Subject: Re: [bitcoindev] Signing a Bitcoin Transaction with Lamport Signatures (no changes needed)

From: "David A. Harding" <[email-masked]>
Date: Sun, 05 May 2024 21:39:51 -1000

On 2024-04-30 04:21, Andrew Poelstra wrote:
> Another reason this is useful is that if you have a Lamport signature 
> on
> the stack which is composed of SIZE values, all of which are small
> enough to be manipulated with the numeric script opcodes, then you can
> do covenants in Script.

Hi Andrew,

I don't understand the above.  I think of a covenant as a script that is 
able to restrict the scriptPubKey of the transaction that spends it.  As 
I understand Heilman's description, a lamport signature commits to the 
size of an ECDSA signature (which can naturally vary) and the ECDSA 
signature commits to the spending transaction.  Performing the lamport 
verification on the stack is practically equivalent to 
OP_CHECKSIGFROMSTACK, which is half of what you need for a covenant.  As 
you've previously described[1], the other half is some method for 
introspection.  How do lamport signatures offer introspection when 
they're restricted to committing to ECDSA signatures that can't be known 
at the time a script is created due to circular dependency in hashing 
(i.e., the ECDSA signature commits to the spending transaction, which 
commits to the previous transaction's txid, which commits to the 
script)?

Thanks!,

-Dave

[1] https://medium.com/blockstream/cat-and-schnorr-tricks-i-faf1b59bd298

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email-masked].
To view this discussion on the web visit https://groups.google.com/d/msgid/bitcoindev/47711dc4ffe9d661e8321b05b6adab4e%40dtrt.org.