Delivery-date: Sat, 16 Nov 2024 07:02:32 -0800
Sender: bitcoindev@googlegroups.com
Received-SPF: pass (google.com: domain of eth3rs@gmail.com designates 2a00:1450:4864:20::634 as permitted sender) client-ip=2a00:1450:4864:20::634;
MIME-Version: 1.0
References: <CAEM=y+XyW8wNOekw13C5jDMzQ-dOJpQrBC+qR8-uDot25tM=XA@mail.gmail.com>
 <CA+x5asTOTai_4yNGEgtKEqAchuWJ0jGDEgMqHFYDwactPnrgyw@mail.gmail.com>
 <ZjD-dMMGxoGNgzIg@camus> <129a9605-7a91-42a7-a9ef-07de6662ca7en@googlegroups.com>
In-Reply-To: <129a9605-7a91-42a7-a9ef-07de6662ca7en@googlegroups.com>
From: Ethan Heilman <eth3rs@gmail.com>
Date: Sat, 16 Nov 2024 09:55:48 -0500
Message-ID: <CAEM=y+WMqVLd_ujepgZiC+7hJAPxG3i0j+EOBFXTxfaaq38LSg@mail.gmail.com>
Subject: Re: [bitcoindev] Signing a Bitcoin Transaction with Lamport
 Signatures (no changes needed)
To: Xiaohui Liu <x.liu@scrypt.io>
Cc: Bitcoin Development Mailing List <bitcoindev@googlegroups.com>
Content-Type: multipart/alternative; boundary="000000000000b89640062708e13e"
Precedence: list
Mailing-list: list bitcoindev@googlegroups.com; contact bitcoindev+owners@googlegroups.com

--000000000000b89640062708e13e
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

I don't think it is clear how to turn this into a covenant. The bits you
are extracting using OP_SIZE are only related to the sighash via a random
function.

That said, I don't see any reason that with an unlimited number of opcodes
you can build an small script that's uses SPV to introspect into the entire
blockchains and enforce anything without having to use OP_SIZE or OP_CAT.
You could build snarks in small script so the size of the small script
would be large but constant in the size of the blockchains.

On Fri, Nov 15, 2024, 5:02 PM Xiaohui Liu <x.liu@scrypt.io> wrote:

> Hi,
>
> How does covenant work without OP_CAT here, assuming no size limit? Don't
> you still need OP_CAT to parse/introspect fields (e.g., input/output) of
> the spending transaction?
>
> Regards,
> sCrypt
>
> On Tuesday, April 30, 2024 at 7:22:54=E2=80=AFAM UTC-7 Andrew Poelstra wr=
ote:
>
>> On Tue, Apr 30, 2024 at 08:32:42AM -0400, Matthew Zipkin wrote:
>> > > if an attacker managed to grind a 23-byte r-value at a cost of 2^72
>> > computations, it would provide the attacker some advantage.
>> >
>> > If we are assuming discrete log is still hard, why do we need Lamport
>> > signatures at all? In a post-quantum world, finding k such that r is 2=
1
>> > bytes or less is efficient for the attacker.
>> >
>>
>> Aside from Ethan's point that a variant of this technique is still
>> secure in the case that discrete log is totally broken (or even
>> partially broken...all we need is that _somebody_ is able to find the
>> discrete log of the x=3D1 point and for them to publish this).
>>
>> Another reason this is useful is that if you have a Lamport signature on
>> the stack which is composed of SIZE values, all of which are small
>> enough to be manipulated with the numeric script opcodes, then you can
>> do covenants in Script.
>>
>> (Sadly(?), I think none of this works in the context of the 201-opcode
>> limit...and absent BitVM challenge-response tricks it's unlikely you can
>> do much in the context of the 4MWu block size limit..), but IMO it's a
>> pretty big deal that size limits are now the only reason that Bitcoin
>> doesn't have covenants.)
>>
>> --
>> Andrew Poelstra
>> Director, Blockstream Research
>> Email: apoelstra at wpsoftware.net
>> Web: https://www.wpsoftware.net/andrew
>>
>> The sun is always shining in space
>> -Justin Lewis-Webster
>>
>> --
> You received this message because you are subscribed to the Google Groups
> "Bitcoin Development Mailing List" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to bitcoindev+unsubscribe@googlegroups.com.
> To view this discussion visit
> https://groups.google.com/d/msgid/bitcoindev/129a9605-7a91-42a7-a9ef-07de=
6662ca7en%40googlegroups.com
> <https://groups.google.com/d/msgid/bitcoindev/129a9605-7a91-42a7-a9ef-07d=
e6662ca7en%40googlegroups.com?utm_medium=3Demail&utm_source=3Dfooter>
> .
>

--=20
You received this message because you are subscribed to the Google Groups "=
Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to bitcoindev+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/=
CAEM%3Dy%2BWMqVLd_ujepgZiC%2B7hJAPxG3i0j%2BEOBFXTxfaaq38LSg%40mail.gmail.co=
m.

