Return-Path: Received: from smtp4.osuosl.org (smtp4.osuosl.org [140.211.166.137]) by lists.linuxfoundation.org (Postfix) with ESMTP id 431ECC000D for ; Sat, 18 Sep 2021 14:11:27 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp4.osuosl.org (Postfix) with ESMTP id 2BE3E425E6 for ; Sat, 18 Sep 2021 14:11:27 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org X-Spam-Flag: NO X-Spam-Score: -0.199 X-Spam-Level: X-Spam-Status: No, score=-0.199 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: smtp4.osuosl.org (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from smtp4.osuosl.org ([127.0.0.1]) by localhost (smtp4.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Bd-HUFY7qwnz for ; Sat, 18 Sep 2021 14:11:25 +0000 (UTC) X-Greylist: whitelisted by SQLgrey-1.8.0 Received: from mail-wr1-x432.google.com (mail-wr1-x432.google.com [IPv6:2a00:1450:4864:20::432]) by smtp4.osuosl.org (Postfix) with ESMTPS id D33D8425DE for ; Sat, 18 Sep 2021 14:11:24 +0000 (UTC) Received: by mail-wr1-x432.google.com with SMTP id t8so19992400wrq.4 for ; Sat, 18 Sep 2021 07:11:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=e3+jBOtYXTnfV9b0vATDkjq3VYkbTzghowah2T2l9MM=; b=L2AyLEG6j24RgLqA6twb2yiS8oezQsnliCtLbvgeb3xQnVBpvI2SPoB6UkWN524E0n 6Xbc2vw6LU96uIFxYOenBEnNdr2q0A+CIIXPdCuWBtoao8DEQoqNGjrJEnJM0a+glHIB 84x7PKZljY3zSZyaTDRYv+LnLLSyD2l70kfVX3p8vUjbR78Nlx94xjBOMxCBffj9uksM bfEJlY3jY07qv3hM3AoyuI6/dN7kRMhItV4ZPTcE9WphEv2H56vnTu/JHt50BcCrEjzr JvXvyoWAShSzoPaazXHcqbelKgrz5ddRvJHkwPE2RdTbkTT52wMAb1uYx/flOf6uf5Xx vWKg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=e3+jBOtYXTnfV9b0vATDkjq3VYkbTzghowah2T2l9MM=; b=5eAgYzJ2LavhuoU3+ZPhJHkBFv1FGquuxGaSiqD6sB0nNEEt+rTkA/fPIFWf+ULrfT SFbgJitujqV7olkZGN7LjuwgIQvjkxgNkDjUM6o6dm4LS3BEHR8KDyT7z5F31kCqlRKw KZsBuZvoiAMm8Wn1lRIxVxNr70LpOTjChqFbwm56s9U3vuOayXwcGVTJDo4l+UGm0K+D YYX7cDG+3rod1tzqKC3kapaK4X0gciyd6Tgqtb0wEjncqLUgE3jKbAFq4d1xj+BWYX99 rEOKb8NI8co0uOI/agk3dNS3idVm8efh2SIGGzkBFRCGbtHPCBUjv0NASSzTbRBx/kzy NkoA== X-Gm-Message-State: AOAM530pg8U7EbremnXeYAGlf5zQhIbC/Pvkofd1VGsZbXkr+GUlMIRC KFHs5HMvJBMuhOtQwVApn1+IvVvd2h/SFyjKC2Ayq1akXWo= X-Google-Smtp-Source: ABdhPJya1ml0IsViRPn9wIp3+xyZmC8ZWVD2Tnz2LGW+zuKQDEjWIlDG3xjJjvTNzGFHlaGv/0kXIzzxHP5NofoYL+M= X-Received: by 2002:a5d:4b0b:: with SMTP id v11mr18599274wrq.359.1631974282969; Sat, 18 Sep 2021 07:11:22 -0700 (PDT) MIME-Version: 1.0 References: <20210909064138.GA22496@erisian.com.au> <20210911032644.GB23578@erisian.com.au> <20210915065051.GA26119@erisian.com.au> In-Reply-To: <20210915065051.GA26119@erisian.com.au> From: Antoine Riard Date: Sat, 18 Sep 2021 10:11:10 -0400 Message-ID: To: Anthony Towns Content-Type: multipart/alternative; boundary="0000000000006b469205cc459ff4" X-Mailman-Approved-At: Sat, 18 Sep 2021 18:04:38 +0000 Cc: Bitcoin Protocol Discussion Subject: Re: [bitcoin-dev] TAPLEAF_UPDATE_VERIFY covenant opcode X-BeenThere: bitcoin-dev@lists.linuxfoundation.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Bitcoin Protocol Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 18 Sep 2021 14:11:27 -0000 --0000000000006b469205cc459ff4 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable > I think "

