Return-Path: Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id 6EE81AC2 for ; Sat, 4 Jul 2015 15:35:51 +0000 (UTC) X-Greylist: whitelisted by SQLgrey-1.7.6 Received: from mail-qk0-f171.google.com (mail-qk0-f171.google.com [209.85.220.171]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id A5BD4192 for ; Sat, 4 Jul 2015 15:35:50 +0000 (UTC) Received: by qkei195 with SMTP id i195so90417267qke.3 for ; Sat, 04 Jul 2015 08:35:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:cc :content-type; bh=S0EtoGxohgrKXM7oAYdn5hJVH8VUCpdgnfhdf25u8iQ=; b=0HdF1P2/n8Ga5/RFkIj5wUhl9oHnbUGk4YWFEyOegE7+XujJNCmyjFm8Xgp+lJhvML dIAk4tGMMrHaaCXhxUauZecVqyyRudqzU/q95nIFOJ02SEEqHa/86+LDaXbinOgRRwjR viAV3KCFPc3E2zskhPR9ol4pQ1S6zz96yQ+RY2k8VGl103YM38YjTJ8cj9+4jT/H/zQ2 cSCwyi0eKV/53PWQY1aT/StA/dpFcKMsd4LvHC5jmhqRw8ON2INEfU2UoVIkZDhd2gkv LlsDU6sTLvVoDOmYHp/aHLXPYOV2EmoW1bE0sR4msm1T7smVv4J+R1wpECfF0krzXZqs P3iA== MIME-Version: 1.0 X-Received: by 10.140.238.15 with SMTP id j15mr63289740qhc.4.1436024149893; Sat, 04 Jul 2015 08:35:49 -0700 (PDT) Received: by 10.140.93.162 with HTTP; Sat, 4 Jul 2015 08:35:49 -0700 (PDT) In-Reply-To: <5597F93B.3000205@openbitcoinprivacyproject.org> References: <20150704054453.GA348@savin.petertodd.org> <5597F93B.3000205@openbitcoinprivacyproject.org> Date: Sat, 4 Jul 2015 16:35:49 +0100 Message-ID: From: Tier Nolan Cc: bitcoin-dev@lists.linuxfoundation.org Content-Type: multipart/alternative; boundary=001a1135b6f257e625051a0e6d50 X-Spam-Status: No, score=-1.7 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,HTML_MESSAGE,MISSING_HEADERS, RCVD_IN_DNSWL_LOW autolearn=no version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org Subject: Re: [bitcoin-dev] Fork of invalid blocks due to BIP66 violations X-BeenThere: bitcoin-dev@lists.linuxfoundation.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Bitcoin Development Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 04 Jul 2015 15:35:51 -0000 --001a1135b6f257e625051a0e6d50 Content-Type: text/plain; charset=UTF-8 On Sat, Jul 4, 2015 at 4:18 PM, Justus Ranvier < justus@openbitcoinprivacyproject.org> wrote: > In general, the situation can be improved if there existed proofs which > validating full nodes could broadcast which would tell SPV nodes why the > branch it sees with the most proof of work is actually invalid. > Yeah, fraud proofs have been suggested lots of times in the past. In this case, they weren't even needed. Fully updated SPV clients should also have rejected the invalid fork. All the information required to reject it was in the header chain. The problem wasn't SPV miners, it was SPV-miners where the SPV part wasn't upgraded to handle v3 blocks. > As far as I can tell, producing such proofs is reasonably > straightforward for all cases except the case where a block is invalid > because it contains a transaction which references a non-existent output. > Even that can be handled with UTXO set commitments. If the UTXO tree is sorted you can prove that an entry doesn't exist. What cannot be handled is proving that a block is invalid if the transaction data for the block is withheld. > If each transaction input identified the block containing the referenced > outpoint, then the proof of non-existence is either the block in > question, or the list of block headers (to show that the block doesn't > exist). That's a significant improvement in proof size over the entire > blockchain. > That is reasonable. Unconfirmed transactions can't include that info though. It could be committed in as an extra commitment. One issue is that you need to prove of of these commitments too. A transaction which points to the wrong block would also be provable in the same way. > Proving the non-existence of a particular transaction in a specific > block could be made easier for future blocks by requiring transactions > to be ordered in the merkle tree by their hashes. Then it would just > require a few nodes in the tree to show that the transaction isn't in > the place where it should be. > You could just have an extra merkle tree. You would only need to include the block hashes for all transactions to show that the two trees don't match. That is 32 bytes per transaction rather than the full 200-500 bytes per transaction. --001a1135b6f257e625051a0e6d50 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On S= at, Jul 4, 2015 at 4:18 PM, Justus Ranvier <justus@open= bitcoinprivacyproject.org> wrote:
In general, the situation can be improved if there existed proofs wh= ich
validating full nodes could broadcast which would tell SPV nodes why the branch it sees with the most proof of work is actually invalid.

Yeah, fraud proofs have been suggested lots of tim= es in the past.

In this case, they weren't even neede= d.=C2=A0 Fully updated SPV clients should also have rejected the invalid fo= rk.=C2=A0 All the information required to reject it was in the header chain= .

The problem wasn't SPV miners, it was SPV-miners wh= ere the SPV part wasn't upgraded to handle v3 blocks.
=C2= =A0
As far as I can tell, producing such proofs is reasonably
straightforward for all cases except the case where a block is invalid
because it contains a transaction which references a non-existent output.

Even that can be handled with UTXO set c= ommitments.=C2=A0 If the UTXO tree is sorted you can prove that an entry do= esn't exist.

What cannot be handled is proving that a= block is invalid if the transaction data for the block is withheld.
=C2=A0
If each transaction input identified the block containing the referenced outpoint, then the proof of non-existence is either the block in
question, or the list of block headers (to show that the block doesn't<= br> exist). That's a significant improvement in proof size over the entire<= br> blockchain.

That is reasonable.=C2=A0 U= nconfirmed transactions can't include that info though.

It could be committed in as an extra commitment.

One i= ssue is that you need to prove of of these commitments too.

A transaction which points to the wrong block would also be provable in = the same way.
=C2=A0
Proving the non-existence of a particular transaction in a specific
block could be made easier for future blocks by requiring transactions
to be ordered in the merkle tree by their hashes.=C2=A0 Then it would just<= br> require a few nodes in the tree to show that the transaction isn't in the place where it should be.

You could= just have an extra merkle tree.

You would only need to i= nclude the block hashes for all transactions to show that the two trees don= 't match.=C2=A0 That is 32 bytes per transaction rather than the full 2= 00-500 bytes per transaction.
--001a1135b6f257e625051a0e6d50--