Delivery-date: Fri, 15 Nov 2024 14:02:19 -0800
Sender: bitcoindev@googlegroups.com
Date: Fri, 15 Nov 2024 13:54:08 -0800 (PST)
From: Xiaohui Liu <x.liu@scrypt.io>
To: Bitcoin Development Mailing List <bitcoindev@googlegroups.com>
Message-Id: <129a9605-7a91-42a7-a9ef-07de6662ca7en@googlegroups.com>
In-Reply-To: <ZjD-dMMGxoGNgzIg@camus>
References: <CAEM=y+XyW8wNOekw13C5jDMzQ-dOJpQrBC+qR8-uDot25tM=XA@mail.gmail.com>
 <CA+x5asTOTai_4yNGEgtKEqAchuWJ0jGDEgMqHFYDwactPnrgyw@mail.gmail.com>
 <ZjD-dMMGxoGNgzIg@camus>
Subject: Re: [bitcoindev] Signing a Bitcoin Transaction with Lamport
 Signatures (no changes needed)
MIME-Version: 1.0
Content-Type: multipart/mixed; 
	boundary="----=_Part_116478_1244980752.1731707648849"
Precedence: list
Mailing-list: list bitcoindev@googlegroups.com; contact bitcoindev+owners@googlegroups.com

------=_Part_116478_1244980752.1731707648849
Content-Type: multipart/alternative; 
	boundary="----=_Part_116479_1946381969.1731707648849"

------=_Part_116479_1946381969.1731707648849
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi,

How does covenant work without OP_CAT here, assuming no size limit? Don't=
=20
you still need OP_CAT to parse/introspect fields (e.g., input/output) of=20
the spending transaction?

Regards,
sCrypt

On Tuesday, April 30, 2024 at 7:22:54=E2=80=AFAM UTC-7 Andrew Poelstra wrot=
e:

> On Tue, Apr 30, 2024 at 08:32:42AM -0400, Matthew Zipkin wrote:
> > > if an attacker managed to grind a 23-byte r-value at a cost of 2^72
> > computations, it would provide the attacker some advantage.
> >=20
> > If we are assuming discrete log is still hard, why do we need Lamport
> > signatures at all? In a post-quantum world, finding k such that r is 21
> > bytes or less is efficient for the attacker.
> >
>
> Aside from Ethan's point that a variant of this technique is still
> secure in the case that discrete log is totally broken (or even
> partially broken...all we need is that _somebody_ is able to find the
> discrete log of the x=3D1 point and for them to publish this).
>
> Another reason this is useful is that if you have a Lamport signature on
> the stack which is composed of SIZE values, all of which are small
> enough to be manipulated with the numeric script opcodes, then you can
> do covenants in Script.
>
> (Sadly(?), I think none of this works in the context of the 201-opcode
> limit...and absent BitVM challenge-response tricks it's unlikely you can
> do much in the context of the 4MWu block size limit..), but IMO it's a
> pretty big deal that size limits are now the only reason that Bitcoin
> doesn't have covenants.)
>
> --=20
> Andrew Poelstra
> Director, Blockstream Research
> Email: apoelstra at wpsoftware.net
> Web: https://www.wpsoftware.net/andrew
>
> The sun is always shining in space
> -Justin Lewis-Webster
>
>

--=20
You received this message because you are subscribed to the Google Groups "=
Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to bitcoindev+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/=
129a9605-7a91-42a7-a9ef-07de6662ca7en%40googlegroups.com.

------=_Part_116479_1946381969.1731707648849
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div>Hi,</div><div><br /></div>How does covenant work without OP_CAT here, =
assuming no size limit? Don't you still need OP_CAT to parse/introspect fie=
lds (e.g., input/output) of the spending transaction?<div><br /></div><div>=
Regards,</div><div>sCrypt</div><div><br /></div><div class=3D"gmail_quote">=
<div dir=3D"auto" class=3D"gmail_attr">On Tuesday, April 30, 2024 at 7:22:5=
4=E2=80=AFAM UTC-7 Andrew Poelstra wrote:<br/></div><blockquote class=3D"gm=
ail_quote" style=3D"margin: 0 0 0 0.8ex; border-left: 1px solid rgb(204, 20=
4, 204); padding-left: 1ex;">On Tue, Apr 30, 2024 at 08:32:42AM -0400, Matt=
hew Zipkin wrote:
<br>&gt; &gt; if an attacker managed to grind a 23-byte r-value at a cost o=
f 2^72
<br>&gt; computations, it would provide the attacker some advantage.
<br>&gt;=20
<br>&gt; If we are assuming discrete log is still hard, why do we need Lamp=
ort
<br>&gt; signatures at all? In a post-quantum world, finding k such that r =
is 21
<br>&gt; bytes or less is efficient for the attacker.
<br>&gt;
<br>
<br>Aside from Ethan&#39;s point that a variant of this technique is still
<br>secure in the case that discrete log is totally broken (or even
<br>partially broken...all we need is that _somebody_ is able to find the
<br>discrete log of the x=3D1 point and for them to publish this).
<br>
<br>Another reason this is useful is that if you have a Lamport signature o=
n
<br>the stack which is composed of SIZE values, all of which are small
<br>enough to be manipulated with the numeric script opcodes, then you can
<br>do covenants in Script.
<br>
<br>(Sadly(?), I think none of this works in the context of the 201-opcode
<br>limit...and absent BitVM challenge-response tricks it&#39;s unlikely yo=
u can
<br>do much in the context of the 4MWu block size limit..), but IMO it&#39;=
s a
<br>pretty big deal that size limits are now the only reason that Bitcoin
<br>doesn&#39;t have covenants.)
<br>
<br>--=20
<br>Andrew Poelstra
<br>Director, Blockstream Research
<br>Email: apoelstra at <a href=3D"http://wpsoftware.net" target=3D"_blank"=
 rel=3D"nofollow" data-saferedirecturl=3D"https://www.google.com/url?hl=3De=
n&amp;q=3Dhttp://wpsoftware.net&amp;source=3Dgmail&amp;ust=3D17317938873310=
00&amp;usg=3DAOvVaw2qNwbsvfc_hMVEvYdRa8Kn">wpsoftware.net</a>
<br>Web:   <a href=3D"https://www.wpsoftware.net/andrew" target=3D"_blank" =
rel=3D"nofollow" data-saferedirecturl=3D"https://www.google.com/url?hl=3Den=
&amp;q=3Dhttps://www.wpsoftware.net/andrew&amp;source=3Dgmail&amp;ust=3D173=
1793887331000&amp;usg=3DAOvVaw1xFz8de2XVGwNtkOx4HgEt">https://www.wpsoftwar=
e.net/andrew</a>
<br>
<br>The sun is always shining in space
<br>    -Justin Lewis-Webster
<br>
<br></blockquote></div>

<p></p>

-- <br />
You received this message because you are subscribed to the Google Groups &=
quot;Bitcoin Development Mailing List&quot; group.<br />
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:bitcoindev+unsubscribe@googlegroups.com">bitcoind=
ev+unsubscribe@googlegroups.com</a>.<br />
To view this discussion visit <a href=3D"https://groups.google.com/d/msgid/=
bitcoindev/129a9605-7a91-42a7-a9ef-07de6662ca7en%40googlegroups.com?utm_med=
ium=3Demail&utm_source=3Dfooter">https://groups.google.com/d/msgid/bitcoind=
ev/129a9605-7a91-42a7-a9ef-07de6662ca7en%40googlegroups.com</a>.<br />

------=_Part_116479_1946381969.1731707648849--

------=_Part_116478_1244980752.1731707648849--