Support Taproot

[tsusanka]

Support Taproot in firmware.

Tasks:

• [x] Make secp256k1-zkp default:
  • https://github.com/trezor/trezor-firmware/issues/1534
  • PR https://github.com/trezor/trezor-firmware/pull/1678
• [x] Support new transaction format
• [x] Decide BIP-44 paths
• [x] Implement Bech32m address format (bip-0350)

Docs:

• BIP 340: Schnorr Signatures
• BIP 341: Taproot: SegWit version 1 spending rules
• BIP 342: Validation of Taproot Scripts
• BIP 350: Bech32m format for v1+ witness addresses

[prusnak]

FTR: Taproot softfork will activate in mid-November 2021.

[tsusanka]

@prusnak could you fill in the last bullet point please? I did not catch it properly what was it.

[prusnak]

@prusnak could you fill in the last bullet point please? I did not catch it properly what was it.

Done

[andrewkozlik]

Additional tasks:

• [x] In SignTx implement the BIP-341 "common signature message" computation.
• [x] In SignTx disable streaming of previous transactions if all internal inputs are taproot.
• [x] Implement taproot support in scripts.py, i.e. output_script_native_p2tr() , witness_p2tr(), parse_witness_p2tr() etc.
• [ ] Decide how best to implement multisig for taproot in Trezor
  • MuSig (interactive signing) vs. unagreggated multisig (non-interactive).
  • Consider that taproot allows encoding more complicated schemes, e.g. with four keys A, B, C and D, we can have something like "A or (B and C) or (B and D)". This would require modifications to MultisigRedeemScriptType.
• [ ] Implement multisig scripts for taproot.
• [x] Use new Bech32m format in GetAddress.
• [x] Support taproot scripts and Schnorr signatures in SignatureVerifier.
• [ ] Support taproot scripts and Schnorr signatures in GetOwnershipProof and in verify_nonownership().
• [ ] Figure out how to deal with taproot in SignMessage and VerifyMessage. Bitcoin Core doesn't seem to use Schnorr signatures for signing messages. This is related to AOPP support https://github.com/trezor/trezor-firmware/issues/1586.

[prusnak]

[ ] Decide how best to implement multisig for taproot in Trezor

I prefer to transfer the multisig related tasks to a separate topic (new epic issue) and focus this effort only for single-sig Taproot.

[andrewkozlik]

• [x] Decide BIP-44 paths

Andrew Chow is proposing to use a new purpose number for taproot paths: https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2021-June/019096.html https://github.com/bitcoin/bips/pull/1137

[bosomt]

QA OK

[gruve-p]

Is the support for Taproot also being implemented for altcoins like GRS? GRS has activated Taproot since june 2021 and Electrum-GRS has support for sending to Taproot addresses.

[matejcik]

@gruve-p not at this time, but please create a separate issue. Enabling Taproot for other coins should not be difficult.

[tsusanka]

Let's close this and separate some of the subtasks from Andrew into new issues?

[andrewkozlik]

Let's close this and separate some of the subtasks from Andrew into new issues?

Done: https://github.com/trezor/trezor-firmware/issues/1943, https://github.com/trezor/trezor-firmware/issues/1944, https://github.com/trezor/trezor-firmware/issues/1946.

[gruve-p]

@matejcik My attempt to enable Taproot for GRS: https://github.com/trezor/trezor-firmware/pull/2030