<KeyA> OP_CHECKSIG
OP_IF
<KeyB>
OP_ELSE
<Delay> OP_CSV OP_DROP
OP_CODESEPARATOR <KeyA>
OP_ENDIF
OP_CHECKSIG
It is actually 2 scripts:
S1: <KeyA> OP_CHECKSIGVERIFY <KeyB> OP_CHECKSIG
S2: <Delay> OP_CSV OP_DROP <KeyA> OP_CHECKSIG
Under taproot, we could make Q = P + H(P||S2)G, where P = MuSig(KeyA, KeyB)
S1 becomes a direct spending with Q, and there is no need to use OP_IF or CODESEPARATOR in S2 at all.
==================
If it is only to force R reuse, there is no need to use CODESEPARATOR:
Input: <R> <S2> <S1> Script: 2DUP EQUAL NOT VERIFY 2 PICK SWAP CAT <key> DUP TOALTSTACK CHECKSIGVERIFY CAT FROMALTSTACK CHECKSIG
But using CODESEPARATOR will save 3 bytes
Input: <S2> <R> <S1> Script: OVER SWAP CAT <key> DUP TOALTSTACK CHECKSIGVERIFY CODESEPARATOR SWAP CAT FROMALTSTACK CHECKSIG
However, a much better way would be:
Input: <S> Script: <known R> SWAP CAT <key> CHECKSIG
The discrete log of R could be a shared secret between A and B. If the purpose is to publish the private key to the whole world, R = G could be used.
Good morning,
Could anyone propose a better use case of CODESEPARATOR?
Long ago, aj sent an email on Lightning-dev about use of CODESEPARATOR to impose Scriptless Script even without Schnorr. It involved 3 signatures with different CODESEPARATOR places, and forced R reuse so that the signatures to claim the funds revealed the privkey.
The script shown had all CODESEPARATOR in a single branch.
I cannot claim to understand the script, and am having difficulty digging through the mailinglist
Regards,
ZmnSCPxj