Delivery-date: Tue, 03 Jun 2025 11:29:34 -0700
Sender: bitcoindev@googlegroups.com
Date: Tue, 3 Jun 2025 10:26:41 -0700 (PDT)
From: Leo Wandersleb <lwandersleb@gmail.com>
To: Bitcoin Development Mailing List <bitcoindev@googlegroups.com>
Message-Id: <5e393f57-ac87-40fd-93ef-e1006accdb55n@googlegroups.com>
In-Reply-To: <ZmYpRwmVDoJBUhiCRb909Lgwws_dT9d_CNUjfddVt128pyjdH0UcYfXgA_uguwRu44ZC8_x_SwlrooqKhyvdwJjnO1h3BvzQxVRbdCpVfjg=@proton.me>
References: <2c3b7e1c-95dd-4773-a88f-f2cdb37acf4a@gmail.com>
 <CAFC_Vt7z5Vj=r90J8RoH3sC5592BO4G9U3L9gdcX+D3DruC1PQ@mail.gmail.com>
 <33f67e84-5d1c-4c14-80b9-90a3fec3cb36@gmail.com>
 <ZmYpRwmVDoJBUhiCRb909Lgwws_dT9d_CNUjfddVt128pyjdH0UcYfXgA_uguwRu44ZC8_x_SwlrooqKhyvdwJjnO1h3BvzQxVRbdCpVfjg=@proton.me>
Subject: Re: [bitcoindev] Pre-emptive commit/reveal for quantum-safe migration (poison-pill)
MIME-Version: 1.0
Content-Type: multipart/mixed; 
	boundary="----=_Part_477528_1713939525.1748971601858"
Precedence: list
Mailing-list: list bitcoindev@googlegroups.com; contact bitcoindev+owners@googlegroups.com

------=_Part_477528_1713939525.1748971601858
Content-Type: multipart/alternative; 
	boundary="----=_Part_477529_508156734.1748971601858"

------=_Part_477529_508156734.1748971601858
Content-Type: text/plain; charset="UTF-8"

Hi conduition,

Thanks for your careful analysis - excellent catches.

You're absolutely right about the txid vulnerability. The commitment must 
be to the complete transaction including witness data (wTXID or equivalent) 
to prevent an attacker from pre-committing to unsigned transactions. This 
is essential - otherwise an attacker could indeed enumerate the UTXO set 
and create commitments without knowing the private keys.

Regarding updates: You're correct that frequent updates would be needed as 
wallets receive new UTXOs. However, I don't see this as a major issue - 
users could batch their commitments periodically (say, monthly) rather than 
after every transaction. The scheme is particularly important for existing 
UTXOs that already have exposed pubkeys (old P2PK, reused addresses, etc.). 
For new UTXOs, wallets should ideally migrate to quantum-safe addresses 
once available. OpenTimestamps aggregation would indeed help with scaling 
and provide plausible deniability about the number of UTXOs being protected.

The time delay serves a different purpose than you might expect. It's not 
about preventing commitment forgery after pubkey exposure, but rather about 
allowing priority based on commitment age when multiple parties claim the 
same UTXO:

1. Weak announcement starts the 144-block window
2. During this window, anyone with a strong commitment can reveal it
3. The oldest valid commitment wins

This creates the "poison pill" effect: an attacker might crack a key and 
try to spend a UTXO, but if the original owner has an older commitment, 
they can reclaim it during the window. The uncertainty about which UTXOs 
have poison pills makes attacking large "lost" UTXOs risky - hence less 
disruptive to the network.

The delay essentially allows a "commitment priority contest" where age 
determines the winner, protecting users who prepared early while still 
allowing these users to not move their funds.

Best,

Leo

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/5e393f57-ac87-40fd-93ef-e1006accdb55n%40googlegroups.com.

------=_Part_477529_508156734.1748971601858
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi conduition,<br /><br />Thanks for your careful analysis - excellent catc=
hes.<br /><br />You're absolutely right about the txid vulnerability. The c=
ommitment must be to the complete transaction including witness data (wTXID=
 or equivalent) to prevent an attacker from pre-committing to unsigned tran=
sactions. This is essential - otherwise an attacker could indeed enumerate =
the UTXO set and create commitments without knowing the private keys.<br />=
<br />Regarding updates: You're correct that frequent updates would be need=
ed as wallets receive new UTXOs. However, I don't see this as a major issue=
 - users could batch their commitments periodically (say, monthly) rather t=
han after every transaction. The scheme is particularly important for exist=
ing UTXOs that already have exposed pubkeys (old P2PK, reused addresses, et=
c.). For new UTXOs, wallets should ideally migrate to quantum-safe addresse=
s once available. OpenTimestamps aggregation would indeed help with scaling=
 and provide plausible deniability about the number of UTXOs being protecte=
d.<br /><br />The time delay serves a different purpose than you might expe=
ct. It's not about preventing commitment forgery after pubkey exposure, but=
 rather about allowing priority based on commitment age when multiple parti=
es claim the same UTXO:<br /><br />1. Weak announcement starts the 144-bloc=
k window<br />2. During this window, anyone with a strong commitment can re=
veal it<br />3. The oldest valid commitment wins<br /><br />This creates th=
e "poison pill" effect: an attacker might crack a key and try to spend a UT=
XO, but if the original owner has an older commitment, they can reclaim it =
during the window. The uncertainty about which UTXOs have poison pills make=
s attacking large "lost" UTXOs risky - hence less disruptive to the network=
.<br /><br />The delay essentially allows a "commitment priority contest" w=
here age determines the winner, protecting users who prepared early while s=
till allowing these users to not move their funds.<br /><br />Best,<br /><b=
r />Leo<br />

<p></p>

-- <br />
You received this message because you are subscribed to the Google Groups &=
quot;Bitcoin Development Mailing List&quot; group.<br />
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:bitcoindev+unsubscribe@googlegroups.com">bitcoind=
ev+unsubscribe@googlegroups.com</a>.<br />
To view this discussion visit <a href=3D"https://groups.google.com/d/msgid/=
bitcoindev/5e393f57-ac87-40fd-93ef-e1006accdb55n%40googlegroups.com?utm_med=
ium=3Demail&utm_source=3Dfooter">https://groups.google.com/d/msgid/bitcoind=
ev/5e393f57-ac87-40fd-93ef-e1006accdb55n%40googlegroups.com</a>.<br />

------=_Part_477529_508156734.1748971601858--

------=_Part_477528_1713939525.1748971601858--