MIME-Version: 1.0
In-Reply-To: <9FD4AF03-28A5-4B8A-9C12-CBCB1BC2E22C@friedenbach.org>
References: <5B6756D0-6BEF-4A01-BDB8-52C646916E29@friedenbach.org>
	<C623794E-F061-4C7A-B05D-378798ED2BF7@friedenbach.org>
	<201709190309.08669.luke@dashjr.org>
	<CAA2B000-6C54-4AD7-B931-43C99D615A61@friedenbach.org>
	<CAKzdR-phAarTY16BOnC95BPN0qMNEE_XZ9H-XmFeeaBc2V1U5w@mail.gmail.com>
	<3385CE20-C1BA-40DD-8FC3-8F53F3350717@friedenbach.org>
	<CAKzdR-pnvystx5H+P+OCXm73aVmWdyesCymerSgx=pCuXx+YGA@mail.gmail.com>
	<9FD4AF03-28A5-4B8A-9C12-CBCB1BC2E22C@friedenbach.org>
From: Sergio Demian Lerner <sergio.d.lerner@gmail.com>
Date: Fri, 22 Sep 2017 18:54:39 -0300
Message-ID: <CAKzdR-r6u4J+_T5X516A=-tLWZ8zFFFsRokReiJndDE_S64OqQ@mail.gmail.com>
To: Mark Friedenbach <mark@friedenbach.org>
Content-Type: multipart/alternative; boundary="001a114085f4d9f50e0559ce43d3"
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] cleanstack alt stack & softfork improvements
 (Was: Merkle branch verification & tail-call semantics for generalized
 MAST)
Precedence: list

--001a114085f4d9f50e0559ce43d3
Content-Type: text/plain; charset="UTF-8"

If the variable size increase is only a few bytes, then three possibilities
arise:

- one should allow signatures to be zero padded (to reach the maximum size)
and abandon strict DER encoding

- one should allow spare witness stack elements (to pad the size to match
the maximum size) and remove the cleanstack rule. But this is tricky
because empty stack elements must be counted as 1 byte.

- signers must loop the generation of signatures until the signature
generated is of its maximum size.


On Fri, Sep 22, 2017 at 6:39 PM, Mark Friedenbach <mark@friedenbach.org>
wrote:

> You generally know the witness size to within a few bytes right before
> signing. Why would you not? You know the size of ECDSA signatures. You can
> be told the size of a hash preimage by the other party. It takes some
> contriving to come up with a scheme where one party has variable-length
> signatures of their chosing
>
> > On Sep 22, 2017, at 2:32 PM, Sergio Demian Lerner <
> sergio.d.lerner@gmail.com> wrote:
> >
> > But generally before one signs a transaction one does not know the
> signature size (which may be variable). One can only estimate the maximum
> size.
>
>

--001a114085f4d9f50e0559ce43d3
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">If the variable size increase is only a few bytes, then th=
ree possibilities arise:<div><br></div><div>- one should allow signatures t=
o be zero padded (to reach the maximum size) and abandon strict DER encodin=
g</div><div><br></div><div>- one should allow spare witness stack elements =
(to pad the size to match the maximum size) and remove the cleanstack rule.=
 But this is tricky because empty stack elements must be counted as 1 byte.=
<div><br></div><div>- signers must loop the generation of signatures until =
the signature generated is of its maximum size.</div><div><br><div><br></di=
v><div><br></div></div></div></div><div class=3D"gmail_extra"><br><div clas=
s=3D"gmail_quote">On Fri, Sep 22, 2017 at 6:39 PM, Mark Friedenbach <span d=
ir=3D"ltr">&lt;<a href=3D"mailto:mark@friedenbach.org" target=3D"_blank">ma=
rk@friedenbach.org</a>&gt;</span> wrote:<br><blockquote class=3D"gmail_quot=
e" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">=
You generally know the witness size to within a few bytes right before sign=
ing. Why would you not? You know the size of ECDSA signatures. You can be t=
old the size of a hash preimage by the other party. It takes some contrivin=
g to come up with a scheme where one party has variable-length signatures o=
f their chosing<br>
<div class=3D"HOEnZb"><div class=3D"h5"><br>
&gt; On Sep 22, 2017, at 2:32 PM, Sergio Demian Lerner &lt;<a href=3D"mailt=
o:sergio.d.lerner@gmail.com">sergio.d.lerner@gmail.com</a>&gt; wrote:<br>
&gt;<br>
&gt; But generally before one signs a transaction one does not know the sig=
nature size (which may be variable). One can only estimate the maximum size=
.<br>
<br>
</div></div></blockquote></div><br></div>

--001a114085f4d9f50e0559ce43d3--