Received-SPF: pass (sog-mx-1.v43.ch3.sourceforge.com: domain of gmail.com
	designates 209.85.215.43 as permitted sender)
	client-ip=209.85.215.43; envelope-from=pieter.wuille@gmail.com;
	helo=mail-la0-f43.google.com; 
MIME-Version: 1.0
In-Reply-To: <55304321.3030300@sky-ip.org>
References: <552EF785.7000207@sky-ip.org>
	<CAPg+sBgAhdgPPjmT5i0PMYhQo=Hk6Weo8tpX_Wyn-NJ5Ye9D_A@mail.gmail.com>
	<552FDF73.6010104@sky-ip.org>
	<CAOG=w-vMjysbF5H8wWN2y45U3djFwpKMtXq3vCvB=-eFr7GqFg@mail.gmail.com>
	<55304321.3030300@sky-ip.org>
Date: Fri, 17 Apr 2015 02:02:19 -0700
Message-ID: <CAPg+sBi3QgJK7-PuV-1vbur0AMUeXddUdv_-Mcjwgbefqj3rFg@mail.gmail.com>
From: Pieter Wuille <pieter.wuille@gmail.com>
To: s7r@sky-ip.org
Content-Type: multipart/alternative; boundary=001a113463267007ea0513e7d6eb
Cc: Bitcoin Dev <bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] 75%/95% threshold for transaction versions
Precedence: list

--001a113463267007ea0513e7d6eb
Content-Type: text/plain; charset=ISO-8859-1

> Anyone can alter the txid - more details needed. The number of altered
> txids in practice is not so high in order to make us believe anyone can
> do it easily. It is obvious that all current bitcoin transactions are
> malleable, but not by anyone and not that easy. At least I like to think
so.

Don't assume that because it does not (frequently) happen, that it cannot
happen. Large amounts of malleated transactions have happened in the past.
Especially if you build a system depends on non-malleability for its
security, you may at some point have an attacker who has financial gain
from malleation.

> >From your answer I understand that right now if I create a transaction
> (tx1) and broadcast it, you can alter its txid at your will, without any
> mining power and/or access to my private keys so I would end up not
> recognizing my own transaction and probably my change too (if my systems
> rely hardly on txid)?

In theory, yes, anyone can alter the txid without invalidating it, without
mining power and without access to the sender's private keys.

All it requires is seeing a transaction on the network, doing a trivial
modification to it, and rebroadcasting it quickly. If the modifies version
gets mined, you're out of luck. Having mining power helps of course.

After BIP62, you will, as a sender, optionally be able to protect others
from malleating. You're always able to re-sign yourself.

-- 
Pieter

--001a113463267007ea0513e7d6eb
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<p dir=3D"ltr">&gt; Anyone can alter the txid - more details needed. The nu=
mber of altered<br>
&gt; txids in practice is not so high in order to make us believe anyone ca=
n<br>
&gt; do it easily. It is obvious that all current bitcoin transactions are<=
br>
&gt; malleable, but not by anyone and not that easy. At least I like to thi=
nk so.</p>
<p dir=3D"ltr">Don&#39;t assume that because it does not (frequently) happe=
n, that it cannot happen. Large amounts of malleated transactions have happ=
ened in the past. Especially if you build a system depends on non-malleabil=
ity for its security, you may at some point have an attacker who has financ=
ial gain from malleation.<br></p>
<p dir=3D"ltr">&gt; &gt;From your answer I understand that right now if I c=
reate a transaction<br>
&gt; (tx1) and broadcast it, you can alter its txid at your will, without a=
ny<br>
&gt; mining power and/or access to my private keys so I would end up not<br=
>
&gt; recognizing my own transaction and probably my change too (if my syste=
ms<br>
&gt; rely hardly on txid)?</p>
<p dir=3D"ltr">In theory, yes, anyone can alter the txid without invalidati=
ng it, without mining power and without access to the sender&#39;s private =
keys.</p>
<p dir=3D"ltr">All it requires is seeing a transaction on the network, doin=
g a trivial modification to it, and rebroadcasting it quickly. If the modif=
ies version gets mined, you&#39;re out of luck. Having mining power helps o=
f course.</p>
<p dir=3D"ltr">After BIP62, you will, as a sender, optionally be able to pr=
otect others from malleating. You&#39;re always able to re-sign yourself.</=
p>
<p dir=3D"ltr">-- <br>
Pieter<br>
</p>

--001a113463267007ea0513e7d6eb--