MERKLESUB" is the same as "

OP_0 2 TLUV", provided > happens to be the same index as the current input. So it misses the > ability to add branches (replacing OP_0 with a hash), the ability to > preserve the current script (replacing 2 with 0), and the ability to > remove some of the parent paths (replacing 2 with 4*n); but gains the > ability to refer to non-corresponding outputs. Yes, I agree. > That... doesn't sound very straightforward to me; it's basically > introducing a new covenant approach, that's getting fixed into a > signature, rather than being a separate opcode. I think one design advantage of combining scope-minimal opcodes like MERKLESUB with sighash malleability is the ability to update a subset of the off-chain contract transactions fields after the funding phase. With a lower level of cooperation than required by the key path. I think not an ability offered by templated covenants. > I'm not really sure what you're saying there; is that any different to a > pool of (A and B) where A suddenly wants to withdraw funds ASAP and can't > wait for a key path signature? In that case A authorises the withdrawal > and does whatever she wants with the funds (including form a new pool), > and B remains in the pool. Yes this is a different contract policy that I would like to set up. Let's say you would like to express the following set of capabilities. C0=3D"Split the 4 BTC funds between Alice/Bob and Caroll/Dave" C1=3D"Alice can withdraw 1 BTC after 2 weeks" C2=3D"Bob can withdraw 1 BTC after 2 weeks" C3=3D"Caroll can withdraw 1 BTC after 2 weeks" C4=3D"Dave can withdraw 1 BTC after 2 weeks" C5=3D"If USDT price=3DX, Alice can withdraw 2 BTC or Caroll can withdraw 2 = BTC" If C4 is exercised, to avoid trust in the remaining counterparty, both Alice or Caroll should be able to conserve the C5 option, without relying on the updated key path. As you're saying, as we know the group in advance, one way to setup the tre= e could be: (A, (((((B, C), BC), D), BCD), ((((E, F), EF), G), EFG))) where: A=3D"1 2 CHECKMULTISIG CHECKSIG" B=3D" DUP 0 2 TLUV CHECKSIG" C=3D" DUP 0 2 TLUV CHECKSIG" D=3D" 0 6 TLUV 1 2 CHECKMULTISIG" E=3D" DUP 0 2 TLUV CHECKSIG" F=3D" DUP 0 2 TLUV CHECKSIG" G=3D" 0 6 TLUV 1 2 CHECKMULTISIG" E.g, if D is exercised, B+C+D are removed from the tree and A, E, F, G are conserved in the Caroll/Dave fork. Then Caroll can exercise the USDT option without trusting Dave. Note, this solution isn't really satisfying as the G path isn't neutralized on the Caroll/Dave fork and could be replayed by Alice or Bob... One improvement could be to have the "withdraw" script path (C,D,F,G) expressed redundantly. That way when a "split" script path is exercised the uncle split path and all the siblings "withdraw" paths can be removed. Echoing your point about the difficulty of reliably composing arbitrary subsets of the pool, I lean to agree that merkle trees aren't the most straightforward way to encode that kind of contract policy. > If you're worried about the cost of a single byte of witness data you > probably can't afford to do script path spends at all -- certainly > having to do 64 bytes of witness data to add a signature that commits > to an amount and the like will be infeasible in that case. Yes, I agree fully templated covenants are more efficient to save witness data. I still like the idea of inserting a key as you might have an interesting ability. Like a N-of-M, a subset of the vault/pool able to update the withdraw pubkey. > That doesn't work. Suppose you start off with an even internal pubkey, > with three scripts, (A, (B,C)). All of those scripts have tapscript > version 0xc0 because the internal pubkey is even. You spend using A and > calculate the new internal pubkey which turns out to be odd. You then > need to change B and C's script version from 0xc0 to 0x20, but you can't > do that (at least, you can't do it without revealing every script). I'm not sure we're aligned on the mechanism. We introduce a new tapscript version 0x20. At spent taproot commitment verification, if the tapscript version=3D0x20, the second-lowest bit of the first byte of the control block is interpreted as the parity bit of the spent internal pubkey (i.e control[0] & 0x2). This parity bit is used to compute a new format of TapTweakV2=3DH(p || m || bit) and commitment verification keep proceeding unmodified. As the leaf version is committed as part of every TapLeaf, I think any usage of MERKLESUB would require to use tapscript version 0x20 for the whole set of leaves. If you build a tree blurring 0xc0 leaves and TapTweakV2, I think those leaves will be unspendable as they will always fail the commitment verification. > Changing the TapTweak calculation is a hard fork; existing software > already verifies the calculation even if the script version is unknown. Thinking more, you're right... In case of TapTweakV2, non-upgraded nodes won't be able to pass the validation of unknown script version (0x20), and the failure will provoke a fork. Could we commit the spent internal pubkey parity bit as a one-more-tweak transparent to non-upgrades nodes ? For upgraded, P =3D R + (t2 * G) and Q =3D P + (t1 * G) For non-upgraded, Q =3D P + (t1 * G). Could we add a new validation rule (e.g VerifyInternalPubkeyCommitment) conditional on a newer tapscript version just before VerifyTaprootCommitment ? > That is, the strategy isn't "tweak the scripts by delaying them 3 months" > it's "tweak the merkle tree, to replace the scripts that would be delayed > with a new script that has a delay and then allows itself to be replaced > by the original scripts that we now want back". Yes, that's a good strategy to have logically equivalent subtree embedded in the modifying tapscript. If you have multiple modifying scripts and you can't predict the order, I think the tree complexity will be quickly too high and grafroot-like approaches are likely better Le mer. 15 sept. 2021 =C3=A0 02:51, Anthony Towns a =C3= =A9crit : > On Sun, Sep 12, 2021 at 07:37:56PM -0400, Antoine Riard via bitcoin-dev > wrote: > > While MERKLESUB is still WIP, here the semantic. [...] > > I believe this is matching your description and the main difference > compared to > > your TLUV proposal is the lack of merkle tree extension, where a new > merkle > > path is added in place of the removed tapscript. > > I think "

