MIME-Version: 1.0
References: <CAPfvXfJQKb7i8GBvTEvTTz-3dU_5mH8jOv8Nm4Q8gPt=KxrqLQ@mail.gmail.com>
 <CAB3F3DveCDz6yy-rd3ttV8+4sMufsvB+9J-qVK95yh9aLYX+Mw@mail.gmail.com>
 <ZAAqIZZO1KK32Th9@erisian.com.au>
 <CAB3F3DtGpVHkyT_=KLS42rvdP=dgnMvChhR1Rs0BHO5yOEabmw@mail.gmail.com>
 <ZA9zgqeNiCBfBGUz@console>
In-Reply-To: <ZA9zgqeNiCBfBGUz@console>
From: Greg Sanders <gsanders87@gmail.com>
Date: Tue, 14 Mar 2023 10:40:53 -0400
Message-ID: <CAB3F3Dsu8OWJfrEAUB=5rDtrmAm=N9zL1tN_r153v01k9F4LGA@mail.gmail.com>
To: Greg Sanders <gsanders87@gmail.com>, 
 Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>,
 Anthony Towns <aj@erisian.com.au>
Content-Type: multipart/alternative; boundary="00000000000093f42b05f6dd3708"
Subject: Re: [bitcoin-dev] BIP for OP_VAULT
Precedence: list

--00000000000093f42b05f6dd3708
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Brandon,

Thank you for chiming in, causing me to think a bit more deeply on the
privacy issues
and what seems possible.

> I like that in James' current PR proposal we can explicitly batch via
the implied input/output summation rules while avoiding address reuse.
If we can retain some or all of that, I think it would be good for on
chain efficiency and potentially privacy.

Rotating trigger authorization keys maintains batchability and stops
address reuse.
Remember that anytime you share any path, like recovery path, for batching,
it becomes
obvious at spend-time. Rotating inner pubkeys only doesn't seem to help
much.

Coinjoins being the other batching scenario which could benefit perhaps are
quite a heavy
lift. You'd need the recovery policy(every other branch) to be agreed upon,
have everyone unvault
to this new joint vault, then mix, and withdrawal back to the original
vault. If someone is going through
all that effort, I suspect they'll just use a NUMS to reduce fingerprinting=
.

> Many inputs with different internal keys can be combined to satisfy the
total output value for a single output, as long as their scriptpubkeys
with FLU and NUMS internal key are equal This enables avoiding address
reuse within the vault.

To reiterate, we can just cycle any key in the $trigger branch with OP_FLU,
which accomplishes the same thing.
Or in authorization-less $trigger, add a random number which is dropped.

> Many inputs with the same scriptpubkey can be combined to satisfy a
single CTV output template. This allows a user to unfsck themselves if
they initiate a withdrawal that cannot be satisfied because they didn't
send enough sats to satisfy their template.

I think that would fit the deprecated OP_FORWARD_OUTPUTS, but OP_CTV
commits to total
number of inputs to remove txid malleability. I think the real solution to
this mistake would be to hit
the big red RECOVERY button that you're relying on for vault security
anyways.

Cheers,
Greg

On Mon, Mar 13, 2023 at 3:04=E2=80=AFPM Brandon Black <freedom@reardencode.=
com>
wrote:

> Hi Gents,
>
> > > I don't think replacing the internal-public-key makes sense -- if it
> > was immediately spendable via the keypath before there's no reason for
> > it not to be immediately spendable now.
> >
> > Slavishly following the current proposal was the idea to make sure all
> > functionality was captured; I agree with this change.
>
> I think we do need to replace the internal key with a hardcoded NUMS
> point to allow us to batch multiple vault inputs which might have
> different internal keys but the same OP_FLU/OP_VAULT_TRIGGER script to
> the same time+template-restricted output.
>
> I like that in James' current PR proposal we can explicitly batch via
> the implied input/output summation rules while avoiding address reuse.
> If we can retain some or all of that, I think it would be good for on
> chain efficiency and potentially privacy.
>
> My thoughts on batching:
>
> Many inputs with different internal keys can be combined to satisfy the
> total output value for a single output, as long as their scriptpubkeys
> with FLU and NUMS internal key are equal This enables avoiding address
> reuse within the vault.
>
> Many inputs with the same scriptpubkey can be combined to satisfy a
> single CTV output template. This allows a user to unfsck themselves if
> they initiate a withdrawal that cannot be satisfied because they didn't
> send enough sats to satisfy their template.
>
> Best,
>
> --Brandon
>

