Delivery-date: Mon, 06 May 2024 02:48:03 -0700
Sender: bitcoindev@googlegroups.com
Received-SPF: pass (google.com: domain of dave@dtrt.org designates 208.79.240.5 as permitted sender) client-ip=208.79.240.5;
MIME-Version: 1.0
Date: Sun, 05 May 2024 21:39:51 -1000
From: "David A. Harding" <dave@dtrt.org>
To: Andrew Poelstra <apoelstra@wpsoftware.net>
Cc: Matthew Zipkin <pinheadmz@gmail.com>, Ethan Heilman <eth3rs@gmail.com>,
 Bitcoin Development Mailing List <bitcoindev@googlegroups.com>
Subject: Re: [bitcoindev] Signing a Bitcoin Transaction with Lamport
 Signatures (no changes needed)
In-Reply-To: <ZjD-dMMGxoGNgzIg@camus>
References: <CAEM=y+XyW8wNOekw13C5jDMzQ-dOJpQrBC+qR8-uDot25tM=XA@mail.gmail.com>
 <CA+x5asTOTai_4yNGEgtKEqAchuWJ0jGDEgMqHFYDwactPnrgyw@mail.gmail.com>
 <ZjD-dMMGxoGNgzIg@camus>
User-Agent: Roundcube Webmail/1.4.15
Message-ID: <47711dc4ffe9d661e8321b05b6adab4e@dtrt.org>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Precedence: list
Mailing-list: list bitcoindev@googlegroups.com; contact bitcoindev+owners@googlegroups.com

On 2024-04-30 04:21, Andrew Poelstra wrote:
> Another reason this is useful is that if you have a Lamport signature 
> on
> the stack which is composed of SIZE values, all of which are small
> enough to be manipulated with the numeric script opcodes, then you can
> do covenants in Script.

Hi Andrew,

I don't understand the above.  I think of a covenant as a script that is 
able to restrict the scriptPubKey of the transaction that spends it.  As 
I understand Heilman's description, a lamport signature commits to the 
size of an ECDSA signature (which can naturally vary) and the ECDSA 
signature commits to the spending transaction.  Performing the lamport 
verification on the stack is practically equivalent to 
OP_CHECKSIGFROMSTACK, which is half of what you need for a covenant.  As 
you've previously described[1], the other half is some method for 
introspection.  How do lamport signatures offer introspection when 
they're restricted to committing to ECDSA signatures that can't be known 
at the time a script is created due to circular dependency in hashing 
(i.e., the ECDSA signature commits to the spending transaction, which 
commits to the previous transaction's txid, which commits to the 
script)?

Thanks!,

-Dave

[1] https://medium.com/blockstream/cat-and-schnorr-tricks-i-faf1b59bd298

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/bitcoindev/47711dc4ffe9d661e8321b05b6adab4e%40dtrt.org.