From: Luke Dashjr <luke@dashjr•org>
To: Christian Decker <decker.christian@gmail•com>
Cc: Bitcoin Dev <bitcoin-dev@lists•linuxfoundation.org>
Subject: Re: [bitcoin-dev] [BIP] Normalized transaction IDs
Date: Tue, 3 Nov 2015 22:01:20 +0000 [thread overview]
Message-ID: <201511032201.21047.luke@dashjr.org> (raw)
In-Reply-To: <CALxbBHVwv_T4=DTUdmbgG2y7QmjETCKbQ6_oKKNjsCS=HDrJ+A@mail.gmail.com>
On Tuesday, November 03, 2015 9:44:02 PM Christian Decker wrote:
> Ok, so assuming we can get a connected component of upgraded nodes that
> relay both the transaction and the associated external scripts then we
> could just piggyback the external scripts on top of the normal messages.
> Non-upgraded nodes will read the entire two-part message but only parse the
> classical transaction, dropping the external script. Validation rules for
> upgraded nodes are the same as before: if the attached signatures are
> invalid the entire TX is dropped. We have to commit to the external scripts
> used during the creation of a block. I think the easiest way to add this
> commitment is the coinbase input I guess, and following the transaction
> list a new list of signature lists is shipped with the rest of the block.
> Non-upgraded will ignore it as before.
I'd throw it in the merged-mining tree; it's not ideal, but it can be swapped
out for something better when it's ready (I'm working on such a BIP -
hopefully it can be before or at the same time as a SW deployment).
> Would that work? It all hinges on having upgraded miners in a connected
> component otherwise non-upgraded nodes will drop the external scripts on
> the way (since they parse and then reconstruct the messages along the
> path). But if it works this could be a much nicer solution.
It's actually better than that. If miners don't get the SW transactions, then
they just won't mine them, and the wallets will continue to rebroadcast until
they do. But realistically, the entire network will likely be running SW-
capable nodes long before any wallets have deployed SW transactions.
> > > As for open venues for malleability, I'm not sure we can fix them at
> > > all, after all the ability of a single signer to doublespend by
> > > appending/replacing inputs/outputs in an arbitrary fashion is not
> > > fixable IMHO and will cause any future transaction building on its
> > > outputs to be orphaned. What would the perfect properties for such a
> > > fix be?
> >
> > The problem isn't changing inputs/outputs, but that such changes
> > invalidate later spends. In particular, note that wallets *should
> > ideally* be actively trying to make transfers using multiple malleated
> > versions of the same payment.
>
> So this is indeed a form of desired malleability we will likely not be able
> to fix. I'd argue that this goes more into the direction of double-spending
> than a form of malleability, and is mostly out of scope for this BIP. As
> the abstract mentions this BIP attempts to eliminate damage incurred by
> malleability in the third party modification scenario and in the multisig
> scenario, with the added benefit of enabling transaction templating. If we
> can get the segregated witnesses approach working all the better, we don't
> even have the penalty of increased UTXO size. The problem of singlesig
> users doublespending their outputs to update transactions remains a problem
> even then.
I don't know what you're trying to say here. Double spending to the same
destination(s) and malleability are literally the same thing. Things affected
by malleability are still just as broken even with this BIP - whether it is
triggered by a third-party or not is not very relevant.
> > So the way to make an anti-malleable wallet, would be to strictly enforce
> > the
> > no-address-reuse rule on payments received (note this has no effect on
> > other/current wallets) and rely only on the hash of that
> > scriptPubKey+value for the input in subsequent transactions. This way,
> > no matter what inputs or
> > other outputs the transaction paying the address/invoice uses, the
> > subsequent
> > transaction ignores them and remains valid. (I am not suggesting this as
> > a mandatory change that all wallets must adopt to receive the current
> > semi- malleability protection you propose - only that it be *possible*
> > for wallets
> > to upgrade to or offer in the future.)
>
> Sounds very interesting. That would then be a new signature checking opcode
> I guess that would allow the transaction hash in the input be replaced by
> the hash of the serialized output it is spending? That way the transaction
> would not be detached from the coins unless the amount or the scriptpubkey
> (containing the address) is modified. So a user may add new outputs and
> inputs to an existing transaction like you mentioned.
Correct...
> This does not help someone receiving funds from a sender to build new
> transactions on top since the sender may simply doublespend its output
> before it is confirmed. I think this is probably best addressed in a
> separate proposal.
Huh??
Luke
next prev parent reply other threads:[~2015-11-03 22:02 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-10-19 14:01 Christian Decker
2015-10-19 15:23 ` Tier Nolan
2015-10-19 19:28 ` Christian Decker
2015-10-19 22:22 ` s7r
2015-10-20 10:30 ` Christian Decker
2015-10-21 6:18 ` Luke Dashjr
2015-10-21 7:39 ` Christian Decker
2015-10-21 7:52 ` Luke Dashjr
2015-10-21 8:31 ` Christian Decker
2015-10-21 8:39 ` Luke Dashjr
2015-10-21 8:44 ` Christian Decker
2015-10-21 8:46 ` Luke Dashjr
2015-10-21 18:22 ` Danny Thorpe
2015-10-21 19:27 ` Gregory Maxwell
2015-10-21 23:20 ` Luke Dashjr
2015-10-22 8:26 ` Christian Decker
2015-10-22 8:57 ` Gregory Maxwell
2015-10-22 11:54 ` Christian Decker
2015-10-22 9:05 ` Luke Dashjr
2015-11-03 20:37 ` Christian Decker
2015-11-03 20:48 ` Luke Dashjr
2015-11-03 21:44 ` Christian Decker
2015-11-03 22:01 ` Luke Dashjr [this message]
2015-11-05 15:27 ` Jorge Timón
2015-11-05 19:36 ` Luke Dashjr
2015-11-05 20:25 ` Jorge Timón
2015-11-05 22:46 ` s7r
2015-11-05 22:29 ` Adam Back
2015-11-06 14:52 ` Christian Decker
2015-11-04 4:00 ` Peter Todd
2015-11-05 9:38 ` Christian Decker
2015-10-21 7:48 ` Gregory Maxwell
2015-10-21 8:26 ` Gregory Maxwell
2015-10-21 8:49 ` Christian Decker
2015-10-21 8:50 ` Christian Decker
2015-10-21 10:14 ` Gregory Maxwell
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=201511032201.21047.luke@dashjr.org \
--to=luke@dashjr$(echo .)org \
--cc=bitcoin-dev@lists$(echo .)linuxfoundation.org \
--cc=decker.christian@gmail$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox