Date: Sat, 9 Jun 2018 08:50:58 -0400
From: Peter Todd <pete@petertodd.org>
To: Sergio Demian Lerner <sergio.d.lerner@gmail.com>
Message-ID: <20180609125058.sk3rdoyl7li73qdo@petertodd.org>
References: <20180607171311.6qdjohfuuy3ufriv@petertodd.org>
	<CAHUJnBB7UL3mH6SixP_M4yooMVP3DgZa+5hiQOmF=AiqfdpfOg@mail.gmail.com>
	<20180607222028.zbva4vrv64dzrmxy@petertodd.org>
	<CAHUJnBCj8wnjP1=jobfpg7jkfjkX9iSBLeeAOyQCpobh6-AhUA@mail.gmail.com>
	<CAKzdR-paqYgOxToikaVD=0GMsCjHBaynX3WgB-CN6Sn7B7kRXw@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="aq2kv5qp3v6gcggu"
Content-Disposition: inline
In-Reply-To: <CAKzdR-paqYgOxToikaVD=0GMsCjHBaynX3WgB-CN6Sn7B7kRXw@mail.gmail.com>
User-Agent: NeoMutt/20170113 (1.7.2)
Cc: bitcoin-dev <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Trusted merkle tree depth for safe tx inclusion
 proofs without a soft fork
Precedence: list


--aq2kv5qp3v6gcggu
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sat, Jun 09, 2018 at 01:03:53PM +0200, Sergio Demian Lerner wrote:
> Hi Peter,
> We reported this as CVE-2017-12842, although it may have been known by
> developers before us.

It's been known so long ago that I incorrectly thought the attack was ok to
discuss in public; I had apparently incorrectly remembered a conversation I=
 had
with Greg Maxwell over a year ago where I thought he said it was fine to
discuss because it was well known.

My apologies to anyone who thinks my post was jumping the gun by discussing
this in public; cats out of the bag now anyway.

> There are hundreds of SPV wallets out there, without even considering oth=
er
> more sensitive systems relying on SPV proofs.
> As I said we, at RSK, discovered this problem in 2017. For RSK it's very
> important this is fixed because our SPV bridge uses SPV proofs.
> I urge all people participating in this mailing list and the rest of the
> Bitcoin community to work on this issue for the security and clean-design
> of Bitcoin.

My post is arguing that we *don't* need to fix the attack, because we can m=
ake
pruned nodes invulerable to it while retaining the ability to verify merkle
path tx inclusion proofs.

As for SPV, there is no attack to fix: they can be attacked at much lower c=
ost
by simply generating fake blocks.

--=20
https://petertodd.org 'peter'[:-1]@petertodd.org

--aq2kv5qp3v6gcggu
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEFcyURjhyM68BBPYTJIFAPaXwkfsFAlsbzS8ACgkQJIFAPaXw
kfsaSQf/T3IEcE4yl4Xna/Su70C7y1jOCHK2wTLK/Zd4xwm2GwRUutmEthDwcDHp
JJNgNMd9bkBQqXPTlWlnL602nXurLfyGfwoi9GG7Kg27vfqaFtod/nD/uKlUf4I4
Gep6J4mCGu0tAT3J0wG2rmAzWetXfgYCahvc12rsnWop1/kRDGuzmWHQPR6C0Nwx
DoIESSNArAJedP+ACdQ5vLhgYKjlPzilVD9sql8egxKolE7Mx4E2XuqZVdCaHPfi
+smO/lS82umXzoCXQcaoz3JfBVG45Tsl4+Czt//Wmn+d47B/h7k7M9KZMKycRGCf
V7dkzOlRlGkEypNarMY0T2d56Xq18Q==
=SFsE
-----END PGP SIGNATURE-----

--aq2kv5qp3v6gcggu--