Date: Mon, 29 Jul 2019 01:46:40 +0000
To: Mike Brooks <m@ib.tc>
From: ZmnSCPxj <ZmnSCPxj@protonmail.com>
Reply-To: ZmnSCPxj <ZmnSCPxj@protonmail.com>
Message-ID: <dW426iyRLdy0-CbpWL9pG7dG8qvmyQizPrwuBVHpblJBCBDSMjeIuFMiTjNHOaMfUzjaW2btTiFD9PiozOt9Cv5DQUZG0o22hYndr2wk3SI=@protonmail.com>
In-Reply-To: <CALFqKjQoA+4XKGePHEK9OAZv2+qg=Q669v=f=MpDtg4F3Fx4kQ@mail.gmail.com>
References: <CALFqKjQkQwuxjeYkGWO_Y_HhNQmJgrjqF3m04hbORV7FSbsi3Q@mail.gmail.com>
	<nk8ihWbf71QT6w-wVbnunppF_DjS8ywDoDAugBj5mYM_LCpSzec0j6lkaTKBK4t3CsXwRSXWmzbWiW7nmqT4y0W2fn8X-3oXv-TAYXwP1R4=@protonmail.com>
	<CALFqKjQoA+4XKGePHEK9OAZv2+qg=Q669v=f=MpDtg4F3Fx4kQ@mail.gmail.com>
Feedback-ID: el4j0RWPRERue64lIQeq9Y2FP-mdB86tFqjmrJyEPR9VAtMovPEo9tvgA0CrTsSHJeeyPXqnoAu6DN-R04uJUg==:Ext:ProtonMail
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>,
	"pieter.wuille@gmail.com" <pieter.wuille@gmail.com>
Subject: Re: [bitcoin-dev] PubRef - Script OP Code For Public Data References
Precedence: list

Good morning Mike,


Sent with ProtonMail Secure Email.

=E2=80=90=E2=80=90=E2=80=90=E2=80=90=E2=80=90=E2=80=90=E2=80=90 Original Me=
ssage =E2=80=90=E2=80=90=E2=80=90=E2=80=90=E2=80=90=E2=80=90=E2=80=90
On Sunday, July 28, 2019 4:03 AM, Mike Brooks <m@ib.tc> wrote:

> Hey ZmnSCPxj,
>
> As to your first point.=C2=A0 I wasn't aware there was so much volatility=
 at the tip, also 100 blocks is quite the difference!=C2=A0 I agree no one =
could references a transaction in a newly formed blocks, but I'm curious ho=
w this number was chosen. Do you have any documentation or code that you ca=
n share related to how re-orgs are handled? Do we have a kind of 'consensus=
 checkpoint' when a re-org is no longer possible? This is a very interestin=
g topic.
>

Miner coinbases need 100 blocks for maturity, which is the basis of my sugg=
estion to use 100 blocks.
It might be too high, but I doubt there will be good reason to be less than=
 100.

There is a potential for a targeted attack where a large payout going to a =
`scriptPubKey` that uses `OP_PUBREF` on a recently-confirmed transaction fi=
nds that recently-confirmed transaction is replaced with one that pays to a=
 different public key, via a history-rewrite attack.
Such an attack is doable by miners, and if we consider that we accept 100 b=
locks for miner coinbase maturity as "acceptably low risk" against miner sh=
enanigans, then we might consider that 100 blocks might be acceptable for t=
his also.
Whether 100 is too high or not largely depends on your risk appetite.

>=C2=A0 A validator only needs an array of PUSHDATA elements and can then v=
alidate any given SCRIPT at O(1).=C2=A0=C2=A0

Data derived from > 220Gb of perpetually-growing blockchain is hardly, to m=
y mind, "only needs an array".
Such an array would not fit in memory for many devices that today are pract=
ical for running fullnodes.
It is keeping that array and indexing it which is the problem, i.e. the dev=
il in the details.

Reiterating also, current pruned nodes did not retain that data and would b=
e forced to re-download the entire blockchain.
Unless you propose that we can refer only to `OP_PUSHDATA` after activation=
 of `OP_PUSHREF`.

Regards,
ZmnSCPxj