--00000000000093f42b05f6dd3708
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hi Brandon,</div><div><br></div><div>Thank you for ch=
iming in, causing me to think a bit more deeply on the privacy issues</div>=
<div>and what seems possible.</div><div><br></div>&gt; I like that in James=
&#39; current PR proposal we can explicitly batch via<br>the implied input/=
output summation rules while avoiding address reuse.<br>If we can retain so=
me or all of that, I think it would be good for on<br>chain efficiency and =
potentially privacy.<div><br></div><div>Rotating trigger authorization keys=
 maintains batchability and stops address reuse.</div><div>Remember that an=
ytime you share any path, like recovery path, for batching, it becomes</div=
><div>obvious at spend-time. Rotating inner pubkeys only doesn&#39;t seem t=
o help much.</div><div><br></div><div>Coinjoins=C2=A0being the other batchi=
ng scenario which could benefit perhaps are quite a heavy</div><div>lift. Y=
ou&#39;d need the recovery policy(every other branch) to be agreed upon, ha=
ve everyone unvault</div><div>to this new joint vault, then mix, and withdr=
awal back to the original vault. If someone is going through</div><div>all =
that effort, I suspect they&#39;ll just use a NUMS to reduce fingerprinting=
.</div><div><br></div><div>&gt; Many inputs with different internal keys ca=
n be combined to satisfy the</div>total output value for a single output, a=
s long as their scriptpubkeys<br>with FLU and NUMS internal key are equal T=
his enables avoiding address<br>reuse within the vault.<div><br></div><div>=
To reiterate, we can just cycle any key in the $trigger branch with OP_FLU,=
 which accomplishes the same thing.</div><div>Or in authorization-less $tri=
gger, add a random number which is dropped.</div><div><br></div><div>&gt; M=
any inputs with the same scriptpubkey can be combined to satisfy a</div>sin=
gle CTV output template. This allows a user to unfsck themselves if<br>they=
 initiate a withdrawal that cannot be satisfied because they didn&#39;t<br>=
send enough sats to satisfy their template.<div><br></div><div>I think that=
 would fit the deprecated OP_FORWARD_OUTPUTS, but OP_CTV commits to total</=
div><div>number of inputs to remove txid malleability. I think the real sol=
ution to this mistake would be to hit</div><div>the big red RECOVERY button=
 that you&#39;re relying on for vault security anyways.</div><div><br></div=
><div>Cheers,</div><div>Greg</div></div><br><div class=3D"gmail_quote"><div=
 dir=3D"ltr" class=3D"gmail_attr">On Mon, Mar 13, 2023 at 3:04=E2=80=AFPM B=
randon Black &lt;<a href=3D"mailto:freedom@reardencode.com" target=3D"_blan=
k">freedom@reardencode.com</a>&gt; wrote:<br></div><blockquote class=3D"gma=
il_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,2=
04,204);padding-left:1ex">Hi Gents,<br>
<br>
&gt; &gt; I don&#39;t think replacing the internal-public-key makes sense -=
- if it<br>
&gt; was immediately spendable via the keypath before there&#39;s no reason=
 for<br>
&gt; it not to be immediately spendable now.<br>
&gt; <br>
&gt; Slavishly following the current proposal was the idea to make sure all=
<br>
&gt; functionality was captured; I agree with this change.<br>
<br>
I think we do need to replace the internal key with a hardcoded NUMS<br>
point to allow us to batch multiple vault inputs which might have<br>
different internal keys but the same OP_FLU/OP_VAULT_TRIGGER script to<br>
the same time+template-restricted output.<br>
<br>
I like that in James&#39; current PR proposal we can explicitly batch via<b=
r>
the implied input/output summation rules while avoiding address reuse.<br>
If we can retain some or all of that, I think it would be good for on<br>
chain efficiency and potentially privacy.<br>
<br>
My thoughts on batching:<br>
<br>
Many inputs with different internal keys can be combined to satisfy the<br>
total output value for a single output, as long as their scriptpubkeys<br>
with FLU and NUMS internal key are equal This enables avoiding address<br>
reuse within the vault.<br>
<br>
Many inputs with the same scriptpubkey can be combined to satisfy a<br>
single CTV output template. This allows a user to unfsck themselves if<br>
they initiate a withdrawal that cannot be satisfied because they didn&#39;t=
<br>
send enough sats to satisfy their template.<br>
<br>
Best,<br>
<br>
--Brandon<br>
</blockquote></div>

--00000000000093f42b05f6dd3708--