TYPE 0x0203 · HASH FAMILY

TAGGED_HASH

BIP-340 tagged hash verification. Computes SHA256(SHA256(tag) || SHA256(tag) || preimage) and compares to an expected hash. The tag_hash field IS SHA256(tag) already.

Hash Invertible

Ladder Diagram

Fields

Field	Data Type	Size	Side	Description
tag_hash	HASH256	32 B	Conditions	SHA-256 of the tag string (pre-hashed for efficiency)
expected_hash	HASH256	32 B	Conditions	Expected tagged hash result
witness_tag_hash	HASH256	32 B	Witness	Copy of tag_hash, echoed in the witness for implicit layout matching
witness_expected_hash	HASH256	32 B	Witness	Copy of expected_hash, echoed in the witness for implicit layout matching
preimage	PREIMAGE	32 B	Witness	Data to hash with the tag

Wire Format Breakdown

Conditions side (in scriptPubKey):

0x0203 0 2 HASH256[0] · 32B HASH256[1] · 32B = 72 bytes

Witness side (in input witness):

0x0203 0 3 HASH256[0] · 32B HASH256[1] · 32B PREIMAGE · 32B = 102 bytes

Total (conditions + witness) ~174 bytes

Two condition HASH256 fields: one for the tag hash, one for the expected result.

Evaluation Logic

1. Require 2 HASH256 fields + PREIMAGE. Any missing → ERROR

2. Compute SHA256(tag_hash || tag_hash || PREIMAGE)

3. Compare result to expected_hash. If match → SATISFIED

4. Mismatch → UNSATISFIED

Return Values

Condition	Result
Missing HASH256 fields (need 2)	ERROR
Missing PREIMAGE field	ERROR
Tagged hash does not match expected_hash	UNSATISFIED
Tagged hash matches expected_hash	SATISFIED

JSON Wire Format

Conditions (scriptPubKey)

{
  "type": "TAGGED_HASH",
  "inverted": false,
  "fields": [
    { "type": "HASH256", "hex": "a1b2c3...32 bytes (tag_hash)" },
    { "type": "HASH256", "hex": "d4e5f6...32 bytes (expected)" }
  ]
}

Witness (input)

{
  "type": "TAGGED_HASH",
  "inverted": false,
  "fields": [
    { "type": "HASH256", "hex": "a1b2c3...32 bytes (tag_hash)" },
    { "type": "HASH256", "hex": "d4e5f6...32 bytes (expected)" },
    { "type": "PREIMAGE", "hex": "deadbeef...exactly 32 bytes" }
  ]
}

Use Cases

Domain-Separated Commitments

The tag provides domain separation, ensuring that a preimage valid in one context cannot be replayed in another. Different tags produce entirely different hashes from the same data.

BIP-340 Challenge Verification

Schnorr signature challenges use tagged hashes with the "BIP0340/challenge" tag. This block can verify that a specific challenge was correctly constructed from its components.

Taproot-Compatible Tagged Hashing

Taproot uses tagged hashes extensively (TapLeaf, TapBranch, TapTweak). This block enables on-chain verification of taproot tree construction and tweak derivation.

← CLTV_TIME CTV →