MIME-Version: 1.0
References: <CAMhCMoH9uZPeAE_2tWH6rf0RndqV+ypjbNzazpFwFnLUpPsZ7g@mail.gmail.com>
 <CALZpt+GVe0XTdWqV=LAcOj=nq+k2DEFqc+sKyxAujLDBR7bYbQ@mail.gmail.com>
 <CAMhCMoEONv3jriBU3qwm0pt75iF_sgra1H2Z4rOF8u+e7hs_cw@mail.gmail.com>
 <0f352f70-c93a-614f-e443-67d198ec2c26@protonmail.com>
 <7f3674d1-c1ad-9a82-e30f-7cf24d697faf@protonmail.com>
 <CAMhCMoGabEASO9CGc1hAMpYZn4nWH5D8XFs3eFcSSFAitSFUGA@mail.gmail.com>
 <CAGpPWDZkUYW=Qb763TPzUa6yUf217nh0Bo+O9Qyf=WS2pUQUYA@mail.gmail.com>
 <CAD3i26AXZKDCH3odhCjpMwzOTGQKSFqH9S+5N9UXNTb7CJHONA@mail.gmail.com>
 <CAMhCMoFgto3Bu5+yEoqn1Jf8fNd+EQK-t_H3TKR2=3RXe8FdcQ@mail.gmail.com>
 <CAMhCMoGdZsDO2eZYMf+G36gc5=-SB0HxHXbRSPx5OaCOjo5_Dw@mail.gmail.com>
 <CAD3i26BoasDQGg1VOxaHJzoXXKnYKuBdXOq+wVZ=QhKbycobPA@mail.gmail.com>
In-Reply-To: <CAD3i26BoasDQGg1VOxaHJzoXXKnYKuBdXOq+wVZ=QhKbycobPA@mail.gmail.com>
From: Salvatore Ingala <salvatore.ingala@gmail.com>
Date: Fri, 5 May 2023 23:18:16 +0200
Message-ID: <CAMhCMoH-MSfTeG6vnWPdG9bAxWXRatWQY8wUmOqM5mAyH=5n9Q@mail.gmail.com>
To: =?UTF-8?Q?Johan_Tor=C3=A5s_Halseth?= <johanth@gmail.com>
Content-Type: multipart/alternative; boundary="00000000000083c17705faf8d4be"
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Merkleize All The Things
Precedence: list

--00000000000083c17705faf8d4be
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Thu, 4 May 2023 at 10:34, Johan Tor=C3=A5s Halseth <johanth@gmail.com> w=
rote:
>
> It sounds like we can generalize the description of the construct to:
> Access to (the hash of) embedded data of inputs and outputs, and the
> enforcement of output keys and (static) taptrees. In other words, as
> long as you can dynamically compute the output embedded data in
> Script, you can enforce more or less anything (since you can make the
> output script enforce presenting a witness "satisfying" the embedded
> data).
>
> Does that sound about right?

Yes. Fraud proofs allow us to extend beyond what Script can do (with the
necessary tradeoffs), but there is plenty that can be done without them.


> For instance, I believe you could simulate coin pools pretty easily:
> Commit to the set of pubkeys and amounts owned by the participants in
> the pool, and an output taptree where each participant has their own
> spending path. Now, to exit the pool unilaterally, the participant
> must present a proof that their pubkey+amount is committed to in the
> input and an output where it is no longer committed.

I don't think one would want to have a tapleaf for each participant:
that would make you pay log n hashes just to reveal the tapleaf, and
then you still need to pay log n hashes to access the embedded data.

Instead, the "unilateral withdrawal Script" can be the same for all the
participants. The witness would be the Merkle proof, plus perhaps some
additional information to identify the leaf in the tree (depending on
how the Merkle tree is implemented). In a complete Merkle tree for
N =3D 2^n participants, the witness could contain the n hashes that allow
to prove the value of the leaf, plus n bits to identify the path to the
leaf (0/1 for 'left/right" child), since Script doesn't have enough
opcodes to extract the bits from the leaf index.

The data in the leaf can contain a commitment to all the information
relevant for that participant (e.g.: their balance and pubkey, in a
CoinPool construction).

Then, the same witness can easily be reused to compute the new Merkle
root after the data in the leaf is modified (for example, setting the
amount to 0 for one participant).


