MIME-Version: 1.0
In-Reply-To: <5597F93B.3000205@openbitcoinprivacyproject.org>
References: <COL402-EAS195B72E1CF2B75999C1AB11CD950@phx.gbl>
	<20150704054453.GA348@savin.petertodd.org>
	<5597F93B.3000205@openbitcoinprivacyproject.org>
Date: Sat, 4 Jul 2015 16:35:49 +0100
Message-ID: <CAE-z3OWTzgYP7CKbFLf-YFKU+G6CNKND2DmAbnr_3_NjB-Y4fw@mail.gmail.com>
From: Tier Nolan <tier.nolan@gmail.com>
Cc: bitcoin-dev@lists.linuxfoundation.org
Content-Type: multipart/alternative; boundary=001a1135b6f257e625051a0e6d50
Subject: Re: [bitcoin-dev] Fork of invalid blocks due to BIP66 violations
Precedence: list

--001a1135b6f257e625051a0e6d50
Content-Type: text/plain; charset=UTF-8

On Sat, Jul 4, 2015 at 4:18 PM, Justus Ranvier <
justus@openbitcoinprivacyproject.org> wrote:

> In general, the situation can be improved if there existed proofs which
> validating full nodes could broadcast which would tell SPV nodes why the
> branch it sees with the most proof of work is actually invalid.
>

Yeah, fraud proofs have been suggested lots of times in the past.

In this case, they weren't even needed.  Fully updated SPV clients should
also have rejected the invalid fork.  All the information required to
reject it was in the header chain.

The problem wasn't SPV miners, it was SPV-miners where the SPV part wasn't
upgraded to handle v3 blocks.


> As far as I can tell, producing such proofs is reasonably
> straightforward for all cases except the case where a block is invalid
> because it contains a transaction which references a non-existent output.
>

Even that can be handled with UTXO set commitments.  If the UTXO tree is
sorted you can prove that an entry doesn't exist.

What cannot be handled is proving that a block is invalid if the
transaction data for the block is withheld.


> If each transaction input identified the block containing the referenced
> outpoint, then the proof of non-existence is either the block in
> question, or the list of block headers (to show that the block doesn't
> exist). That's a significant improvement in proof size over the entire
> blockchain.
>

That is reasonable.  Unconfirmed transactions can't include that info
though.

It could be committed in as an extra commitment.

One issue is that you need to prove of of these commitments too.

A transaction which points to the wrong block would also be provable in the
same way.


> Proving the non-existence of a particular transaction in a specific
> block could be made easier for future blocks by requiring transactions
> to be ordered in the merkle tree by their hashes.  Then it would just
> require a few nodes in the tree to show that the transaction isn't in
> the place where it should be.
>

You could just have an extra merkle tree.

You would only need to include the block hashes for all transactions to
show that the two trees don't match.  That is 32 bytes per transaction
rather than the full 200-500 bytes per transaction.

--001a1135b6f257e625051a0e6d50
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_extra"><div class=3D"gmail_quote">On S=
at, Jul 4, 2015 at 4:18 PM, Justus Ranvier <span dir=3D"ltr">&lt;<a href=3D=
"mailto:justus@openbitcoinprivacyproject.org" target=3D"_blank">justus@open=
bitcoinprivacyproject.org</a>&gt;</span> wrote:<br><blockquote class=3D"gma=
il_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-lef=
t:1ex"><span class=3D"">
</span>In general, the situation can be improved if there existed proofs wh=
ich<br>
validating full nodes could broadcast which would tell SPV nodes why the<br=
>
branch it sees with the most proof of work is actually invalid.<br></blockq=
uote><div><br></div><div>Yeah, fraud proofs have been suggested lots of tim=
es in the past.<br><br></div><div>In this case, they weren&#39;t even neede=
d.=C2=A0 Fully updated SPV clients should also have rejected the invalid fo=
rk.=C2=A0 All the information required to reject it was in the header chain=
.<br><br></div><div>The problem wasn&#39;t SPV miners, it was SPV-miners wh=
ere the SPV part wasn&#39;t upgraded to handle v3 blocks.<br></div><div>=C2=
=A0<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;b=
order-left:1px #ccc solid;padding-left:1ex">
As far as I can tell, producing such proofs is reasonably<br>
straightforward for all cases except the case where a block is invalid<br>
because it contains a transaction which references a non-existent output.<b=
r></blockquote><div><br></div><div>Even that can be handled with UTXO set c=
ommitments.=C2=A0 If the UTXO tree is sorted you can prove that an entry do=
esn&#39;t exist.<br><br></div><div>What cannot be handled is proving that a=
 block is invalid if the transaction data for the block is withheld.<br></d=
iv><div>=C2=A0<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0=
 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
If each transaction input identified the block containing the referenced<br=
>
outpoint, then the proof of non-existence is either the block in<br>
question, or the list of block headers (to show that the block doesn&#39;t<=
br>
exist). That&#39;s a significant improvement in proof size over the entire<=
br>
blockchain.<br></blockquote><div><br></div><div>That is reasonable.=C2=A0 U=
nconfirmed transactions can&#39;t include that info though.<br><br></div><d=
iv>It could be committed in as an extra commitment.<br><br></div><div>One i=
ssue is that you need to prove of of these commitments too.<br><br></div><d=
iv>A transaction which points to the wrong block would also be provable in =
the same way.<br></div><div>=C2=A0<br></div><blockquote class=3D"gmail_quot=
e" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Proving the non-existence of a particular transaction in a specific<br>
block could be made easier for future blocks by requiring transactions<br>
to be ordered in the merkle tree by their hashes.=C2=A0 Then it would just<=
br>
require a few nodes in the tree to show that the transaction isn&#39;t in<b=
r>
the place where it should be.<br></blockquote><div><br></div><div>You could=
 just have an extra merkle tree.<br><br></div><div>You would only need to i=
nclude the block hashes for all transactions to show that the two trees don=
&#39;t match.=C2=A0 That is 32 bytes per transaction rather than the full 2=
00-500 bytes per transaction.<br></div></div></div></div>

--001a1135b6f257e625051a0e6d50--