Date: Wed, 13 Nov 2019 05:32:32 +0000
To: Clark Moody <clark@clarkmoody.com>,
	Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
From: ZmnSCPxj <ZmnSCPxj@protonmail.com>
Reply-To: ZmnSCPxj <ZmnSCPxj@protonmail.com>
Message-ID: <2sU6YozN9nn30cofkAMhffgjDLZwjG3mvF0nBgOsVQQEY9ROmP72GuHWjnBlF_qa8eeQPU8bxleZqcvRGJgS-uJ2xWYmAm9HjrFWWx_9o8k=@protonmail.com>
In-Reply-To: <CAHGSxGv_BQAAkdcxsqVsjphqaoE=Xm05jXhdBnGw+m+vRxeQYQ@mail.gmail.com>
References: <CAPg+sBjC-D2iWYywj_X-evQoWx56nb0YnASLVwCSCzWT6Guu3A@mail.gmail.com>
	<20191108021541.n3jk54vucplryrbl@ganymede>
	<CAPg+sBgus6HgYPVbXaAx51nO2ArsR3-6=obe2AwkO8kh11fB6Q@mail.gmail.com>
	<611b4e5b-e7cf-adc7-31e1-b5ff24b6574b@mattcorallo.com>
	<CAHGSxGv_BQAAkdcxsqVsjphqaoE=Xm05jXhdBnGw+m+vRxeQYQ@mail.gmail.com>
Feedback-ID: el4j0RWPRERue64lIQeq9Y2FP-mdB86tFqjmrJyEPR9VAtMovPEo9tvgA0CrTsSHJeeyPXqnoAu6DN-R04uJUg==:Ext:ProtonMail
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [bitcoin-dev] Bech32 weakness and impact on bip-taproot
	addresses
Precedence: list

Good morning all,

It seems to me that adding the length for checksumming purposes need not re=
quire the length to be *actually* added in the address format.

So, currently, below is my understanding of bech32 validation:

* Run BCH checksum on witness program.
* Compare checksum to checksum in address.
  * If the checksum matches:
    * If version is 0, validate that the witness program is length 20 or 32=
.
    * Else accept.
  * If the checksum does not match:
    * Reject

Let me propose then:

* Run BCH checksum on witness program.
* Compare checksum to checksum in address.
  * If the checksum matches:
    * If version is 0, validate that the witness program is length 20 or 32=
.
    * Else validate that the witness program is length 32.
  * If the checksum does not match:
    * Get the length of the witness program.
    * Prepend the length to the witness program.
    * Run BCH checksum on concatenated length | witness program.
    * Compare checksum to checksum in address.
      * If the checksum matches:
        * Accept.
      * Else reject.

A writer of bech32 addresses would then:

* If the witness program is length 32, or witness version is 0 and witness =
program length is 20, use a non-length-prefixed checksum.
* Otherwise, use a length-prefixed checksum (but not include the length in =
the address, just change the BCH checksum).

This has the following properties:

* The bech32 address format is retained, and no explicit length is added.
* There are now two checksum formats: one with just the witness program, th=
e other which validates with the witness program length.
  * Readers that do not understand the new checksum format will simply reje=
ct them without mis-sending to the wrong witness program.

Is the above acceptable?

Regards,
ZmnSCPxj