MIME-Version: 1.0
References: <CAJvkSseW9OZ50yQiS7e0zt9tQt4v9aoikgGs_54_kMN-ORkQgw@mail.gmail.com>
 <79753214-9d5e-40c7-97ac-1d4e9ea3c64e@www.fastmail.com>
 <CAPv7TjZ45VD_5sGSFiQxmt981uDodq28mHOW=2LYLofXams43w@mail.gmail.com>
 <87369v6nw3.fsf@gmail.com>
In-Reply-To: <87369v6nw3.fsf@gmail.com>
From: Greg Sanders <gsanders87@gmail.com>
Date: Thu, 26 Mar 2020 13:17:13 -0400
Message-ID: <CAB3F3Dt0z5bDMpzRGGJxJV8KpCk_4XGF23MGmYVkLppRbG7Wnw@mail.gmail.com>
To: Christian Decker <decker.christian@gmail.com>, 
 Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: multipart/alternative; boundary="0000000000008af83505a1c52871"
Cc: tom@commerceblock.com
Subject: Re: [bitcoin-dev] Statechain implementations
Precedence: list

--0000000000008af83505a1c52871
Content-Type: text/plain; charset="UTF-8"

> Wouldn't that result in a changing pubkey at each update, and thus
require an onchain move to be committed?

Suggestion was in line with original proposal where no keys are changing
ever, just not presupposing existence of MuSig.

On Thu, Mar 26, 2020 at 1:15 PM Christian Decker via bitcoin-dev <
bitcoin-dev@lists.linuxfoundation.org> wrote:

> Ruben Somsen via bitcoin-dev <bitcoin-dev@lists.linuxfoundation.org>
> writes:
> > Regarding modification 1, I agree with ZmnSCPxj that
> > Decker-Wattenhofer is your next best option, given that eltoo is not
> > yet available. But if you are going to use a kickoff transaction, keep
> > in mind that every previous owner will have a copy of it. Because of
> > this, you can't include a fee, and will instead need to have a second
> > output for CPFP. This way a previous owner will at least have to pay
> > the fee if they want to publish it. Note that it's still an
> > improvement, because even if the kickoff transaction gets posted, it
> > basically becomes no different than what it would have been, had you
> > not used a kickoff transaction at all.
>
> It might be worth adopting the late fee binding we have in eltoo by
> having the kickoff transaction input spending the funding tx signed with
> sighash_single. This works because we only have 1 input and 1 output
> that we really care about, and can allow others to attach fees at
> will. That'd at least remove the need to guess the feerate days or
> months in advance and thus having to overestimate.
>
> > Regarding modification 2, I like it a lot conceptually. It hadn't
> > occurred to me before, and it's a clear security improvement. The only
> > question is something Greg Sanders mentioned: whether it's enough to
> > justify the added complexity of using 2P ECDSA. The alternative would
> > be to simply use a regular 2-of-2 multisig (until Schnorr arrives,
> > possibly).
>
> Wouldn't that result in a changing pubkey at each update, and thus
> require an onchain move to be committed?
>
> > I'm looking forward to seeing statechains become a reality.
>
> That'd indeed be great :-)
>
> Cheers,
> Christian
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>

--0000000000008af83505a1c52871
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">&gt; Wouldn&#39;t that result in a changing pubkey at each=
 update, and thus<br>require an onchain move to be committed?<div><br></div=
><div>Suggestion was in line with original proposal where no keys are chang=
ing ever, just not presupposing existence of MuSig.</div></div><br><div cla=
ss=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Thu, Mar 26, 20=
20 at 1:15 PM Christian Decker via bitcoin-dev &lt;<a href=3D"mailto:bitcoi=
n-dev@lists.linuxfoundation.org">bitcoin-dev@lists.linuxfoundation.org</a>&=
gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0=
px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Ruben=
 Somsen via bitcoin-dev &lt;<a href=3D"mailto:bitcoin-dev@lists.linuxfounda=
tion.org" target=3D"_blank">bitcoin-dev@lists.linuxfoundation.org</a>&gt;<b=
r>
writes:<br>
&gt; Regarding modification 1, I agree with ZmnSCPxj that<br>
&gt; Decker-Wattenhofer is your next best option, given that eltoo is not<b=
r>
&gt; yet available. But if you are going to use a kickoff transaction, keep=
<br>
&gt; in mind that every previous owner will have a copy of it. Because of<b=
r>
&gt; this, you can&#39;t include a fee, and will instead need to have a sec=
ond<br>
&gt; output for CPFP. This way a previous owner will at least have to pay<b=
r>
&gt; the fee if they want to publish it. Note that it&#39;s still an<br>
&gt; improvement, because even if the kickoff transaction gets posted, it<b=
r>
&gt; basically becomes no different than what it would have been, had you<b=
r>
&gt; not used a kickoff transaction at all.<br>
<br>
It might be worth adopting the late fee binding we have in eltoo by<br>
having the kickoff transaction input spending the funding tx signed with<br=
>
sighash_single. This works because we only have 1 input and 1 output<br>
that we really care about, and can allow others to attach fees at<br>
will. That&#39;d at least remove the need to guess the feerate days or<br>
months in advance and thus having to overestimate.=C2=A0 <br>
<br>
&gt; Regarding modification 2, I like it a lot conceptually. It hadn&#39;t<=
br>
&gt; occurred to me before, and it&#39;s a clear security improvement. The =
only<br>
&gt; question is something Greg Sanders mentioned: whether it&#39;s enough =
to<br>
&gt; justify the added complexity of using 2P ECDSA. The alternative would<=
br>
&gt; be to simply use a regular 2-of-2 multisig (until Schnorr arrives,<br>
&gt; possibly).<br>
<br>
Wouldn&#39;t that result in a changing pubkey at each update, and thus<br>
require an onchain move to be committed?<br>
<br>
&gt; I&#39;m looking forward to seeing statechains become a reality.<br>
<br>
That&#39;d indeed be great :-)<br>
<br>
Cheers,<br>
Christian<br>
_______________________________________________<br>
bitcoin-dev mailing list<br>
<a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.org" target=3D"_blank">=
bitcoin-dev@lists.linuxfoundation.org</a><br>
<a href=3D"https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev" =
rel=3D"noreferrer" target=3D"_blank">https://lists.linuxfoundation.org/mail=
man/listinfo/bitcoin-dev</a><br>
</blockquote></div>

--0000000000008af83505a1c52871--