Delivery-date: Mon, 06 May 2024 09:59:40 -0700
Sender: bitcoindev@googlegroups.com
Received-SPF: pass (google.com: domain of apoelstra@wpsoftware.net designates 66.183.0.205 as permitted sender) client-ip=66.183.0.205;
Date: Mon, 6 May 2024 16:48:17 +0000
From: Andrew Poelstra <apoelstra@wpsoftware.net>
To: "David A. Harding" <dave@dtrt.org>
Cc: Matthew Zipkin <pinheadmz@gmail.com>, Ethan Heilman <eth3rs@gmail.com>,
	Bitcoin Development Mailing List <bitcoindev@googlegroups.com>
Subject: Re: [bitcoindev] Signing a Bitcoin Transaction with Lamport
 Signatures (no changes needed)
Message-ID: <ZjkJ0fPyzuAPTLWS@camus>
References: <CAEM=y+XyW8wNOekw13C5jDMzQ-dOJpQrBC+qR8-uDot25tM=XA@mail.gmail.com>
 <CA+x5asTOTai_4yNGEgtKEqAchuWJ0jGDEgMqHFYDwactPnrgyw@mail.gmail.com>
 <ZjD-dMMGxoGNgzIg@camus>
 <47711dc4ffe9d661e8321b05b6adab4e@dtrt.org>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="uWbPaJfyaDo01qX6"
Content-Disposition: inline
In-Reply-To: <47711dc4ffe9d661e8321b05b6adab4e@dtrt.org>
Precedence: list
Mailing-list: list bitcoindev@googlegroups.com; contact bitcoindev+owners@googlegroups.com


--uWbPaJfyaDo01qX6
Content-Type: text/plain; charset="UTF-8"
Content-Disposition: inline

On Sun, May 05, 2024 at 09:39:51PM -1000, David A. Harding wrote:
> 
> Hi Andrew,
> 
> I don't understand the above.  I think of a covenant as a script that is
> able to restrict the scriptPubKey of the transaction that spends it.  As I
> understand Heilman's description, a lamport signature commits to the size of
> an ECDSA signature (which can naturally vary) and the ECDSA signature
> commits to the spending transaction.  Performing the lamport verification on
> the stack is practically equivalent to OP_CHECKSIGFROMSTACK, which is half
> of what you need for a covenant.  As you've previously described[1], the
> other half is some method for introspection.  How do lamport signatures
> offer introspection when they're restricted to committing to ECDSA
> signatures that can't be known at the time a script is created due to
> circular dependency in hashing (i.e., the ECDSA signature commits to the
> spending transaction, which commits to the previous transaction's txid,
> which commits to the script)?
>

Aside from limits on transaction size, post-Taproot script can verify a
trace of any program execution, as long as the individual elements it is
operating on fit into 4-byte CScriptNums. You can therefore implement
SHA2, ECDSA, etc., and reconstruct the pattern of SIZE elements by
feeding in transaction data. Which of course can then be arbitrarily
constrained.

Probably actually doing this would take more than 4 megs of script and
you would need to use some sort of BitVM tricks and the whole thing
might not work. But this was my point in saying that "only the script
limits are stopping us from having covenants".

And pre-Taproot we have only 201 opcodes so of course this is all
totally out of the question :) but plausibly we could make a copy of the
Lamport signature in a Taproot output and then use non-equivocation
slashing conditions to somehow make things work.


-- 
Andrew Poelstra
Director, Blockstream Research
Email: apoelstra at wpsoftware.net
Web:   https://www.wpsoftware.net/andrew

The sun is always shining in space
    -Justin Lewis-Webster

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/bitcoindev/ZjkJ0fPyzuAPTLWS%40camus.

--uWbPaJfyaDo01qX6
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEkPnKPD7Je+ki35VexYjWPOQbl8EFAmY5Cc8ACgkQxYjWPOQb
l8E/6Qf/VH8gQhms8B3p6VdIAOAreXuuOMaANr9JBRL6dj0azJBhjoy8OcPUbf0m
Lh06bmekh5kcKwxkFPH8KqF4bxyNQt5q1XUff+b393R5/hsaiXHXUSRGPk5xd2w6
rPB7/B/BrClDs6ihGEQlECbuzjdM3t52Ztc8Xz8lyfuZyWAn1gOvAl2HH7yLT6+u
PcBAKZlOnup+wOYuSEyRQZYa42pQFnMKfcblEBR3XoYmZKu8kE7WNogzs1cU92aB
96p+XrmJXsq/6KinHz5ASgChQTfPOzQYWN4qCkjse4m8neG7TaRynHXahiizUihx
1NfuQIH6F4p/g9aKbLVlUYMAlRV5Og==
=Kwxv
-----END PGP SIGNATURE-----

--uWbPaJfyaDo01qX6--