MIME-Version: 1.0
References: <CAJBJmV-L4FusaMNV=_7L39QFDKnPKK_Z1QE6YU-wp2ZLjc=RrQ@mail.gmail.com>
 <CALZpt+FyVQpMAf-gPmUgh6ORqa2K59iKZKsa3Qm2Fw_U+GHC3Q@mail.gmail.com>
In-Reply-To: <CALZpt+FyVQpMAf-gPmUgh6ORqa2K59iKZKsa3Qm2Fw_U+GHC3Q@mail.gmail.com>
From: Joost Jager <joost.jager@gmail.com>
Date: Sat, 10 Jun 2023 09:43:52 +0200
Message-ID: <CAJBJmV9SGXaf90X4oyTx7o+DG4-P58gUyiCGz+K08XZAOFBf2g@mail.gmail.com>
To: Antoine Riard <antoine.riard@gmail.com>
Content-Type: multipart/alternative; boundary="000000000000c0fde905fdc1a79e"
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Standardisation of an unstructured taproot annex
Precedence: list

--000000000000c0fde905fdc1a79e
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Antoine,

On Sat, Jun 10, 2023 at 2:23=E2=80=AFAM Antoine Riard <antoine.riard@gmail.=
com>
wrote:

> From a taproot annex design perspective, I think this could be very
> valuable if you have a list of unstructured data use-cases you're thinkin=
g
> about ?
>

The annex's list of unstructured data use-cases includes existing data
storage uses that utilize OP_RETURN or inscriptions. Consider ordinals,
timestamps, and any other data already stored on the chain. These
applications would immediately benefit from the annex's improved space
efficiency.

However, the primary advantage I see in the annex is that its data isn't
included in the calculation of the txid or a potential parent commit
transaction's txid (for inscriptions). I've explained this at [1]. This
feature makes the annex a powerful tool for applications that would ideally
use covenants.

The most critical application in this category, for me, involves
time-locked vaults. Given the positive reception to proposals such as
OP_VAULT [2], I don't think I'm alone in this belief. OP_VAULT is probably
a bit further out, but pre-signed transactions signed using an ephemeral
key can fill the gap and improve the safeguarding of Bitcoin in the short
term.

Backing up the ephemeral signatures of the pre-signed transactions on the
blockchain itself is an excellent way to ensure that the vault can always
be 'opened'. However, without the annex, this is not as safe as it could
be. Due to the described circular reference problem, the vault creation and
signature backup can't be executed in one atomic operation. For example,
you can store the backup in a child commit/reveal transaction set, but the
vault itself can be confirmed independently and the backup may never
confirm. If you create a vault and lose the ephemeral signatures, the funds
will be lost.

This use case for the annex has been labeled 'speculative' elsewhere. To
me, every use case appears speculative at this point because the annex
isn't available. However, if you believe that time-locked vaults are
important for Bitcoin and also acknowledge that soft forks, such as the one
required for OP_VAULT, aren't easy to implement, I'd argue that the
intermediate solution described above is very relevant.


> As raised on the BIP proposal, those unstructured data use-cases could us=
e
> annex tags with the benefit to combine multiple "types" of unstructured
> data in a single annex payload. As you're raising smaller bits of
> unstructured data might not afford the overhead though my answer with thi=
s
> observation would be to move this traffic towards some L2 systems ? In my
> mind, the default of adding a version byte for the usage of unstructured
> data comes with the downside of having future consensus enabled use-cases
> encumbering by the extended witness economic cost.
>

When it comes to the trade-offs associated with various encodings, I fully
acknowledge their existence. The primary motivation behind my proposal to
adopt a simple approach to the Taproot annex is to avoid a potentially long
standardization process. While I am not entirely familiar with the
decision-making process of Bitcoin Core, my experience with other projects
suggests that simpler changes often encounter less resistance and can be
implemented more swiftly. Perhaps I am being overly cautious here, though.


> About the annex payload extension attack described by Greg. If my
> understanding of this transaction-relay jamming griefing issue is correct=
,
> we can have an annex tag in the future where the signer is committing to
> the total weight of the transaction, or even the max per-input annex size=
 ?
> This should prevent a coinjoin or aggregated commitment transaction
> counterparty to inflate its annex space to downgrade the overall
> transaction feerate, I guess. And I think this could benefit unstructured
> data use-cases too.
>

Regarding the potential payload extension attack, I believe that the
changes proposed in the [3] to allow tx replacement by smaller witness
would provide a viable solution?

