Received-SPF: pass (sog-mx-1.v43.ch3.sourceforge.com: domain of gmail.com
	designates 209.85.223.175 as permitted sender)
	client-ip=209.85.223.175; envelope-from=pieter.wuille@gmail.com;
	helo=mail-ie0-f175.google.com; 
MIME-Version: 1.0
In-Reply-To: <54BFFE30.8010105@bitcoinarmory.com>
References: <CAPg+sBhk7F2OHT64i2LNSjv8DR5tD3RJkLJGzPGZW8OPQTCjQw@mail.gmail.com>
	<54BFFE30.8010105@bitcoinarmory.com>
Date: Wed, 21 Jan 2015 15:30:44 -0500
Message-ID: <CAPg+sBhx=_DubYGZhBSMmYzeyZQd1NE_p0dLzoODY02vU0LQUQ@mail.gmail.com>
From: Pieter Wuille <pieter.wuille@gmail.com>
To: Douglas Roark <doug@bitcoinarmory.com>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Bitcoin Dev <bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] [softfork proposal] Strict DER signatures
Precedence: list

On Wed, Jan 21, 2015 at 2:29 PM, Douglas Roark <doug@bitcoinarmory.com> wrote:
> Nice paper, Pieter. I do have a bit of feedback.

Thanks for the comments. I hope I have clarified the text a bit accordingly.

> 1)The first sentence of "Deployment" has a typo. "We reuse the
> double-threshold switchover mechanism from BIP 34, with the same
> *thresholds*, [....]"

Fixed.

> 2)I think the handling of the sighash byte in the comments of
> IsDERSignature() could use a little tweaking. If you look at
> CheckSignatureEncoding() in the actual code (src/script/interpreter.cpp
> in master), it's clear that the sighash byte is included as part of the
> signature struct, even though it's not part of the actual DER encoding
> being checked by IsDERSignature(). This is fine. I just think that the
> code comments in the paper ought to make this point clearer, either in
> the sighash description, or as a comment when checking the sig size
> (i.e., size-3 is valid because sighash is included), or both.

I've renamed the function to IsValidSignatureEncoding, as it is not
strictly about DER (it adds a Bitcoin-specific byte, and supports and
empty string too).

> 3)The paper says a sig with size=0 is correctly coded but is neither
> valid nor DER. Perhaps this code should be elsewhere in the Bitcoin
> code? It seems to me that letting a sig pass in IsDERSignature() when
> it's not actually DER-encoded is incorrect.

I've expanded the comments about it a bit.

-- 
Pieter