From: Anthony Towns <aj@erisian•com.au>
To: Christian Decker <decker.christian@gmail•com>,
Bitcoin Protocol Discussion
<bitcoin-dev@lists•linuxfoundation.org>
Cc: lightning-dev@lists•linuxfoundation.org
Subject: Re: [bitcoin-dev] Continuing the discussion about noinput / anyprevout
Date: Wed, 2 Oct 2019 01:59:29 +1000 [thread overview]
Message-ID: <20191001155929.e2yznsetqesx2jxo@erisian.com.au> (raw)
In-Reply-To: <87wodp7w9f.fsf@gmail.com>
On Mon, Sep 30, 2019 at 03:23:56PM +0200, Christian Decker via bitcoin-dev wrote:
> With the recently renewed interest in eltoo, a proof-of-concept implementation
> [1], and the discussions regarding clean abstractions for off-chain protocols
> [2,3], I thought it might be time to revisit the `sighash_noinput` proposal
> (BIP-118 [4]), and AJ's `bip-anyprevout` proposal [5].
Hey Christian, thanks for the write up!
> ## Open questions
> The questions that remain to be addressed are the following:
> 1. General agreement on the usefulness of noinput / anyprevoutanyscript /
> anyprevout[?]
> 2. Is there strong support or opposition to the chaperone signatures[?]
> 3. The same for output tagging / explicit opt-in[?]
> 4. Shall we merge BIP-118 and bip-anyprevout. This would likely reduce the
> confusion and make for simpler discussions in the end.
I think there's an important open question you missed from this list:
(1.5) do we really understand what the dangers of noinput/anyprevout-style
constructions actually are?
My impression on the first 3.5 q's is: (1) yes, (1.5) not really,
(2) weak opposition for requiring chaperone sigs, (3) mixed (weak)
support/opposition for output tagging.
My thinking at the moment (subject to change!) is:
* anyprevout signatures make the address you're signing for less safe,
which may cause you to lose funds when additional coins are sent to
the same address; this can be avoided if handled with care (or if you
don't care about losing funds in the event of address reuse)
* being able to guarantee that an address can never be signed for with
an anyprevout signature is therefore valuable; so having it be opt-in
at the tapscript level, rather than a sighash flag available for
key-path spends is valuable (I call this "opt-in", but it's hidden
until use via taproot rather than "explicit" as output tagging
would be)
* receiving funds spent via an anyprevout signature does not involve any
qualitatively new double-spending/malleability risks.
(eltoo is unavoidably malleable if there are multiple update
transactions (and chaperone signatures aren't used or are used with
well known keys), but while it is better to avoid this where possible,
it's something that's already easily dealt with simply by waiting
for confirmations, and whether a transaction is malleable is always
under the control of the sender not the receiver)
* as such, output tagging is also unnecessary, and there is also no
need for users to mark anyprevout spends as "tainted" in order to
wait for more confirmations than normal before considering those funds
"safe"
I think it might be good to have a public testnet (based on Richard Myers
et al's signet2 work?) where we have some fake exchanges/merchants/etc
and scheduled reorgs, and demo every weird noinput/anyprevout case anyone
can think of, and just work out if we need any extra code/tagging/whatever
to keep those fake exchanges/merchants from losing money (and write up
the weird cases we've found in a wiki or a paper so people can easily
tell if we missed something obvious).
Cheers,
aj
next prev parent reply other threads:[~2019-10-01 15:59 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-30 13:23 Christian Decker
2019-09-30 16:00 ` ZmnSCPxj
2019-09-30 23:28 ` ZmnSCPxj
2019-10-01 14:26 ` Christian Decker
2019-10-01 14:45 ` Anthony Towns
2019-10-01 15:42 ` ZmnSCPxj
2019-10-01 14:20 ` Christian Decker
2019-10-01 15:35 ` ZmnSCPxj
2019-10-03 9:42 ` Christian Decker
2019-10-01 12:23 ` Chris Stewart
2019-10-01 13:31 ` [bitcoin-dev] [Lightning-dev] " ZmnSCPxj
2019-10-03 10:01 ` Christian Decker
2019-10-03 9:57 ` Christian Decker
[not found] ` <CACJVCgJ9PL-2jTS71--tXsa=QkK+f5_ciYLwv468WUno=XXAig@mail.gmail.com>
2019-10-01 14:27 ` Ethan Heilman
2019-10-01 15:14 ` Chris Stewart
2019-10-03 10:30 ` Christian Decker
2019-10-01 15:59 ` Anthony Towns [this message]
2019-10-02 2:03 ` [bitcoin-dev] " ZmnSCPxj
2019-10-03 1:47 ` [bitcoin-dev] [Lightning-dev] " Anthony Towns
2019-10-03 3:07 ` ZmnSCPxj
2019-10-03 15:05 ` [bitcoin-dev] OP_CAT was " Ethan Heilman
2019-10-03 23:42 ` [bitcoin-dev] [Lightning-dev] " ZmnSCPxj
2019-10-04 0:48 ` Ethan Heilman
2019-10-04 5:02 ` Jeremy
2019-10-04 7:00 ` ZmnSCPxj
2019-10-04 18:33 ` Jeremy
2019-10-04 11:15 ` Peter Todd
2019-10-04 18:40 ` Jeremy
2019-10-05 15:49 ` Peter Todd
2019-10-06 8:46 ` ZmnSCPxj
2019-10-06 9:12 ` Peter Todd
2019-10-06 7:02 ` Lloyd Fournier
2019-10-09 16:56 ` Andrew Poelstra
2019-10-02 15:11 ` [bitcoin-dev] " s7r
2019-10-03 11:08 ` Christian Decker
2019-10-05 10:06 ` Anthony Towns
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191001155929.e2yznsetqesx2jxo@erisian.com.au \
--to=aj@erisian$(echo .)com.au \
--cc=bitcoin-dev@lists$(echo .)linuxfoundation.org \
--cc=decker.christian@gmail$(echo .)com \
--cc=lightning-dev@lists$(echo .)linuxfoundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox