MIME-Version: 1.0
References: <CAH5Bsr2vxL3FWXnJTszMQj83jTVdRvvuVpimEfY7JpFCyP1AZA@mail.gmail.com>
 <2b316504-f785-b1b3-9ff9-8d781d6c0d9b@gmail.com>
In-Reply-To: <2b316504-f785-b1b3-9ff9-8d781d6c0d9b@gmail.com>
From: Thibaut Le Guilly <thibaut@cryptogarage.co.jp>
Date: Thu, 27 Jan 2022 09:45:12 +0900
Message-ID: <CABPZDUyMmyt0UCmHYfm+s-zs=iLjxXB0VtdJZ64X5HA3XLFESA@mail.gmail.com>
To: Jonas Nick <jonasdnick@gmail.com>, 
 Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: multipart/alternative; boundary="000000000000324bbe05d685a28d"
Cc: dlc-dev@mailmanlists.org
Subject: Re: [bitcoin-dev] [dlc-dev] CTV dramatically improves DLCs
Precedence: list

--000000000000324bbe05d685a28d
Content-Type: text/plain; charset="UTF-8"

Hi,

Lloyd, thanks for this excellent writeup. I must say that indeed using CTV
seems like it would very much lower the complexity of the DLC protocol (and
it seems like APO would also work, thanks Jonas for pointing that out).
Though thinking about it, I can't help wondering if the ideal op code for
DLC wouldn't actually be CHECKSIGFROMSTACK? It feels to me that this would
give the most natural way of doing things. If I'm not mistaken, this would
enable simply requiring an oracle signature over the outcome, without any
special trick, and without even needing the oracle to release a nonce in
advance (the oracle could sign `event_outcome + event_id` to avoid
signature reuse). I must say that I haven't studied covenant opcodes in
detail yet so is that line of thinking correct or am I missing something?

Cheers,

Thibaut

On Wed, Jan 26, 2022 at 1:27 AM Jonas Nick via bitcoin-dev <
bitcoin-dev@lists.linuxfoundation.org> wrote:

> Thank you, that's an interesting application of OP_CTV.
>
> Perhaps worth pointing out that this does not require OP_CTV but could
> also be
> enabled by other covenant constructions. For example, it seems like
> ANYPREVOUT-based covenants provide similar benefits. The script of the
> Taproot
> leaves could be set to
>
> <sig> <G> CHECKSIGVERIFY <CET_i> CHECKSIGVERIFY
>
> where <sig> is an ANYPREVOUTANYSCRIPT signature of the CET for public key
> P = G.
> When using nonce R = G, signature creation has negligible computational
> cost (s
> = 1 + H(R, P, m)). A downside compared to CTV is the additional overhead
> of 64
> witness bytes (<sig>).
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>

--000000000000324bbe05d685a28d
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi,<div><br></div><div>Lloyd, thanks for this excellent=C2=
=A0writeup. I must say that indeed using CTV seems like it would very much =
lower the complexity of the DLC protocol (and it seems like APO would also =
work, thanks Jonas for pointing that out). Though thinking about it, I can&=
#39;t help wondering if the ideal op code for DLC wouldn&#39;t actually be =
CHECKSIGFROMSTACK? It feels to me that this would give the most natural way=
 of doing things. If I&#39;m not mistaken, this would enable simply requiri=
ng an oracle signature over the outcome, without any special trick, and wit=
hout even needing the oracle to release a nonce in advance (the oracle coul=
d sign `event_outcome=C2=A0+ event_id` to avoid signature reuse). I must sa=
y that I haven&#39;t studied covenant=C2=A0opcodes in detail yet so is that=
 line of thinking correct or am I=C2=A0missing something?</div><div><br></d=
iv><div>Cheers,</div><div><br></div><div>Thibaut</div></div><br><div class=
=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Wed, Jan 26, 2022=
 at 1:27 AM Jonas Nick via bitcoin-dev &lt;<a href=3D"mailto:bitcoin-dev@li=
sts.linuxfoundation.org">bitcoin-dev@lists.linuxfoundation.org</a>&gt; wrot=
e:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0=
.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Thank you, th=
at&#39;s an interesting application of OP_CTV.<br>
<br>
Perhaps worth pointing out that this does not require OP_CTV but could also=
 be<br>
enabled by other covenant constructions. For example, it seems like<br>
ANYPREVOUT-based covenants provide similar benefits. The script of the Tapr=
oot<br>
leaves could be set to<br>
<br>
&lt;sig&gt; &lt;G&gt; CHECKSIGVERIFY &lt;CET_i&gt; CHECKSIGVERIFY<br>
<br>
where &lt;sig&gt; is an ANYPREVOUTANYSCRIPT signature of the CET for public=
 key P =3D G.<br>
When using nonce R =3D G, signature creation has negligible computational c=
ost (s<br>
=3D 1 + H(R, P, m)). A downside compared to CTV is the additional overhead =
of 64<br>
witness bytes (&lt;sig&gt;).<br>
_______________________________________________<br>
bitcoin-dev mailing list<br>
<a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.org" target=3D"_blank">=
bitcoin-dev@lists.linuxfoundation.org</a><br>
<a href=3D"https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev" =
rel=3D"noreferrer" target=3D"_blank">https://lists.linuxfoundation.org/mail=
man/listinfo/bitcoin-dev</a><br>
</blockquote></div>

--000000000000324bbe05d685a28d--