public inbox for bitcoindev@googlegroups.com
 help / color / mirror / Atom feed

From: Anthony Towns <aj@erisian•com.au>
To: bitcoin-dev@lists•linuxfoundation.org
Subject: [bitcoin-dev] SIGHASH_ANYPREVOUT proposal
Date: Sat, 11 May 2019 06:38:04 +1000	[thread overview]
Message-ID: <20190510203804.554q333lw3l7qql4@erisian.com.au> (raw)

Hi everybody!

Here is a followup BIP draft that enables SIGHASH_ANYPREVOUT and
SIGHASH_ANYPREVOUTANYSCRIPT on top of taproot/tapscript. (This is NOINPUT,
despite the name change)

I don't think we are (or should be) as confident that ANYPREVOUT is
ready for implementation and deployment as we are that taproot is.
In particular, we were still coming up with surprising ways that these
style of signatures could maybe cause problems over the past few months,
despite "NOINPUT" having been around for years, and having been thinking
seriously about it for most of the last year. In comparison we've had
a roughed out security proof for taproot [0] for over a year now.

So far, the best approach (in my opinion) that we've come up with to
limit the possible negative impacts of these types of signatures is to
require an additional regular signature to accompany every ANYPREVOUT
signature. As such, it's included in the BIP draft.

In theory this ensures that no ANYPREVOUT tx can cause any more problems
than some existing tx could; but in practice this assumes that the private
key for that signature is maintained in a similar way to the private keys
currently securing transactions are. After passing this around privately,
I'm not convinced the theory will survive meeting adversarial reality,
in which case I don't think this draft will be suitable for adoption.

But maybe I'm too pessimistic, or maybe we can come up with either
a proof that ANYPREVOUT is already safe without any other measures,
or maybe we can come up with some better measures to ensure it's safe.
So in any case I'm still hopeful that publishing the best we've got is
helpful, even if that still isn't good enough.

The BIP draft can be found here:
 https://github.com/ajtowns/bips/blob/bip-anyprevout/bip-anyprevout.mediawiki

A sample implementation based on the taproot branch is here:
 https://github.com/ajtowns/bitcoin/commits/anyprevout

Some interesting features:

 * This demonstrates how to upgrade tapscript's existing CHECKSIG,
   CHECKSIGADD and CHECKSIGVERIFY opcodes for new SIGHASH methods or
   potentially a new signature scheme, a new elliptic curve or other
   public key scheme
 * This demonstrates a cheap way of using the taproot internal key
   as the public key for CHECKSIG operations in script
 * There are two variants, ANYPREVOUT and ANYPREVOUTANYSCRIPT, which
   seems helpful for eltoo
 * The BIP attempts to describe the security implications of ANYPREVOUT-style
   signatures

Cheers,
aj

[0] https://github.com/apoelstra/taproot/blob/master/main.tex

next             reply	other threads:[~2019-05-10 20:38 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-05-10 20:38 Anthony Towns [this message]
2019-05-22  2:47 ` Rusty Russell
2019-05-22 20:11   ` Anthony Towns
2019-05-27  1:26     ` Rusty Russell

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190510203804.554q333lw3l7qql4@erisian.com.au \
    --to=aj@erisian$(echo .)com.au \
    --cc=bitcoin-dev@lists$(echo .)linuxfoundation.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox