Public key recovery for EC leaves in P2MR (BIP-360)

A Delving Bitcoin thread proposing a fee-efficiency optimization for BIP-360's expected common pattern — a cheap elliptic-curve leaf for everyday spending next to an expensive post-quantum emergency leaf. The idea: a special "recoverable EC leaf" whose spend omits the public key from the witness entirely; verifiers recover the key mathematically from the Schnorr signature and check it against the output's Merkle root. That shrinks the everyday P2MR spend from roughly double a Taproot key spend to about 1.5×, without weakening the quantum protection (the key stays hidden until spend time).

The discussion is a working example of open review. Pieter Wuille judged the core idea sound but flagged the cost — it breaks batch verification, a BIP-340 design requirement — and during the thread a related-key attack on an early variant was found (credited to conduition) and fixed by committing the signature to the exact spending path. The thread then widened: Anthony Towns sketched P2TRH (a hashed Taproot key with the same recovery trick), and Wuille produced a side-by-side table of exactly which conditions each contender — P2TRv2, P2TRH, P2MR, and a PQ-only variant — stays quantum-safe under.

As of mid-July 2026 the thread was still active, with the author and others treating the optimization as a candidate to fold into BIP-360 before any activation.