--000000000000b89640062708e13e
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto">I don&#39;t think it is clear how to turn this into a cov=
enant. The bits you are extracting using OP_SIZE are only related to the si=
ghash via a random function.<div dir=3D"auto"><br></div><div dir=3D"auto">T=
hat said, I don&#39;t see any reason that with an unlimited number of opcod=
es you can build an small script that&#39;s uses SPV to introspect into the=
 entire blockchains and enforce anything without having to use OP_SIZE or O=
P_CAT. You could build snarks in small script so the size of the small scri=
pt would be large but constant in the size of the blockchains.</div></div><=
br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Fri,=
 Nov 15, 2024, 5:02 PM Xiaohui Liu &lt;<a href=3D"mailto:x.liu@scrypt.io" t=
arget=3D"_blank" rel=3D"noreferrer">x.liu@scrypt.io</a>&gt; wrote:<br></div=
><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border=
-left:1px solid rgb(204,204,204);padding-left:1ex"><div>Hi,</div><div><br><=
/div>How does covenant work without OP_CAT here, assuming no size limit? Do=
n&#39;t you still need OP_CAT to parse/introspect fields (e.g., input/outpu=
t) of the spending transaction?<div><br></div><div>Regards,</div><div>sCryp=
t</div><div><br></div><div class=3D"gmail_quote"><div dir=3D"auto" class=3D=
"gmail_attr">On Tuesday, April 30, 2024 at 7:22:54=E2=80=AFAM UTC-7 Andrew =
Poelstra wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:=
0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">=
On Tue, Apr 30, 2024 at 08:32:42AM -0400, Matthew Zipkin wrote:
<br>&gt; &gt; if an attacker managed to grind a 23-byte r-value at a cost o=
f 2^72
<br>&gt; computations, it would provide the attacker some advantage.
<br>&gt;=20
<br>&gt; If we are assuming discrete log is still hard, why do we need Lamp=
ort
<br>&gt; signatures at all? In a post-quantum world, finding k such that r =
is 21
<br>&gt; bytes or less is efficient for the attacker.
<br>&gt;
<br>
<br>Aside from Ethan&#39;s point that a variant of this technique is still
<br>secure in the case that discrete log is totally broken (or even
<br>partially broken...all we need is that _somebody_ is able to find the
<br>discrete log of the x=3D1 point and for them to publish this).
<br>
<br>Another reason this is useful is that if you have a Lamport signature o=
n
<br>the stack which is composed of SIZE values, all of which are small
<br>enough to be manipulated with the numeric script opcodes, then you can
<br>do covenants in Script.
<br>
<br>(Sadly(?), I think none of this works in the context of the 201-opcode
<br>limit...and absent BitVM challenge-response tricks it&#39;s unlikely yo=
u can
<br>do much in the context of the 4MWu block size limit..), but IMO it&#39;=
s a
<br>pretty big deal that size limits are now the only reason that Bitcoin
<br>doesn&#39;t have covenants.)
<br>
<br>--=20
<br>Andrew Poelstra
<br>Director, Blockstream Research
<br>Email: apoelstra at <a href=3D"http://wpsoftware.net" rel=3D"nofollow n=
oreferrer noreferrer" target=3D"_blank">wpsoftware.net</a>
<br>Web:   <a href=3D"https://www.wpsoftware.net/andrew" rel=3D"nofollow no=
referrer noreferrer" target=3D"_blank">https://www.wpsoftware.net/andrew</a=
>
<br>
<br>The sun is always shining in space
<br>    -Justin Lewis-Webster
<br>
<br></blockquote></div>

<p></p>

-- <br>
You received this message because you are subscribed to the Google Groups &=
quot;Bitcoin Development Mailing List&quot; group.<br>
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:bitcoindev+unsubscribe@googlegroups.com" rel=3D"n=
oreferrer noreferrer" target=3D"_blank">bitcoindev+unsubscribe@googlegroups=
.com</a>.<br>
To view this discussion visit <a href=3D"https://groups.google.com/d/msgid/=
bitcoindev/129a9605-7a91-42a7-a9ef-07de6662ca7en%40googlegroups.com?utm_med=
ium=3Demail&amp;utm_source=3Dfooter" rel=3D"noreferrer noreferrer" target=
=3D"_blank">https://groups.google.com/d/msgid/bitcoindev/129a9605-7a91-42a7=
-a9ef-07de6662ca7en%40googlegroups.com</a>.<br>
</blockquote></div>

<p></p>

-- <br />
You received this message because you are subscribed to the Google Groups &=
quot;Bitcoin Development Mailing List&quot; group.<br />
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:bitcoindev+unsubscribe@googlegroups.com">bitcoind=
ev+unsubscribe@googlegroups.com</a>.<br />
To view this discussion visit <a href=3D"https://groups.google.com/d/msgid/=
bitcoindev/CAEM%3Dy%2BWMqVLd_ujepgZiC%2B7hJAPxG3i0j%2BEOBFXTxfaaq38LSg%40ma=
il.gmail.com?utm_medium=3Demail&utm_source=3Dfooter">https://groups.google.=
com/d/msgid/bitcoindev/CAEM%3Dy%2BWMqVLd_ujepgZiC%2B7hJAPxG3i0j%2BEOBFXTxfa=
aq38LSg%40mail.gmail.com</a>.<br />

--000000000000b89640062708e13e--