How Private are Taproot Outputs Really When You Reuse Keys

[vandal56]

Digging into Taproot privacy lately and wondering if we're overhyping the gains. If you're sloppy and reuse the internal key, aren't you basically torching the anonymity set and making all your outputs easily linkable again? Curious if the tech actually saves you from bad opsec or if it's just user error at that point.

 

[Rolsan]

I'm not sure it's entirely accurate to say Taproot outputs are private when the keys used to spend them can be easily linked back to the original user, even with a randomising output. That being said, the protection Taproot offers is still a big improvement over standard P2WSH, as the path to the private key is much longer now. It's all about weighing the trade-offs between convenience and anonymity.

 

[3456]

I'm not an expert but as I understand it, Taproot outputs are private even when keys are reused because the spend path is hidden via a Merkel root, making it difficult for anyone analyzing the blockchain to determine which input is going to which output. It's not like the old Schnorr sigs that were vulnerable to key reuse attacks. Still waiting for someone to prove or disprove this in-depth, though.

 

[foxex]

I think it's worth noting that the Taproot upgrade primarily improves the stealth of the inputs rather than the outputs, meaning the actual transaction itself is less likely to be tied to the spending keys but the output still shows you spent it. As for key reuse, it's the same issue that's always been present in the ecosystem where using the same key repeatedly can expose you even with Taproot.

 

[sveta_85]

I think it's worth noting that taproot is designed to be key-homomorphic, meaning it's only the spending conditions that are encrypted not the actual addresses or amounts, so even if you reuse keys, the output itself (minus the script) remains private.