1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
|
Return-Path: <salvatore.ingala@gmail.com>
Received: from smtp3.osuosl.org (smtp3.osuosl.org [140.211.166.136])
by lists.linuxfoundation.org (Postfix) with ESMTP id 3D7E6C002A
for <bitcoin-dev@lists.linuxfoundation.org>;
Fri, 5 May 2023 21:18:30 +0000 (UTC)
Received: from localhost (localhost [127.0.0.1])
by smtp3.osuosl.org (Postfix) with ESMTP id 1211360AD8
for <bitcoin-dev@lists.linuxfoundation.org>;
Fri, 5 May 2023 21:18:30 +0000 (UTC)
DKIM-Filter: OpenDKIM Filter v2.11.0 smtp3.osuosl.org 1211360AD8
Authentication-Results: smtp3.osuosl.org;
dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com
header.a=rsa-sha256 header.s=20221208 header.b=ZXEHk6xD
X-Virus-Scanned: amavisd-new at osuosl.org
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5
tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1,
DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001,
HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001,
SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from smtp3.osuosl.org ([127.0.0.1])
by localhost (smtp3.osuosl.org [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id dFgsQDd9lXDi
for <bitcoin-dev@lists.linuxfoundation.org>;
Fri, 5 May 2023 21:18:29 +0000 (UTC)
X-Greylist: whitelisted by SQLgrey-1.8.0
DKIM-Filter: OpenDKIM Filter v2.11.0 smtp3.osuosl.org E114160A9C
Received: from mail-oa1-x35.google.com (mail-oa1-x35.google.com
[IPv6:2001:4860:4864:20::35])
by smtp3.osuosl.org (Postfix) with ESMTPS id E114160A9C
for <bitcoin-dev@lists.linuxfoundation.org>;
Fri, 5 May 2023 21:18:28 +0000 (UTC)
Received: by mail-oa1-x35.google.com with SMTP id
586e51a60fabf-18665c1776dso1920234fac.2
for <bitcoin-dev@lists.linuxfoundation.org>;
Fri, 05 May 2023 14:18:28 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=gmail.com; s=20221208; t=1683321508; x=1685913508;
h=cc:to:subject:message-id:date:from:in-reply-to:references
:mime-version:from:to:cc:subject:date:message-id:reply-to;
bh=EQiemWKY3UxXheS04ZvjvqVsWAxuPU5hQhZBF19yQSw=;
b=ZXEHk6xDdPflwqv49ie1TFIq/1aFz5J0BzLsToYGTbPo5D2EPFS/b1aiAfzUO/zEVs
6XzNtOmJKoI2PP95LQcyilxW2LJiIRMs9FliEZ9C/yrgvRFS74ZLWuumODVOc8hx3CAM
Y98W14IL/74mVMuKX0qasbUHLCEunocnK3G2LUbXEPEbN2urCAwunJBBC3PS+WpyP8NX
4pxmZCvfTGM+g6QgLKzvKlRYDxKAVwBtHtVArHhwRyePMe4ICGz1Z0LViUrcaZ7Zvbs8
gfOj5oaCK9X6PgW7etl+zuXF0Z+OLEnAWzUPNntAQMq7tar7ZQtyZrqUX9m9aa3PbHy7
qXuQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20221208; t=1683321508; x=1685913508;
h=cc:to:subject:message-id:date:from:in-reply-to:references
:mime-version:x-gm-message-state:from:to:cc:subject:date:message-id
:reply-to;
bh=EQiemWKY3UxXheS04ZvjvqVsWAxuPU5hQhZBF19yQSw=;
b=UhgN1Jb+Ol5tZHieqvYJ/zZshYh5fxXVywIm806G8ljCr31YXMwd0Mq5YdxFrvR2Ni
DcGDJJf2Vn4g9EL8DWxmY8re0g8QzrsojIfFCckg18CQPY8A3uAbQ/wEk3eJm5fmJOfL
9m7nMU87imr/Nt6ZJpFDTxsH6oiQe2DtZwB32dULxaZQBSlkKeH4T+jdAs7TwVAuIdDh
RSEuv4wUBwiIyoHKmb/rTzrrl9JHCpx1nUMjO4fQsfA4eT0orpwUwBwkZmmZFhdRf+Sz
nqVBNp4vvbWNrOsuLR9nG8mgS8TpLIVAQNzpcv4+qBaOaCbZ9i24aukF3dcFh4CwhH1n
Ie9g==
X-Gm-Message-State: AC+VfDzqw0SKer9rkP9cakstBhUOl8qQZ+fCeRcGB8zu81vK50yOrh1j
MxrEjeHKcrWZsgsob2WQO88fYE9zT0tm6rG8W3E=
X-Google-Smtp-Source: ACHHUZ6E2nwZVSThTVAeZ+xxvzGnXcH6gog8Z3U/UiEjUa6j7VUHJwUp0Fff4wm5zwlKhHGYnI4gIPIkepjZDuJnCeM=
X-Received: by 2002:a05:6870:4294:b0:187:be3c:28b6 with SMTP id
y20-20020a056870429400b00187be3c28b6mr1813281oah.41.1683321507788; Fri, 05
May 2023 14:18:27 -0700 (PDT)
