NUT-10: Taproot secrets (v3 keysets) - #421
Open
robwoodgate wants to merge 2 commits into
Open
Conversation
Defines the v3 secret family: point secrets with conditions committed into the key (a BIP341-style tree of declarative leaves), one transaction transcript that every input signs, key and script path witnesses, spend info for transfer, and receive-time verification. Existing NUTs gain version-scoped deltas: NUT-00 (secret bytes, secret uniqueness, si in the V4 format), NUT-03/05 (v3 inputs witness the transcript), NUT-04 (v3 quotes are locked transaction inputs), NUT-29 (a batch is one transaction), NUT-11/14/20 (scoped to pre-v3 keysets), NUT-13 (v3 secret key branch), NUT-18/26 (the taproot payment request option, TLV tag 0x0b), NUT-28 (the blinding core one layer down: slot map, value matching, verbatim NUMS bases). Adds tests/10-tests.md and extends the NUT-13/18/26/28 vectors; all values are produced and cross-verified by two implementations.
The NUT-13 V3 vectors are re-derived under the framed keyset id, keeping the secret-key semantics, and the NUT-10 transcript and token vectors are realigned with the regenerated shared vector file.
This was referenced Aug 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implementations
These are Proof of concept implementations.
Summary
Formalizes taproot secrets, the secret family for v3 (BLS) keysets, as version-scoped additions to the existing NUTs rather than a new NUT.
The core expands NUT-10: secrets are compressed secp256k1 points, bare or tweaked BIP341-style over a tree of declarative condition leaves (
threshold,after,hashlock); a shared TLV grammar; the transaction transcript that every v3 input signs; key path and script path witnesses; spend info for transfer; and receive-time verification. Full design rationale lives in the discussion draft and is deliberately kept out of the spec text.Per-NUT deltas:
hash_to_curve_G1; secret uniqueness stated on theProofmodel;sishown in the V4 token format.signaturefield. NUT-29: a batch is one transaction, one digest.SECP256K1_N); per-purpose derivation paths are superseded for v3.taprootpayment request option (k,l,b), carried in creqB under new TLV tag0x0b.Test vectors
New
tests/10-tests.md(leaf forms, tree folds, worked derivations, transaction transcripts with signatures, V4 tokens with spend info) plus additions to the NUT-13/18/26/28 vectors. Every value is produced by one of two independent implementations (cashu-ts and nutshell) that pass a shared integration suite against each other, and the tree, tweak, and transcript values were re-derived independently during review.Stacking
Builds on #371 (BLS12-381 v3 keyset protocol). The PR is based on
bls-protocol(#371's content with current main merged in), so the diff here is the taproot change alone. Once #371 merges to main, this retargets to main and the stack base branch can be deleted.