Joost

[1]
https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2023-June/021737.ht=
ml
[2] https://github.com/bitcoin/bips/pull/1421
[3] https://github.com/bitcoin/bitcoin/pull/24007

--000000000000c0fde905fdc1a79e
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hi Antoine,</div><br><div class=3D"gmail_quote"><div =
dir=3D"ltr" class=3D"gmail_attr">On Sat, Jun 10, 2023 at 2:23=E2=80=AFAM An=
toine Riard &lt;<a href=3D"mailto:antoine.riard@gmail.com">antoine.riard@gm=
ail.com</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"=
margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-lef=
t:1ex"><div dir=3D"ltr"><div>From a taproot annex design perspective, I thi=
nk this could be very valuable if you have a list of unstructured=C2=A0data=
 use-cases you&#39;re thinking about ? </div></div></blockquote><div><br></=
div>The annex&#39;s list of unstructured data use-cases includes existing d=
ata storage uses that utilize OP_RETURN or inscriptions. Consider ordinals,=
 timestamps, and any other data already stored on the chain. These applicat=
ions would immediately benefit from the annex&#39;s improved space efficien=
cy.</div><div class=3D"gmail_quote"><br>However, the primary advantage I se=
e in the annex is that its data isn&#39;t included in the calculation of th=
e txid or a potential parent commit transaction&#39;s txid (for inscription=
s). I&#39;ve explained this at [1]. This feature makes the annex a powerful=
 tool for applications that would ideally use covenants.<br><br>The most cr=
itical application in this category, for me, involves time-locked vaults. G=
iven the positive reception to proposals such as OP_VAULT [2], I don&#39;t =
think I&#39;m alone in this belief. OP_VAULT is probably a bit further out,=
 but pre-signed transactions signed using an ephemeral key can fill the gap=
 and improve the safeguarding of Bitcoin in the short term.<br><br>Backing =
up the ephemeral signatures of the pre-signed transactions on the blockchai=
n itself is an excellent way to ensure that the vault can always be &#39;op=
ened&#39;. However, without the annex, this is not as safe as it could be. =
Due to the described circular reference problem, the vault creation and sig=
nature backup can&#39;t be executed in one atomic operation. For example, y=
ou can store the backup in a child commit/reveal transaction set, but the v=
ault itself can be confirmed independently and the backup may never confirm=
. If you create a vault and lose the ephemeral signatures, the funds will b=
e lost.<br><br>This use case for the annex has been labeled &#39;speculativ=
e&#39; elsewhere. To me, every use case appears speculative at this point b=
ecause the annex isn&#39;t available. However, if you believe that time-loc=
ked vaults are important for Bitcoin and also acknowledge that soft forks, =
such as the one required for OP_VAULT, aren&#39;t easy to implement, I&#39;=
d argue that the intermediate solution described above is very relevant.<br=
><div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px=
 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div di=
r=3D"ltr"><div>As raised on the BIP proposal, those unstructured=C2=A0data =
use-cases could use annex tags with the benefit to combine multiple &quot;t=
ypes&quot; of unstructured data in a single annex payload. As you&#39;re ra=
ising smaller bits of unstructured data might not afford the overhead thoug=
h my answer with this observation would be to move this traffic towards som=
e L2 systems ? In my mind, the default of adding a version byte for the usa=
ge of unstructured data comes with the downside of having future consensus =
enabled use-cases encumbering by the extended witness economic cost.</div><=
/div></blockquote><div><br></div><div>When it comes to the trade-offs assoc=
iated with various encodings, I fully acknowledge their existence.=C2=A0The=
 primary motivation behind my proposal to adopt a simple approach to the Ta=
proot annex is to avoid a potentially long standardization process. While I=
 am not entirely familiar with the decision-making process of Bitcoin Core,=
 my experience with other projects suggests that simpler changes often enco=
unter less resistance and can be implemented more swiftly. Perhaps I am bei=
ng overly cautious here, though.<br></div><div>=C2=A0</div><blockquote clas=
s=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid r=
gb(204,204,204);padding-left:1ex"><div dir=3D"ltr"><div>About=C2=A0the anne=
x payload extension attack described by Greg. If my understanding of this t=
ransaction-relay jamming griefing issue is correct, we can have an annex ta=
g in the future where the signer is committing to the total weight of the t=
ransaction, or even the max per-input annex size ? This should prevent a co=
injoin or aggregated commitment transaction counterparty to inflate its ann=
ex space to downgrade the overall transaction feerate, I guess. And I think=
 this could benefit unstructured data use-cases too.</div></div></blockquot=
e><div><br></div>Regarding the potential payload extension attack, I believ=
e that the changes proposed in the [3] to allow tx replacement by smaller w=
itness would provide a viable solution?=C2=A0<br><div>=C2=A0</div><div>Joos=
t</div><div><br></div><div>[1] <a href=3D"https://lists.linuxfoundation.org=
/pipermail/bitcoin-dev/2023-June/021737.html">https://lists.linuxfoundation=
.org/pipermail/bitcoin-dev/2023-June/021737.html</a></div><div>[2]=C2=A0<a =
href=3D"https://github.com/bitcoin/bips/pull/1421">https://github.com/bitco=
in/bips/pull/1421</a></div><div>[3]=C2=A0<a href=3D"https://github.com/bitc=
oin/bitcoin/pull/24007">https://github.com/bitcoin/bitcoin/pull/24007</a></=
div></div></div>

--000000000000c0fde905fdc1a79e--