MIME-Version: 1.0
References: <CAMhCMoH9uZPeAE_2tWH6rf0RndqV+ypjbNzazpFwFnLUpPsZ7g@mail.gmail.com>
<CALZpt+GVe0XTdWqV=LAcOj=nq+k2DEFqc+sKyxAujLDBR7bYbQ@mail.gmail.com>
<CAMhCMoEONv3jriBU3qwm0pt75iF_sgra1H2Z4rOF8u+e7hs_cw@mail.gmail.com>
<0f352f70-c93a-614f-e443-67d198ec2c26@protonmail.com>
<7f3674d1-c1ad-9a82-e30f-7cf24d697faf@protonmail.com>
<CAMhCMoGabEASO9CGc1hAMpYZn4nWH5D8XFs3eFcSSFAitSFUGA@mail.gmail.com>
<CAGpPWDZkUYW=Qb763TPzUa6yUf217nh0Bo+O9Qyf=WS2pUQUYA@mail.gmail.com>
<CAD3i26AXZKDCH3odhCjpMwzOTGQKSFqH9S+5N9UXNTb7CJHONA@mail.gmail.com>
<CAMhCMoFgto3Bu5+yEoqn1Jf8fNd+EQK-t_H3TKR2=3RXe8FdcQ@mail.gmail.com>
<CAMhCMoGdZsDO2eZYMf+G36gc5=-SB0HxHXbRSPx5OaCOjo5_Dw@mail.gmail.com>
<CAD3i26BoasDQGg1VOxaHJzoXXKnYKuBdXOq+wVZ=QhKbycobPA@mail.gmail.com>
In-Reply-To: <CAD3i26BoasDQGg1VOxaHJzoXXKnYKuBdXOq+wVZ=QhKbycobPA@mail.gmail.com>
From: Salvatore Ingala <salvatore.ingala@gmail.com>
Date: Fri, 5 May 2023 23:18:16 +0200
Message-ID: <CAMhCMoH-MSfTeG6vnWPdG9bAxWXRatWQY8wUmOqM5mAyH=5n9Q@mail.gmail.com>
To: =?UTF-8?Q?Johan_Tor=C3=A5s_Halseth?= <johanth@gmail.com>
Content-Type: multipart/alternative; boundary="00000000000083c17705faf8d4be"
X-Mailman-Approved-At: Sat, 06 May 2023 09:38:04 +0000
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Merkleize All The Things
X-BeenThere: bitcoin-dev@lists.linuxfoundation.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Bitcoin Protocol Discussion <bitcoin-dev.lists.linuxfoundation.org>
List-Unsubscribe: <https://lists.linuxfoundation.org/mailman/options/bitcoin-dev>,
<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=unsubscribe>
List-Archive: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/>
List-Post: <mailto:bitcoin-dev@lists.linuxfoundation.org>
List-Help: <mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=help>
List-Subscribe: <https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev>,
<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=subscribe>
X-List-Received-Date: Fri, 05 May 2023 21:18:30 -0000
--00000000000083c17705faf8d4be
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
On Thu, 4 May 2023 at 10:34, Johan Tor=C3=A5s Halseth <johanth@gmail.com> w=
rote:
>
> It sounds like we can generalize the description of the construct to:
> Access to (the hash of) embedded data of inputs and outputs, and the
> enforcement of output keys and (static) taptrees. In other words, as
> long as you can dynamically compute the output embedded data in
> Script, you can enforce more or less anything (since you can make the
> output script enforce presenting a witness "satisfying" the embedded
> data).
>
> Does that sound about right?
Yes. Fraud proofs allow us to extend beyond what Script can do (with the
necessary tradeoffs), but there is plenty that can be done without them.
> For instance, I believe you could simulate coin pools pretty easily:
> Commit to the set of pubkeys and amounts owned by the participants in
> the pool, and an output taptree where each participant has their own
> spending path. Now, to exit the pool unilaterally, the participant
> must present a proof that their pubkey+amount is committed to in the
> input and an output where it is no longer committed.
I don't think one would want to have a tapleaf for each participant:
that would make you pay log n hashes just to reveal the tapleaf, and
then you still need to pay log n hashes to access the embedded data.