MERKLESUB" is the same as "

OP_0 2 TLUV", provided > happens to be the same index as the current input. So it misses the > ability to add branches (replacing OP_0 with a hash), the ability to > preserve the current script (replacing 2 with 0), and the ability to > remove some of the parent paths (replacing 2 with 4*n); but gains the > ability to refer to non-corresponding outputs. > > > > That would mean anyone who could do a valid spend of the tx could > > > violate the covenant by spending to an unencumbered witness v2 output > > > and (by collaborating with a miner) steal the funds. I don't think > > > there's a reasonable way to have existing covenants be forward > > > compatible with future destination addresses (beyond something like C= TV > > > that strictly hardcodes them). > > That's a good catch, thanks for raising it :) > > Depends how you define reasonable, but I think one straightforward fix > is to > > extend the signature digest algorithm to encompass the segwit version > (and > > maybe program-size ?) of the spending transaction outputs. > > That... doesn't sound very straightforward to me; it's basically > introducing a new covenant approach, that's getting fixed into a > signature, rather than being a separate opcode. > > I think a better approach for that would be to introduce the opcode (eg, > PUSH_OUTPUT_SCRIPTPUBKEY, and SUBSTR to be able to analyse the segwit > version), and make use of graftroot to allow a signature to declare that > it's conditional on some extra script code. But it feels like it's going > a bit off topic. > > > > Having the output position parameter might be an interesting way to > > > merge/split a vault/pool, but it's not clear to me how much sense it > > > makes sense to optimise for that, rather than just doing that via the > key > > > path. For pools, you want the key path to be common anyway (for priva= cy > > > and efficiency), so it shouldn't be a problem; but even for vaults, > > > you want the cold wallet accessible enough to be useful for the case > > > where theft is attempted, and maybe that's also accessible enough for > > > the ocassional merge/split to keep your utxo count/sizes reasonable. > > I think you can come up with interesting contract policies. Let's say > you want > > to authorize the emergency path of your pool/vault balances if X happen= s > (e.g a > > massive drop in USDT price signed by DLC oracles). You have (A+B+C+D) > forking > > into (A+B) and (C+D) pooled funds. To conserve the contracts > pre-negotiated > > economic equilibrium, all the participants would like the emergency pat= h > to be > > inherited on both forks. Without relying on the key path interactivity, > which > > is ultimately a trust on the post-fork cooperation of your counterparty= ? > > I'm not really sure what you're saying there; is that any different to a > pool of (A and B) where A suddenly wants to withdraw funds ASAP and can't > wait for a key path signature? In that case A authorises the withdrawal > and does whatever she wants with the funds (including form a new pool), > and B remains in the pool. > > I don't think you can reliably have some arbitrary subset of the pool > able to withdraw atomically without using the key path -- if A,B,C,D have > individual scripts allowing withdrawal, then there's no way of setting > the tree up so that every pair of members can have their scripts cut > off without also cutting off one or both of the other members withdrawal > scripts. > > If you know in advance which groups want to stick together, you could > set things up as: > > (((A, B), AB), C) > > where: > > A =3D "A DUP H(B') 10 TLUV CHECKSIG" -> (B', C) > B =3D "B DUP H(A') 10 TLUV CHECKSIG" -> (A', C) > A' =3D "A DUP 0 2 TLUV CHECKSIG" -> (C) > B' =3D "B DUP 0 2 TLUV CHECKSIG" -> (C) > AB =3D "(A+B) DUP 6 TLUV CHECKSIG -> (C) > C =3D "C DUP 0 2 TLUV CHECKSIG" -> ((A,B), AB) > > (10 =3D 2+4*2 =3D drop my script, my sibling and my uncle; 6 =3D 2+4*1 = =3D > drop my script and my sibling; 2 =3D drop my script only) > > Which would let A and B exit together in a single tx rather than needing > two > transactions to exit separately. > > > > Saving a byte of witness data at the cost of specifying additional > > > opcodes seems like optimising the wrong thing to me. > > I think we should keep in mind that any overhead cost in the usage of a > script > > primitive is echoed to the user of off-chain contract/payment channels. > If the > > tapscripts are bigger, your average on-chain spends in case of > non-cooperative > > scenarios are increased in consequence, and as such