Can I send assets to an address that I created from another's internal key?

[vbphung]

I'm building a wallet on top of Taproot Assets Protocol as my side project. And I have 2 questions today.

Q1: Could you guys give me a short explanation of the InternalKey and ScriptKey on newing an address and their usage in TAP? I've already read Mastering Bitcoin and some BIPs but these 2 keys are not familiar to me.

Q2: During newing a TAP addr, let's assume that Alice wants to send an asset to Bob. Can she do that without asking Bob to generate a new addr if she has Bob's InternalKey and ScriptKey?

The reason I ask the Q1 is because I think only the person that owns InternalKey or ScriptKey of an addr can spend the assets sent to this addr.

For Q2, I've done some tests and found out that when Alice creates an addr, for example of 100 CUST, from Bob's InternalKey - ScriptKey and sends to this addr, all of the outputs (as I queried from ListUtxos RPC) belong to her. However, she will not able to spend the output of above 100 CUST.

So if I guess correctly, TAP's ListUtxos RPC or the function getting utxos on sending are getting the utxos that were sent to the addresses that Alice created before without checking if these utxos can be really spent by her.

This is the error I got when trying to spend the similar ouput:

rpc error: code = Unknown desc = unable to sign and commit virtual packet: unable to generate Taproot Asset witness data: invalid transfer asset witness: 

[guggero]

Q1: The InternalKey refers to the BTC on-chain, Taproot internal key as defined in BIP-0341.
The ScriptKey is the asset-level key an individual asset output is locked by. The assets in an output can only be spent if there is a valid signature for the ScriptKey in the asset-level proof as well as a valid signature on the BTC level.
It is possible that Alice owns the InternalKey and Bob owns the ScriptKey, but then the two parties will need to cooperate and interact (using the vPSBT flow) to get valid signatures on both level and the TAP address end flow (which is generally referred to as the non-interactive send case) cannot be used.

Q2: While in theory it's possible to send assets to an address created from a set of keys that belong to Bob without explicitly creating an address on Bob's tapd, it will not work automatically. Bob will only expect funds to be sent to a TAP address if he knows which keys are used, what asset ID is inbound and how many units of it. Otherwise Bob will not be able to construct the BTC on-chain Taproot Output key to look for (e.g. the P2TR address to expect a transfer to). So Bob will not be aware of any inbound transfers.
BUT if you send to such an address that was created without Bob's knowledge (but using keys Bob owns), you can still create proofs and then send those proofs to Bob. Once Bob manually imports those proofs, he will be able to detect the assets and also spend them.

all of the outputs (as I queried from ListUtxos RPC) belong to her.

The concept of "belongs to her" is a bit tricky here... Because knowing a key exists and having an entry for it in the database is not the same as having the private key to be able to sign for it. And I think we don't yet fully differentiate between the two in all our APIs. I recently added the is_script_key_local to the ListAssets RPC which is true if the backing lnd wallet owns the private key for an asset's script key.
But I guess we should add a similar bool for all internal/script keys shown in our APIs.

[vbphung]

@guggero Thank you, your answer satisfied me in some ways.