Instead, the "unilateral withdrawal Script" can be the same for all the
participants. The witness would be the Merkle proof, plus perhaps some
additional information to identify the leaf in the tree (depending on
how the Merkle tree is implemented). In a complete Merkle tree for
N =3D 2^n participants, the witness could contain the n hashes that allow
to prove the value of the leaf, plus n bits to identify the path to the
leaf (0/1 for 'left/right" child), since Script doesn't have enough
opcodes to extract the bits from the leaf index.
The data in the leaf can contain a commitment to all the information
relevant for that participant (e.g.: their balance and pubkey, in a
CoinPool construction).
Then, the same witness can easily be reused to compute the new Merkle
root after the data in the leaf is modified (for example, setting the
amount to 0 for one participant).
> A question that arises is how one would efficiently (in Script) prove
> the inclusion/exclusion of the data in the commitment. One could
> naively hash all the data twice during script execution (once for the
> input, once for the output), but that is costly. It would be natural
> to show merkle tree inclusion/exclusion in script, but perhaps there
> are more efficient ways to prove it?
A Merkle tree as described above commits to an entire vector that you
can index positionally. That's quite versatile, and easier to handle
than more complex constructions like accumulators with exclusion proofs.
A Merkle proof for 2^7 =3D 128 participants requires about 8 hashes, so
around 250 bytes in total of witness size; 2^10 =3D 1024 should bring that
to the ballpark of 350 bytes.
Best,
Salvatore Ingala
--00000000000083c17705faf8d4be
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr">On Thu, 4 May 2023 at 10:34, Johan Tor=C3=A5s Halseth <=
<a href=3D"mailto:johanth@gmail.com">johanth@gmail.com</a>> wrote:<br>&g=
t;<br>> It sounds like we can generalize the description of the construc=
t to:<br>> Access to (the hash of) embedded data of inputs and outputs, =
and the<br>> enforcement of output keys and (static) taptrees. In other =
words, as<br>> long as you can dynamically compute the output embedded d=
ata in<br>> Script, you can enforce more or less anything (since you can=
make the<br>> output script enforce presenting a witness "satisfyi=
ng" the embedded<br>> data).<br>><br>> Does that sound about =
right?<br><br>Yes. Fraud proofs allow us to extend beyond what Script can d=
o (with the<br>necessary tradeoffs), but there is plenty that can be done w=
ithout them.<br><br><br>> For instance, I believe you could simulate coi=
n pools pretty easily:<br>> Commit to the set of pubkeys and amounts own=
ed by the participants in<br>> the pool, and an output taptree where eac=
h participant has their own<br>> spending path. Now, to exit the pool un=
ilaterally, the participant<br>> must present a proof that their pubkey+=
amount is committed to in the<br>> input and an output where it is no lo=
nger committed.<br><br>I don't think one would want to have a tapleaf f=
or each participant:<br>that would make you pay log n hashes just to reveal=
the tapleaf, and<br>then you still need to pay log n hashes to access the =
embedded data.<br><br>Instead, the "unilateral withdrawal Script"=
can be the same for all the<br>participants. The witness would be the Merk=
le proof, plus perhaps some<br>additional information to identify the leaf =
in the tree (depending on<br>how the Merkle tree is implemented). In a comp=
lete Merkle tree for<br>N =3D 2^n participants, the witness could contain t=
he n hashes that allow<br>to prove the value of the leaf, plus n bits to id=
entify the path to the<br>leaf (0/1 for 'left/right" child), since=
Script doesn't have enough<br>opcodes to extract the bits from the lea=
f index.<br><br>The data in the leaf can contain a commitment to all the in=
formation<br>relevant for that participant (e.g.: their balance and pubkey,=
in a<br>CoinPool construction).<br><br>Then, the same witness can easily b=
e reused to compute the new Merkle<br>root after the data in the leaf is mo=
dified (for example, setting the<br>amount to 0 for one participant).<br><b=
r>=C2=A0<br>> A question that arises is how one would efficiently (in Sc=
ript) prove<br>> the inclusion/exclusion of the data in the commitment. =
One could<br>> naively hash all the data twice during script execution (=
once for the<br>> input, once for the output), but that is costly. It wo=
uld be natural<br>> to show merkle tree inclusion/exclusion in script, b=
ut perhaps there<br>> are more efficient ways to prove it?<br><br>A Merk=
le tree as described above commits to an entire vector that you<br>can inde=
x positionally. That's quite versatile, and easier to handle<br>than mo=
re complex constructions like accumulators with exclusion proofs.<br><br>A =
Merkle proof for 2^7 =3D 128 participants requires about 8 hashes, so<br>ar=
ound 250 bytes in total of witness size; 2^10 =3D 1024 should bring that<br=
>to the ballpark of 350 bytes.<br><br>Best,<br>Salvatore Ingala</div>
--00000000000083c17705faf8d4be--
|
