Date: Mon, 12 Jul 2021 15:01:15 +1000
From: Anthony Towns <aj@erisian.com.au>
To: Jeremy <jlrubin@mit.edu>
Message-ID: <20210712050115.GA6250@erisian.com.au>
References: <CAD5xwhgO5p2Ldy1P1rUuqDHcJ0opSe7Tg_mX_rb+ZpLOxa47cA@mail.gmail.com>
 <20210708084416.GB1339@erisian.com.au>
 <CAD5xwhjVod-Lu-gjU89znmVZnmL4UrL7xVuy=gZuuG6JG9X5yg@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAD5xwhjVod-Lu-gjU89znmVZnmL4UrL7xVuy=gZuuG6JG9X5yg@mail.gmail.com>
User-Agent: Mutt/1.10.1 (2018-07-13)
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>,
 lightning-dev <lightning-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] [Lightning-dev] Eltoo / Anyprevout & Baked in
 Sequences
Precedence: list

On Thu, Jul 08, 2021 at 08:48:14AM -0700, Jeremy wrote:
>     This would disallow using a relative locktime and an absolute locktime
>     for the same input. I don't think I've seen a use case for that so far,
>     but ruling it out seems suboptimal.
> I think you meant disallowing a relative locktime and a sequence locktime? I
> agree it is suboptimal.

No? If you overload the nSequence for a per-input absolute locktime
(well in the past for eltoo), then you can't reuse the same input's
nSequence for a per-input relative locktime (ie CSV).

Apparently I have thought of a use for it now -- cut-through of PTLC
refunds when the timeout expires well after the channel settlement delay
has passed. (You want a signature that's valid after a relative locktime
of the delay and after the absolute timeout)

> What do you make of sequence tagged keys?

I think we want sequencing restrictions to be obvious from some (simple)
combination of nlocktime/nsequence/annex so that you don't have to
evaluate scripts/signatures in order to determine if a transaction
is final.

Perhaps there's a more general principle -- evaluating a script should
only return one bit of info: "bool tx_is_invalid_script_failed"; every
other bit of information -- how much is paid in fees (cf ethereum gas
calculations), when the tx is final, if the tx is only valid in some
chain fork, if other txs have to have already been mined / can't have
been mined, who loses funds and who gets funds, etc... -- should already
be obvious from a "simple" parsing of the tx.

Cheers,
aj