MIME-Version: 1.0
References: <CALxbBHU+kdEAh_4+B663vknAAr8OKZpUzVTACORPZi47E=Ehkw@mail.gmail.com>
	<201510212320.31052.luke@dashjr.org>
	<CALxbBHUK_na0qKEBrkCzV2oAUc90wpL4z=7h6Zuu4XzaKEazrA@mail.gmail.com>
	<201510220905.27124.luke@dashjr.org>
In-Reply-To: <201510220905.27124.luke@dashjr.org>
From: Christian Decker <decker.christian@gmail.com>
Date: Tue, 03 Nov 2015 20:37:44 +0000
Message-ID: <CALxbBHV4JU7TG8QutkX7m9V4n_ANgKAgWO8ZA2KxQk8jP=kF0g@mail.gmail.com>
To: Luke Dashjr <luke@dashjr.org>
Content-Type: multipart/alternative; boundary=001a1147181a4f05570523a8de9c
Cc: Bitcoin Dev <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] [BIP] Normalized transaction IDs
Precedence: list

--001a1147181a4f05570523a8de9c
Content-Type: text/plain; charset=UTF-8

Ok, getting the ball rolling again after some downtime. I amended the
proposal to use a simple version number instead of the binary flags, added
the normalization of inputs before computing the signaturehash and added
Schnorr signatures as requested.

The BIP has also been assigned number 130 :-)

I am still very much intrigued by Luke's idea of having empty scriptsigs
and ship the signatures in external scripts, however the proposal uses the
on-the-fly normalization because we have no good way of relaying the
external scripts. Since we are still in the drafting phase I am open to
suggestions and if there is a good/working solution I can amend/withdraw
the proposal.

As for open venues for malleability, I'm not sure we can fix them at all,
after all the ability of a single signer to doublespend by
appending/replacing inputs/outputs in an arbitrary fashion is not fixable
IMHO and will cause any future transaction building on its outputs to be
orphaned. What would the perfect properties for such a fix be?

Regards,
Christian

On Thu, Oct 22, 2015 at 11:05 AM Luke Dashjr <luke@dashjr.org> wrote:

> On Thursday, October 22, 2015 8:26:58 AM Christian Decker wrote:
> > I think the scenario of the single signer re-ordering the outputs and
> > inputs and then re-signing the transaction is in the same category of
> > simple double-spends. The signer could just as well sign a completely
> > different transaction spending the same coins to somewhere else, so I
> don't
> > think there is a lot we can do about it even if we instate a canonical
> > ordering. Even if we order the inputs and outputs the signer can just
> add a
> > new input and output and we would have a different transaction.
> >
> > Normalized transaction IDs do help in the case that the single signer
> wants
> > to immediately follow up its transaction with another transaction
> spending
> > the first one's change output, and it prevents any modification in the
> > multi-signer scenario.
>
> Except that unlike malicious double spending, adding more outputs to
> unconfirmed transactions is what wallets *should ideally be doing every
> time
> they send another transaction*. Spending unconfirmed change is the wrong
> approach. So half-fixing malleability as this PR would, encourages
> inefficient behaviour in multiple ways (first, by not making it
> malleability-
> safe; second, by encouraging spending unconfirmed change).
>
> Luke
>

--001a1147181a4f05570523a8de9c
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Ok, getting the ball rolling again after some downtime. I =
amended the proposal to use a simple version number instead of the binary f=
lags, added the normalization of inputs before computing the signaturehash =
and added Schnorr signatures as requested.<div><br></div><div>The BIP has a=
lso been assigned number 130 :-)</div><div><br></div><div>I am still very m=
uch intrigued by Luke&#39;s idea of having empty scriptsigs and ship the si=
gnatures in external scripts, however the proposal uses the on-the-fly norm=
alization because we have no good way of relaying the external scripts. Sin=
ce we are still in the drafting phase I am open to suggestions and if there=
 is a good/working solution I can amend/withdraw the proposal.</div><div><b=
r></div><div>As for open venues for malleability, I&#39;m not sure we can f=
ix them at all, after all the ability of a single signer to doublespend by =
appending/replacing inputs/outputs in an arbitrary fashion is not fixable I=
MHO and will cause any future transaction building on its outputs to be orp=
haned. What would the perfect properties for such a fix be?</div><div><br><=
/div><div>Regards,</div><div>Christian<br><br><div class=3D"gmail_quote"><d=
iv dir=3D"ltr">On Thu, Oct 22, 2015 at 11:05 AM Luke Dashjr &lt;<a href=3D"=
mailto:luke@dashjr.org">luke@dashjr.org</a>&gt; wrote:<br></div><blockquote=
 class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc soli=
d;padding-left:1ex">On Thursday, October 22, 2015 8:26:58 AM Christian Deck=
er wrote:<br>
&gt; I think the scenario of the single signer re-ordering the outputs and<=
br>
&gt; inputs and then re-signing the transaction is in the same category of<=
br>
&gt; simple double-spends. The signer could just as well sign a completely<=
br>
&gt; different transaction spending the same coins to somewhere else, so I =
don&#39;t<br>
&gt; think there is a lot we can do about it even if we instate a canonical=
<br>
&gt; ordering. Even if we order the inputs and outputs the signer can just =
add a<br>
&gt; new input and output and we would have a different transaction.<br>
&gt;<br>
&gt; Normalized transaction IDs do help in the case that the single signer =
wants<br>
&gt; to immediately follow up its transaction with another transaction spen=
ding<br>
&gt; the first one&#39;s change output, and it prevents any modification in=
 the<br>
&gt; multi-signer scenario.<br>
<br>
Except that unlike malicious double spending, adding more outputs to<br>
unconfirmed transactions is what wallets *should ideally be doing every tim=
e<br>
they send another transaction*. Spending unconfirmed change is the wrong<br=
>
approach. So half-fixing malleability as this PR would, encourages<br>
inefficient behaviour in multiple ways (first, by not making it malleabilit=
y-<br>
safe; second, by encouraging spending unconfirmed change).<br>
<br>
Luke<br>
</blockquote></div></div></div>

--001a1147181a4f05570523a8de9c--