your fee-bumping > reserve. > > Thus making those systems less economically accessible. > > If you're worried about the cost of a single byte of witness data you > probably can't afford to do script path spends at all -- certainly > having to do 64 bytes of witness data to add a signature that commits > to an amount and the like will be infeasible in that case. > > > > I don't think that works, because different scripts in the same merkl= e > > > tree can have different script versions, which would here indicate > > > different parities for the same internal pub key. > > Let me make it clearer. We introduce a new tapscript version 0x20, > forcing a > > new bit in the first byte of the control block to be interpreted as the > parity > > bit of the spent internal pubkey. > > That doesn't work. Suppose you start off with an even internal pubkey, > with three scripts, (A, (B,C)). All of those scripts have tapscript > version 0xc0 because the internal pubkey is even. You spend using A and > calculate the new internal pubkey which turns out to be odd. You then > need to change B and C's script version from 0xc0 to 0x20, but you can't > do that (at least, you can't do it without revealing every script). > > > To ensure this parity bit is faithful and > > won't break the updated key path, it's committed in the spent taptweak. > > Changing the TapTweak calculation is a hard fork; existing software > already verifies the calculation even if the script version is unknown. > > > > The IN_OUT_AMOUNT opcode lets you do maths on the values, so you can > > > specify "hot wallets can withdraw up to X" rather than "hot wallets > > > must withdraw exactly X". I don't think there's a way of doing that > with > > > SIGHASH_GROUP, even with a modifier like ANYPUBKEY? > > You can exchange signatures for withdraw outputs with multiples `nValue= ` > > covering the authorized range, assuming the ANYAMOUNT modifier ? > > If you want your hotwallet to be able to withdraw up to $2000, that's > around 4,000,000 sats, so you'd be doing up to 4M signatures there if you > wanted to get the exact value you're trying to send, without having to > either overpay, or first pay yourself then have another tx that splits > your withdrawal into what you're spending and change that's no longer > in your vault. > > > One advantage > > of leveraging sighash is the ability to update a withdraw policy in > real-time. > > Vaults participants might be willing to bump the withdraw policy beyond > X, > > assuming you have N-of-M consents. > > I mean, maybe? It seems like a very heavy weight construct where a more > general approach would probably be better (eg, graftroot to attach a > script to a signature; or checkdatasig or whatever so you push a value > to the stack then check it's signature, then reuse the authenticated > data against other checks) so that you only have to supply a signature > when you want to be able to approve things after the fact. > > > I think I would like to express the following contract policy. Let's sa= y > you > > have 1) a one-time conditional script path to withdraw fund ("a put on > strike > > price X"), 2) a conditional script path to tweak by 3 months all the > usual > > withdraw path and 3) those remaining withdraw paths. Once played out, > you would > > like the one-time path to be removed from your merkle tree. And this > removal to > > be inherited on the tweaked tree if 2) plays out. > > Okay, so I think that means we've got the unconditional withdraw path > "U" (your 1), the delay path "D" (your 2) and some normal path(s) "N" > (your 3). I think you can get that behaviour with: > > S1 =3D Merkle( U, (D, N) ) > S2 =3D Merkle( U, W ) > S3 =3D Merkle( N ) > > that is, you start off with the funds in scriptPubKey S1, then spend > using D to get to S2, then spend using W to get to S3, then presumably > spend using N at some point. > > The script for W is just: > > "IN_OUT_AMOUNT EQUALVERIFY 0 6 TLUV <3 months> CSV" > (drop the script, drop its sibling, add N, wait 3 months) > > The script for D is: > > "IN_OUT_AMOUNT EQUALVERIFY 0 6 TLUV " > (drop the script, drop its sibling, add W, extra conditions > to avoid anyone being able to delay things) > > That is, the strategy isn't "tweak the scripts by delaying them 3 months" > it's "tweak the merkle tree, to replace the scripts that would be delayed > with a new script that has a delay and then allows itself to be replaced > by the original scripts that we now want back". > > Cheers, > aj > > --0000000000006b469205cc459ff4 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

