user123568: Suppose I get a taproot address=schnorr public key from an exchange that is not tweaked using mast merkle root and I wish to tweak that public key.
This will yield a potentially different public key.

Can I do this?
If I Do this, will the exchange still recognize my deposit?
In general, can I re-tweak already tweaked public keys at will?

Thanks.

user208: BIP341 recommends tweaking even public keys which have no intended script path, with a dummy tweak. This prevents certain attacks (though none relevant in your scenario).

You can tweak an existing public key, yes, but the address will get another meaning.

Absolutely not. Only the receiver's software determines which address they accept coins on. If you pay to anything else, you should assume the coins are sent into the void. It is possible that say an exchange can still access the coins with their keys if you inform them of the tweak, but this cannot be relied upon. The private keys may be in a hardware security module or so, which has no means of signing for anything but the intended address.

In a way, yes, but that turns it into another address, with other semantics.


In theory, if someone has the ability to sign for a public point P, they can sign for a tweaked version of P, assuming they know the tweak. The tweak cannot be inferred from the tweaked point; it has to be conveyed separately. This also works recursively, because if you can sign for a tweaked version, you can also signed for a tweak of that. Again however, this is theory and cannot be relied upon in practice. Only the receiver determines which address they accept.

user5406: No, this would likely lead to a loss of funds. Key tweaks are created by a recipient who tweaks a key before sharing the resulting tweaked public key in the form of a destination address.
If you tweak a foreign key, the original intended recipient would have no way of recognizing independently that that their key is associated with the new address at all, and very likely would be unable to spend the funds even when informed about the tweak.

123568: <p>Suppose I get a taproot address=schnorr public key from an exchange that is not tweaked using mast merkle root and I wish to tweak that public key.</p>
<p>This will yield a potentially different public key.</p>
<ol>
<li>Can I do this?</li>
<li>If I Do this, will the exchange still recognize my deposit?</li>
<li>In general, can I re-tweak already tweaked public keys at will?</li>
</ol>
<p>Thanks.</p>
 208: <p>BIP341 recommends tweaking even public keys which have no intended script path, with a dummy tweak. This prevents certain attacks (though none relevant in your scenario).</p>
<ol>
<li><p>You can tweak an existing public key, yes, but the address will get another meaning.</p>
</li>
<li><p>Absolutely not. Only the receiver's software determines which address they accept coins on. If you pay to anything else, you should assume the coins are sent into the void. It is <em>possible</em> that say an exchange can still access the coins with their keys if you inform them of the tweak, but this cannot be relied upon. The private keys may be in a hardware security module or so, which has no means of signing for anything but the intended address.</p>
</li>
<li><p>In a way, yes, but that turns it into another address, with other semantics.</p>
</li>
</ol>
<p>In <em>theory</em>, if someone has the ability to sign for a public point <em>P</em>, they can sign for a tweaked version of <em>P</em>, assuming they know the tweak. The tweak cannot be inferred from the tweaked point; it has to be conveyed separately. This also works recursively, because if you can sign for a tweaked version, you can also signed for a tweak of that. Again however, this is theory and cannot be relied upon in practice. Only the receiver determines which address they accept.</p>
 5406: <p>No, this would likely lead to a loss of funds. Key tweaks are created by a recipient who tweaks a key before sharing the resulting tweaked public key in the form of a destination address.</p>
<p>If you tweak a foreign key, the original intended recipient would have no way of recognizing independently that that their key is associated with the new address at all, and very likely would be unable to spend the funds even when informed about the tweak.</p>
