Thread by @dr_orlovsky

Continuing #Taproot series.

#2, pt 1/6. Taproot introduces new “common signature function” for signing tx with BIP-340 Schnorr signature. This function may be re-used in a future soft-forks (simplifying implementation/code review). It provides two ways of changing signing algo:

#2, pt 2/6. First, for incremental updates, where we do not change the order of data signed, but append new data to the end, we can use so-called *ext flag* - a value in range 0-127 passed as a parameter to the common signing function.

#2, pt 3/6. Tapscript (BIP-342) already uses this mechanism to add to the signed data commitment to a specific key serialization algo (which may change with future updates), script branch version & code (via tapleaf_hash) and code separator.

#2, pt 4/6. By default, if no script is used, taproot requires signatures to be created with ext_flag=0. If script is present, than the flag must be set to 1.

#2, pt 5/6. The second mechanism is so-called *sighash epoch*, used for introducing breaking changes in the signing function. It is defined as byte prefix provided to tagged hash function which produces out of tx data the actual message to sign.

#2, pt 6/6. Changes to signature procedure will always require soft fork, but with #taproot it may happen without an upgrade of witness version: by either using different length of v1 witness program – or via new leaf version value (introduction of new scripting)