MIME-Version: 1.0
Date: Wed, 09 Nov 2022 21:39:10 -1000
From: "David A. Harding" <dave@dtrt.org>
To: Salvatore Ingala <salvatore.ingala@gmail.com>, Bitcoin Protocol
 Discussion <bitcoin-dev@lists.linuxfoundation.org>
In-Reply-To: <CAMhCMoH9uZPeAE_2tWH6rf0RndqV+ypjbNzazpFwFnLUpPsZ7g@mail.gmail.com>
References: <CAMhCMoH9uZPeAE_2tWH6rf0RndqV+ypjbNzazpFwFnLUpPsZ7g@mail.gmail.com>
User-Agent: Roundcube Webmail/1.4.10
Message-ID: <036287ca4f22dde0b98c91784ba79a5d@dtrt.org>
Content-Type: text/plain; charset=UTF-8;
 format=flowed
Content-Transfer-Encoding: 8bit
Subject: Re: [bitcoin-dev] Merkleize All The Things
Precedence: list

On 2022-11-07 23:17, Salvatore Ingala via bitcoin-dev wrote:
> Hi list,

Hi Salvatore!,

> I have been working on some notes to describe an approach that uses
> covenants in order to enable general smart contracts in bitcoin. You
> can find them here:
> 
>     https://merkle.fun

I haven't yet been able to understand everything in your post, but I'm 
wondering if you can describe how your proposal significantly differs in 
application from [1]?  E.g., you write:

> 1. Alice posts the statement “f(x) = y”.
> 2. After a challenge period, if no challenge occurs, Alice is free to 
> continue and unlock the funds; the statement is true.
> 3. At any time before the challenge period expires, Bob can start a 
> challenge: “actually, f(x) = z”.

That looks to me very similar to Gregory Maxwell's script from[1] 
(comments and variable name changes mine):

# Offchain, Alice posts the statement f(x) = y
# Offchain, Bob provides Ex, an encrypted form of x that can be proven 
in zero knowledge to satisfy both f(x) = y and sha256(x) = Y
OP_SHA256
<Y> OP_EQUAL
OP_IF
   # Bob provided the preimage for Y, that preimage being the solution, 
so he can spend the funds now
   <Bob Pubkey>
OP_ELSE
   # The challenge period ended, so Alice can reclaim her funds
   <block_height+100> OP_CHECKLOCKTIMEVERIFY OP_DROP
   <Alice Pubkey>
OP_ENDIF
OP_CHECKSIG

Thanks and apologies if I'm missing something obvious!,

-Dave

[1] 
https://bitcoincore.org/en/2016/02/26/zero-knowledge-contingent-payments-announcement/