Date: Fri, 16 Apr 2021 23:52:48 +0000
To: Christopher Gilliard <christopher.gilliard@gmail.com>,
 Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
From: ZmnSCPxj <ZmnSCPxj@protonmail.com>
Reply-To: ZmnSCPxj <ZmnSCPxj@protonmail.com>
Message-ID: <iU2J5dWMIgqAf312ZCNmx38_hcYsKrcuqx84kniWeEdb0wP8jPZPvwHK3P-q1yvmQ5OtdMCwMFqPgwmsL7BUfE8PGUlrxW4rOM3slwHun3E=@protonmail.com>
In-Reply-To: <CAK=nyAz5+yMUA=XDcunA1eeachSisaJoYE2_yzTLj=B0r4=w5A@mail.gmail.com>
References: <CAK=nyAxOa8fsVfxucH7WTTMn25BCzgQ28h_sNsunedpCoRXjjQ@mail.gmail.com>
 <CAMZUoKmR6ZU6mAgEhKDD5cTMuja_OC0_Sz3x4UND=E-g1PkgsQ@mail.gmail.com>
 <CAK=nyAz5+yMUA=XDcunA1eeachSisaJoYE2_yzTLj=B0r4=w5A@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [bitcoin-dev] BIP - limiting OP_RETURN / HF
Precedence: list

Good morning Christopher,

> >> But more importantly, adding limitations on OP_RETURN transactions is =
not helpful.=C2=A0 Users who want to embed arbitrary data in their transact=
ions can always do so by encoding their data inside the values of legacy mu=
lti-signature scriptpubkeys (pubkeys can be generated without knowing the p=
rivate key in order to encode non-key related data).=C2=A0 Not only can use=
rs do this, users have done this in the past.=C2=A0 However, this behaviour=
 is problematic because such multi-signature "data" scriptpubkeys are indis=
tinguishable from "real" multisignature scriptpubkeys, and thus must be kep=
t in the UTXO set.=C2=A0 This differs from outputs using OP_RETURN which ar=
e provably unspendable, and therefore can be safely omitted from the UTXO s=
et.
>
> This sounds like a good justification to remove the legacy multi-signatur=
e capabilities as well.

The same technique can be used on P2PKH as well --- the "pubkey hash" need =
not be a hash of a public key, it can be a 20-byte commitment, or even an A=
SCII message like "ZmnSCPxj is the best" (20 characters, I counted).
There is nothing that *can* check if the hash of a public key is indeed the=
 hash of a public key unless you actually reveal the public key.

If you need a 32-byte commitment, a P2WSH would work --- again the "script =
hash" need not be a hash of a script, it can be any 32-byte commitment.

In all these cases you have to waste 547 satoshi, but that tends to be smal=
l compared to tx fees currently.

Regards,
ZmnSCPxj