> I think "<I> <P> MERKLESUB" is = the same as "<P> OP_0 2 TLUV", provided
> <I> h= appens to be the same index as the current input. So it misses the
> = ability to add branches (replacing OP_0 with a hash), the ability to
>= ; preserve the current script (replacing 2 with 0), and the ability to
&= gt; remove some of the parent paths (replacing 2 with 4*n); but gains the> ability to refer to non-corresponding outputs.

Yes, I agree.<= br>
> That... doesn't sound very straightforward to me; it's = basically
> introducing a new covenant approach, that's getting f= ixed into a
> signature, rather than being a separate opcode.

= I think one design advantage of combining scope-minimal opcodes like MERKLE= SUB with sighash malleability is the ability to update a subset of the off-= chain contract transactions fields after the funding phase. With a lower le= vel of cooperation than required by the key path. I think not an ability of= fered by templated covenants.

> I'm not really sure what you&= #39;re saying there; is that any different to a
> pool of (A and B) w= here A suddenly wants to withdraw funds ASAP and can't
> wait for= a key path signature? In that case A authorises the withdrawal
> and= does whatever she wants with the funds (including form a new pool),
>= ; and B remains in the pool.

Yes this is a different contract policy= that I would like to set up.

Let's say you would like to expres= s the following set of capabilities.

C0=3D"Split the 4 BTC fund= s between Alice/Bob and Caroll/Dave"
C1=3D"Alice can withdraw = 1 BTC after 2 weeks"
C2=3D"Bob can withdraw 1 BTC after 2 week= s"
C3=3D"Caroll can withdraw 1 BTC after 2 weeks"
C4= =3D"Dave can withdraw 1 BTC after 2 weeks"
C5=3D"If USDT = price=3DX, Alice can withdraw 2 BTC or Caroll can withdraw 2 BTC"
<= br>If C4 is exercised, to avoid trust in the remaining counterparty, both A= lice or Caroll should be able to conserve the C5 option, without relying on= the updated key path.

As you're saying, as we know the group in= advance, one way to setup the tree
could be:

=C2=A0 =C2=A0 =C2= =A0 =C2=A0(A, (((((B, C), BC), D), BCD), ((((E, F), EF), G), EFG)))

= where:
A=3D"1 <alice> <caroll> 2 CHECKMULTISIG <usdt= _oracle> CHECKSIG"
B=3D"<alice> DUP 0 2 TLUV CHECKSIG= "
C=3D"<bob> DUP 0 2 TLUV CHECKSIG"
D=3D"&l= t;alice+bob> 0 6 TLUV 1 <caroll> <dave> 2 CHECKMULTISIG"= ;
E=3D"<caroll> DUP 0 2 TLUV CHECKSIG"
F=3D"<= dave> DUP 0 2 TLUV CHECKSIG"
G=3D"<caroll+dave> 0 6 T= LUV 1 <alice> <bob> 2 CHECKMULTISIG"

E.g, if D is e= xercised, B+C+D are removed from the tree and A, E, F, G are conserved in t= he Caroll/Dave fork. Then Caroll can exercise the USDT option without trust= ing Dave.

