts are hidden and only the owner knows how to trigger them. The conditions are hidden with a hash* (condition is a private key, hash is a public key). This is also known as P2SH (pay to script hash). When the coins are moved by triggering one of the conditions, the condition and the hash of it are revealed. Everyone can later check if the hash of the condition equals the initial hash.

*hash is a random string of numbers and letters, similarly to a Bitcoin wallet address. To get a hash, a one-way function is used, meaning that you can always get the X value from Y, but you cannot get the Y value from X. Where X is a public key and Y is a private key.

The downside of P2SH is that every time one of the conditions is met, all of the other conditions are revealed at the same time. This allows other users of the ecosystem to find out how the funds could have been spent and poses a privacy risk. 

Another important downside is that there is a huge amount of data written for each condition which directly affects the transaction fees.

Why MAST over P2SH?

Merkelized Abstract Syntax Tree is a way of solving the privacy and data issue with Bitcoin smart contracts.

As explained above, P2SH reveals all the conditions because all of the conditions are hidden in a single hash, which means that once one of the conditions is met, all of the conditions become publicly known.

MAST, on the other hand, can hash each of the conditions individually, and only after each condition has been hashed it then hashes these hashed conditions into a single “master” hash, known as Merkle root. This consequently requires only one condition to be revealed once the condition is met as the rest of the conditions are still hidden behind a hash.

What is Schnorr?

(SDSS) Schnorr Digital Signature Scheme is an upcoming Bitcoin signature scheme to replace the current ECDSA (Elliptic Curve Digital Signature Algorithm).

Oddly enough, Schnorr Signatures were developed before ECDSA by Claus Schnorr, but were not used in Bitcoin since Schnorr patented it. The patent expired in 2008. Satoshi Nakamoto most likely preferred ECDSA because they were open-source, more understood and more generally known.

What is a signature?

All transactions on the blockchain must be signed before they are broadcasted and sent to another address. Transactions either require a single signature (basic wallets) or multi-signature (multisig wallet). Basic wallets can be operated by a single owner, while multisig wallets require multiple signatures for the transaction to be broadcasted to the blockchain.

What is a multisig transaction?

Multisig transactions must be signed by multiple private keys. For example, a multisig wallet could have a condition that at least 4 of 5 private keys and valid signatures must sign the transaction in order for it to be broadcasted further.

Why Schorr over ECDSA?

By default, Bitcoin does not support multisig wallets and uses a workaround to allow multisig transactions. This effectively increases the transaction size and directly impacts the transaction fees as there are multiple signatures written in the transaction (more bytes equals more fee) instead of just one private key. This poses an issue when using bigger multisig wallets, for example, one that requires 10 signatures. 

Additionally, when using ECDSA for signing the multisig transactions, everyone on the blockchain can see what wallets were used to sign the transaction. This is not good for privacy as all wallets are exposed on the blockchain.

Schnorr signed transactions are impossible to distinguish between single signed or multi-signed transactions as the length of the signature is always the same. When looking at transactions on the blockchain, both single and multisig transactions will look the same.

All of the multiple signers’ signatures are combined into one single signature which then signs the transaction. This solves both privacy and data issues with current multisig transactions.