Date: Sun, 18 Sep 2016 12:05:24 -0400
From: Peter Todd <pete@petertodd.org>
To: Jannes Faber <j.faber@elevate.nl>
Message-ID: <20160918160524.GA13307@fedora-21-dvm>
References: <20160918042001.GA9076@fedora-21-dvm>
	<CABeL=0jSQsdyRFAUheQ9XSi1krM=PLFAARLXE8Du55FFkX8vZg@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="fdj2RfSjLxBAspz7"
Content-Disposition: inline
In-Reply-To: <CABeL=0jSQsdyRFAUheQ9XSi1krM=PLFAARLXE8Du55FFkX8vZg@mail.gmail.com>
User-Agent: Mutt/1.5.23 (2014-03-12)
Cc: Bitcoin Dev <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Interpreting nTime for the purpose of
 Bitcoin-attested timestamps
Precedence: list


--fdj2RfSjLxBAspz7
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sun, Sep 18, 2016 at 03:45:40PM +0200, Jannes Faber wrote:
> Would you not also have to consider (all) earlier blocks?
>=20
> T =3D max(block[i].nTime for i in {x-100, ..., x, ..., x + N-1}) + max_of=
fset
>=20
> In case one or more previous blocks have an nTime considerably in the
> future and blocks>=3D x have honest nTimes (or before true time).
>=20
> Maybe not strictly for the goal you were describing here (conservative
> estimate) but rather to prevent distinct timestamp events seeming to have
> happened in the wrong order?

Well that's the thing: timestamps are simply proofs that something existed
prior to some time, nothing more, nothing less.

So it doesn't make sense for there to be any notion of the "wrong order" in=
 a
timestamp proof; the proof either is or is not valid, but that has nothing =
to
do with other proofs. Additionally, the architecture of OpenTimestamps does=
n't
and can't make any 100% guarantees about the apparent order of timestamps,
because it's always possible for an earlier timestamp to end up committed in
the blockchain after a later timestamp gets committed. It's not all that li=
kely
of an event, but it is possible.

If you don't want that to be possible, you're going to need a dedicated cha=
in
of transactions for your particular purpose, which adds a lot of complexity,
cost, and makes it much harder to achieve the same level of availability for
the service as a whole.

Remember that for many use-cases the user experience is that there's two or
more claimed dates, and OpenTimestamps simply verifies that those dates are
plausible. Take for example, timestamped git commits:

    commit 536411e73b8c23dc2fdfd78052c893f578444926
    ots: Got 2 attestation(s) from cache
    ots: Success! Bitcoin attests data existed as of Thu Sep 15 01:07:08 20=
16 EDT
    ots: Good timestamp
    gpg: Signature made Thu 15 Sep 2016 12:10:25 AM EDT
    gpg:                using RSA key 6399011044E8AFB2
    gpg: Good signature from "Peter Todd <pete@petertodd.org>"
    gpg:                 aka "[jpeg image of size 5220]"
    Author: Peter Todd <pete@petertodd.org>
    Date:   Thu Sep 15 00:10:20 2016 -0400

        Release v0.2.0

Here we have the date on the git commit, another date a few seconds later f=
or
the PGP signature, and a third date an hour later for the Bitcoin timestamp,
attesting to the fact that the two other dates for that one git commit are
plausible.

--=20
https://petertodd.org 'peter'[:-1]@petertodd.org

--fdj2RfSjLxBAspz7
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----

iQEcBAEBCAAGBQJX3rtBAAoJEGOZARBE6K+yH5UH/2aeDx8Rdm5ayeiLStwmPlOZ
KrL/0mWocusEiSZWyOrqSUPVsKXGsAbd+q0nja43SVNbsBmijwlyUHvS20RCHDVm
vlrH5D1ibE8pfwaUMzTsh02bWsaNDbU5l2BsuG29fJE8HanGwnvE5JYE4PT+9PHh
2uQfQcsvrtjnfNH9xBuAnK3S/9hTZU6ZZuP10h8o0ANSzcrAMvGBe0qUEQv/USok
/mWIzIoZEvshjC0zHWGUhk4sJn+R2kgf3BAbxjLOWPPO5vPko2qNBE9vGAFI92Ai
BBohfbOijUbmefing+KgahDOdnbWWFxRllv375HGrIdbryUEtaUHOJPIQ+mEpRM=
=3EF+
-----END PGP SIGNATURE-----

--fdj2RfSjLxBAspz7--