Note, this solution isn't really satisfying as the G p= ath isn't neutralized on the Caroll/Dave fork and could be replayed by = Alice or Bob... One improvement could be to have the "withdraw" s= cript path (C,D,F,G) expressed redundantly. That way when a "split&quo= t; script path is exercised the uncle split path and all the siblings "= ;withdraw" paths can be removed.

Echoing your point about the d= ifficulty of reliably composing arbitrary subsets of the pool, I lean to ag= ree that merkle trees aren't the most straightforward way to encode tha= t kind of contract policy.

> If you're worried about the cost= of a single byte of witness data you
> probably can't afford to = do script path spends at all -- certainly
> having to do 64 bytes of = witness data to add a signature that commits
> to an amount and the l= ike will be infeasible in that case.

Yes, I agree fully templated co= venants are more efficient to save witness data.

I still like the id= ea of inserting a key as you might have an interesting ability.
Like a N= -of-M, a subset of the vault/pool able to update the withdraw pubkey.
> That doesn't work. Suppose you start off with an even internal p= ubkey,
> with three scripts, (A, (B,C)). All of those scripts have ta= pscript
> version 0xc0 because the internal pubkey is even. You spend= using A and
> calculate the new internal pubkey which turns out to b= e odd. You then
> need to change B and C's script version from 0x= c0 to 0x20, but you can't
> do that (at least, you can't do i= t without revealing every script).

I'm not sure we're aligne= d on the mechanism.

We introduce a new tapscript version 0x20.
At spent taproot commitment verification, if the tapscript version=3D0x20= , the second-lowest bit of the first byte of the control block is interpret= ed as the parity bit of the spent internal pubkey (i.e control[0] & 0x2= ).

This parity bit is used to compute a new format of TapTweakV2=3DH= (p || m || bit) and commitment verification keep proceeding unmodified.
=
As the leaf version is committed as part of every TapLeaf, I think any = usage of MERKLESUB would require to use tapscript version 0x20 for the whol= e set of leaves.

If you build a tree blurring 0xc0 leaves and TapTwe= akV2, I think those leaves will be unspendable as they will always fail the= commitment verification.

> Changing the TapTweak calculation is = a hard fork; existing software
> already verifies the calculation eve= n if the script version is unknown.

Thinking more, you're right.= ..

In case of TapTweakV2, non-upgraded nodes won't be able to pa= ss the validation of unknown script version (0x20), and the failure will pr= ovoke a fork.

Could we commit the spent internal pubkey parity bit = as a one-more-tweak transparent to non-upgrades nodes ?

For upgraded= , P =3D R + (t2 * G) and Q =3D P + (t1 * G)
For non-upgraded, Q =3D P + = (t1 * G).

Could we add a new validation rule (e.g VerifyInternalPubk= eyCommitment) conditional on a newer tapscript version just before VerifyTa= prootCommitment ?

> That is, the strategy isn't "tweak t= he scripts by delaying them 3 months"
> it's "tweak the= merkle tree, to replace the scripts that would be delayed
> with a n= ew script that has a delay and then allows itself to be replaced
> by= the original scripts that we now want back".

Yes, that's a= good strategy to have logically equivalent subtree embedded in the modifyi= ng tapscript.

If you have multiple modifying scripts and you can'= ;t predict the order, I think the tree complexity will be quickly too high = and grafroot-like approaches are likely better

Le=C2=A0mer. 15 sept. 2021 = =C3=A0=C2=A002:51, Anthony Towns <a= j@erisian.com.au> a =C3=A9crit=C2=A0:
On Sun, Sep 12, 2021 at 07:37:56PM -0400, Anto= ine Riard via bitcoin-dev wrote:
> While MERKLESUB is still WIP, here the semantic. [...]
> I believe this is matching your description and the main difference co= mpared to
> your TLUV proposal is the lack of merkle tree extension, where a new m= erkle
> path is added in place of the removed tapscript.

I think "<I> <P> MERKLESUB" is the same as "<= P> OP_0 2 TLUV", provided
<I> happens to be the same index as the current input. So it misses t= he
ability to add branches (replacing OP_0 with a hash), the ability to
preserve the current script (replacing 2 with 0), and the ability to
remove some of the parent paths (replacing 2 with 4*n); but gains the
ability to refer to non-corresponding outputs.