> A question that arises is how one would efficiently (in Script) prove
> the inclusion/exclusion of the data in the commitment. One could
> naively hash all the data twice during script execution (once for the
> input, once for the output), but that is costly. It would be natural
> to show merkle tree inclusion/exclusion in script, but perhaps there
> are more efficient ways to prove it?

A Merkle tree as described above commits to an entire vector that you
can index positionally. That's quite versatile, and easier to handle
than more complex constructions like accumulators with exclusion proofs.

A Merkle proof for 2^7 =3D 128 participants requires about 8 hashes, so
around 250 bytes in total of witness size; 2^10 =3D 1024 should bring that
to the ballpark of 350 bytes.

Best,
Salvatore Ingala

--00000000000083c17705faf8d4be
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">On Thu, 4 May 2023 at 10:34, Johan Tor=C3=A5s Halseth &lt;=
<a href=3D"mailto:johanth@gmail.com">johanth@gmail.com</a>&gt; wrote:<br>&g=
t;<br>&gt; It sounds like we can generalize the description of the construc=
t to:<br>&gt; Access to (the hash of) embedded data of inputs and outputs, =
and the<br>&gt; enforcement of output keys and (static) taptrees. In other =
words, as<br>&gt; long as you can dynamically compute the output embedded d=
ata in<br>&gt; Script, you can enforce more or less anything (since you can=
 make the<br>&gt; output script enforce presenting a witness &quot;satisfyi=
ng&quot; the embedded<br>&gt; data).<br>&gt;<br>&gt; Does that sound about =
right?<br><br>Yes. Fraud proofs allow us to extend beyond what Script can d=
o (with the<br>necessary tradeoffs), but there is plenty that can be done w=
ithout them.<br><br><br>&gt; For instance, I believe you could simulate coi=
n pools pretty easily:<br>&gt; Commit to the set of pubkeys and amounts own=
ed by the participants in<br>&gt; the pool, and an output taptree where eac=
h participant has their own<br>&gt; spending path. Now, to exit the pool un=
ilaterally, the participant<br>&gt; must present a proof that their pubkey+=
amount is committed to in the<br>&gt; input and an output where it is no lo=
nger committed.<br><br>I don&#39;t think one would want to have a tapleaf f=
or each participant:<br>that would make you pay log n hashes just to reveal=
 the tapleaf, and<br>then you still need to pay log n hashes to access the =
embedded data.<br><br>Instead, the &quot;unilateral withdrawal Script&quot;=
 can be the same for all the<br>participants. The witness would be the Merk=
le proof, plus perhaps some<br>additional information to identify the leaf =
in the tree (depending on<br>how the Merkle tree is implemented). In a comp=
lete Merkle tree for<br>N =3D 2^n participants, the witness could contain t=
he n hashes that allow<br>to prove the value of the leaf, plus n bits to id=
entify the path to the<br>leaf (0/1 for &#39;left/right&quot; child), since=
 Script doesn&#39;t have enough<br>opcodes to extract the bits from the lea=
f index.<br><br>The data in the leaf can contain a commitment to all the in=
formation<br>relevant for that participant (e.g.: their balance and pubkey,=
 in a<br>CoinPool construction).<br><br>Then, the same witness can easily b=
e reused to compute the new Merkle<br>root after the data in the leaf is mo=
dified (for example, setting the<br>amount to 0 for one participant).<br><b=
r>=C2=A0<br>&gt; A question that arises is how one would efficiently (in Sc=
ript) prove<br>&gt; the inclusion/exclusion of the data in the commitment. =
One could<br>&gt; naively hash all the data twice during script execution (=
once for the<br>&gt; input, once for the output), but that is costly. It wo=
uld be natural<br>&gt; to show merkle tree inclusion/exclusion in script, b=
ut perhaps there<br>&gt; are more efficient ways to prove it?<br><br>A Merk=
le tree as described above commits to an entire vector that you<br>can inde=
x positionally. That&#39;s quite versatile, and easier to handle<br>than mo=
re complex constructions like accumulators with exclusion proofs.<br><br>A =
Merkle proof for 2^7 =3D 128 participants requires about 8 hashes, so<br>ar=
ound 250 bytes in total of witness size; 2^10 =3D 1024 should bring that<br=
>to the ballpark of 350 bytes.<br><br>Best,<br>Salvatore Ingala</div>

--00000000000083c17705faf8d4be--