MIME-Version: 1.0
Sender: gmaxwell@gmail.com
In-Reply-To: <CAAt2M1-DTzKct-NU9TotxDve8vLe5HFYxHZbq+t_A69C1nL-PA@mail.gmail.com>
References: <CAPg+sBgKY-nmL=x+LVubtB0fFBAwd-1CDHT7zhidX8p9DLSGyg@mail.gmail.com>
	<CAAt2M1-DTzKct-NU9TotxDve8vLe5HFYxHZbq+t_A69C1nL-PA@mail.gmail.com>
From: Gregory Maxwell <greg@xiph.org>
Date: Wed, 23 May 2018 23:45:09 +0000
Message-ID: <CAAS2fgRnd8WDPYturJZk5T-Q8KVbr4ZVOHq4s-UDOwL0KnBuRA@mail.gmail.com>
To: Natanael <natanael.l@gmail.com>, 
	Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: text/plain; charset="UTF-8"
Subject: Re: [bitcoin-dev] Should Graftroot be optional?
Precedence: list

On Wed, May 23, 2018 at 10:06 PM, Natanael via bitcoin-dev
<bitcoin-dev@lists.linuxfoundation.org> wrote:
> Consider for example a P2SH address for some fund, where you create a
> transaction in advance. Even if the parties involved in signing the
> transaction would agree (collude), the original intent of this particular
> P2SH address may be to hold the fund accountable by enforcing some given
> rules by script. To be able to circumvent the rules could break the purpose
> of the fund.

I am having a bit of difficulty understanding your example.

If graftroot were possible it would mean that the funds were paid to a
public key.  That holder(s) of the corresponding private key could
sign without constraint, and so the accoutability you're expecting
wouldn't exist there regardless of graftroot.

I think maybe your example is only making the case that it should be
possible to send funds constrained by a script without a public key
ever existing at all.  If so, I agree-- but that wasn't the question
here as I understood it.