> > That would mean anyone who could do a valid spend of the tx could=
> > violate the covenant by spending to an unencumbered witness v2 ou= tput
> > and (by collaborating with a miner) steal the funds. I don't = think
> > there's a reasonable way to have existing covenants be forwar= d
> > compatible with future destination addresses (beyond something li= ke CTV
> > that strictly hardcodes them).
> That's a good catch, thanks for raising it :)
> Depends how you define reasonable, but I think one straightforward fix= is to
> extend the signature digest algorithm to encompass the segwit version = (and
> maybe program-size ?) of the spending transaction outputs.

That... doesn't sound very straightforward to me; it's basically introducing a new covenant approach, that's getting fixed into a
signature, rather than being a separate opcode.

I think a better approach for that would be to introduce the opcode (eg, PUSH_OUTPUT_SCRIPTPUBKEY, and SUBSTR to be able to analyse the segwit
version), and make use of graftroot to allow a signature to declare that it's conditional on some extra script code. But it feels like it's = going
a bit off topic.

> > Having the output position parameter might be an interesting way = to
> > merge/split a vault/pool, but it's not clear to me how much s= ense it
> > makes sense to optimise for that, rather than just doing that via= the key
> > path. For pools, you want the key path to be common anyway (for p= rivacy
> > and efficiency), so it shouldn't be a problem; but even for v= aults,
> > you want the cold wallet accessible enough to be useful for the c= ase
> > where theft is attempted, and maybe that's also accessible en= ough for
> > the ocassional merge/split to keep your utxo count/sizes reasonab= le.
> I think you can come up with interesting contract policies. Let's = say you want
> to authorize the emergency path of your pool/vault balances if X happe= ns (e.g a
> massive drop in USDT price signed by DLC oracles). You have (A+B+C+D) = forking
> into (A+B) and (C+D) pooled funds. To conserve the contracts pre-negot= iated
> economic equilibrium, all the participants would like the emergency pa= th to be
> inherited on both forks. Without relying on the key path interactivity= , which
> is ultimately a trust on the post-fork cooperation of your counterpart= y ?

I'm not really sure what you're saying there; is that any different= to a
pool of (A and B) where A suddenly wants to withdraw funds ASAP and can'= ;t
wait for a key path signature? In that case A authorises the withdrawal
and does whatever she wants with the funds (including form a new pool),
and B remains in the pool.

I don't think you can reliably have some arbitrary subset of the pool able to withdraw atomically without using the key path -- if A,B,C,D have individual scripts allowing withdrawal, then there's no way of setting<= br> the tree up so that every pair of members can have their scripts cut
off without also cutting off one or both of the other members withdrawal scripts.

If you know in advance which groups want to stick together, you could
set things up as:

=C2=A0 (((A, B), AB), C)

where:

=C2=A0 A =3D=C2=A0 =C2=A0"A DUP H(B') 10 TLUV CHECKSIG"=C2=A0= -> (B', C)
=C2=A0 B =3D=C2=A0 =C2=A0"B DUP H(A') 10 TLUV CHECKSIG"=C2=A0= -> (A', C)
=C2=A0 A' =3D=C2=A0 "A DUP 0 2 TLUV CHECKSIG"=C2=A0 =C2=A0-&g= t; (C)
=C2=A0 B' =3D=C2=A0 "B DUP 0 2 TLUV CHECKSIG"=C2=A0 =C2=A0-&g= t; (C)
=C2=A0 AB =3D=C2=A0 "(A+B) DUP 6 TLUV CHECKSIG=C2=A0 -> (C)
=C2=A0 C=C2=A0 =3D=C2=A0 "C DUP 0 2 TLUV CHECKSIG"=C2=A0 =C2=A0-&= gt; ((A,B), AB)

(10 =3D 2+4*2 =3D drop my script, my sibling and my uncle; 6 =3D 2+4*1 =3D<= br> drop my script and my sibling; 2 =3D drop my script only)

Which would let A and B exit together in a single tx rather than needing tw= o
transactions to exit separately.

> > Saving a byte of witness data at the cost of specifying additiona= l
> > opcodes seems like optimising the wrong thing to me.
> I think we should keep in mind that any overhead cost in the usage of = a script
> primitive is echoed to the user of off-chain contract/payment channels= . If the
> tapscripts are bigger, your average on-chain spends in case of non-coo= perative
> scenarios are increased in consequence, and as such your fee-bumping r= eserve.
> Thus making those systems less economically accessible.

If you're worried about the cost of a single byte of witness data you probably can't afford to do script path spends at all -- certainly
having to do 64 bytes of witness data to add a signature that commits
to an amount and the like will be infeasible in that case.

> > I don't think that works, because different scripts in the sa= me merkle
> > tree can have different script versions, which would here indicat= e
> > different parities for the same internal pub key.
> Let me make it clearer. We introduce a new tapscript version 0x20, for= cing a
> new bit in the first byte of the control block to be interpreted as th= e parity
> bit of the spent internal pubkey.

That doesn't work. Suppose you start off with an even internal pubkey,<= br> with three scripts, (A, (B,C)). All of those scripts have tapscript
version 0xc0 because the internal pubkey is even. You spend using A and
calculate the new internal pubkey which turns out to be odd. You then
need to change B and C's script version from 0xc0 to 0x20, but you can&= #39;t
do that (at least, you can't do it without revealing every script).

> To ensure this parity bit is faithful and
> won't break the updated key path, it's committed in the spent = taptweak.

Changing the TapTweak calculation is a hard fork; existing software
already verifies the calculation even if the script version is unknown.

> > The IN_OUT_AMOUNT opcode lets you do maths on the values, so you = can
> > specify "hot wallets can withdraw up to X" rather than = "hot wallets
> > must withdraw exactly X". I don't think there's a wa= y of doing that with
> > SIGHASH_GROUP, even with a modifier like ANYPUBKEY?
> You can exchange signatures for withdraw outputs with multiples `nValu= e`
> covering the authorized range, assuming the ANYAMOUNT modifier ?

If you want your hotwallet to be able to withdraw up to $2000, that's around 4,000,000 sats, so you'd be doing up to 4M signatures there if y= ou
wanted to get the exact value you're trying to send, without having to<= br> either overpay, or first pay yourself then have another tx that splits
your withdrawal into what you're spending and change that's no long= er
in your vault.

> One advantage
> of leveraging sighash is the ability to update a withdraw policy in re= al-time.
> Vaults participants might be willing to bump the withdraw policy beyon= d X,
> assuming you have N-of-M consents.

I mean, maybe? It seems like a very heavy weight construct where a more
general approach would probably be better (eg, graftroot to attach a
script to a signature; or checkdatasig or whatever so you push a value
to the stack then check it's signature, then reuse the authenticated data against other checks) so that you only have to supply a signature
when you want to be able to approve things after the fact.

> I think I would like to express the following contract policy. Let'= ;s say you
> have 1) a one-time conditional script path to withdraw fund ("a p= ut on strike
> price X"), 2) a conditional script path to tweak by 3 months all = the usual
> withdraw path and 3) those remaining withdraw paths. Once played out, = you would
> like the one-time path to be removed from your merkle tree. And this r= emoval to
> be inherited on the tweaked tree if 2) plays out.

Okay, so I think that means we've got the unconditional withdraw path "U" (your 1), the delay path "D" (your 2) and some norm= al path(s) "N"
(your 3). I think you can get that behaviour with:

=C2=A0 =C2=A0S1 =3D Merkle( U, (D, N) )
=C2=A0 =C2=A0S2 =3D Merkle( U, W )
=C2=A0 =C2=A0S3 =3D Merkle( N )

that is, you start off with the funds in scriptPubKey S1, then spend
using D to get to S2, then spend using W to get to S3, then presumably
spend using N at some point.

The script for W is just:

=C2=A0 =C2=A0"IN_OUT_AMOUNT EQUALVERIFY 0 <N> 6 TLUV <3 month= s> CSV"=C2=A0 =C2=A0
=C2=A0 =C2=A0 =C2=A0 =C2=A0(drop the script, drop its sibling, add N, wait = 3 months)

The script for D is:

=C2=A0 =C2=A0"IN_OUT_AMOUNT EQUALVERIFY 0 <W> 6 TLUV <sigchec= k...>"
=C2=A0 =C2=A0 =C2=A0 =C2=A0(drop the script, drop its sibling, add W, extra= conditions
=C2=A0 =C2=A0 =C2=A0 =C2=A0 to avoid anyone being able to delay things)

That is, the strategy isn't "tweak the scripts by delaying them 3 = months"
it's "tweak the merkle tree, to replace the scripts that would be = delayed
with a new script that has a delay and then allows itself to be replaced by the original scripts that we now want back".

Cheers,
aj

--0000000000006b469205cc459ff4--