1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
|
Return-Path: <pieter.wuille@gmail.com>
Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org
[172.17.192.35])
by mail.linuxfoundation.org (Postfix) with ESMTPS id E54E294B
for <bitcoin-dev@lists.linuxfoundation.org>;
Mon, 19 Nov 2018 22:38:10 +0000 (UTC)
X-Greylist: whitelisted by SQLgrey-1.7.6
Received: from mail-ot1-f53.google.com (mail-ot1-f53.google.com
[209.85.210.53])
by smtp1.linuxfoundation.org (Postfix) with ESMTPS id 87AD2782
for <bitcoin-dev@lists.linuxfoundation.org>;
Mon, 19 Nov 2018 22:38:10 +0000 (UTC)
Received: by mail-ot1-f53.google.com with SMTP id 40so29211436oth.4
for <bitcoin-dev@lists.linuxfoundation.org>;
Mon, 19 Nov 2018 14:38:10 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025;
h=mime-version:from:date:message-id:subject:to;
bh=NFgC4MyUcicYU75YCV/Kyqa6E74zM57GkmDNougOdD8=;
b=Z00ME5M7El1hnvfvNy/O/Blo0wZnKUmMK6o2UC40wlOAXelOJur5rsWA45vAcvCzzE
C+zCPWfv1YyZx+p6Lcvm9wVR1cWWVmL0TXNlWh0ubX7BX7oom98i+a5+p1DiJ78/vp3P
Dy0VwmmPhTncVnkKkzT6vdFHW421UfK7RRa904uifdYZqBq1BmFoj/+Q+aTUlPhFraNe
DAUT4IoAh6GNrgISicKcb/Bogu8z3Ll7jTT+t0acp5RqwmuOhIFA9gJl0n5MWqsAomHD
McW6TDXle+lBIEyfMB/Zbt3hN7K0RaFtzfOl9VvGNZg8Opu+GgMdTFH3AUzAQ0MbqFha
cgHQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:mime-version:from:date:message-id:subject:to;
bh=NFgC4MyUcicYU75YCV/Kyqa6E74zM57GkmDNougOdD8=;
b=g2DQ4F8OYP+7XfmQFDpRVWGG8Gn9DJywycyx69/1hsnQjNvjTWlexcp+KI0zAvPoHz
O52WG6sB2/6gvY0N2jDp01SKgKJAw3M2EsWaCCxLKBmuHuC5Az9dR71O2jJGe8hzcNFs
WzuzSpuQvpl+tL5Rz+9g5Dr5DO4p/LpTyjTNMaciawCNOUa56pkerAj8DcLP5dRmScbd
NIiKzZkrOGYvLT86JNvTMGD0/yUcSDNqZqOLBuRV42aL7e/utsXgLSTohoEMeuHAFyYi
LRlIaJ6l21S8sChh0q0ZYgmADyPSRPOLPfxxy0Vg9SggKLvqf1dijtE91z9PPlnRPWtp
hKEQ==
X-Gm-Message-State: AGRZ1gIN52ca5kjBfuCjAavbq+Kn9rAky9Mis/H1kv32cN9CQcVE6aYM
DL9ysXtbuQVRm5zDBHLEdKtqZfbL5qdJdzacDiXgHKKJ
X-Google-Smtp-Source: AJdET5cY2tI4bj8/SvIgPPEFz7sbSGKU83pMQnyCLRy9WSuRPbI5v9gVLpok+hMGj8ZJ8OHgxzBmfkTeywly5x8+hqM=
X-Received: by 2002:a9d:582e:: with SMTP id r46mr14628085oth.238.1542667089382;
Mon, 19 Nov 2018 14:38:09 -0800 (PST)
MIME-Version: 1.0
From: Pieter Wuille <pieter.wuille@gmail.com>
Date: Mon, 19 Nov 2018 14:37:57 -0800
Message-ID: <CAPg+sBhuPG-2GXc+Bp0yv5ywry2fk56LPLT4AY0Kcs+YEoz4FA@mail.gmail.com>
To: Bitcoin Dev <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: text/plain; charset="UTF-8"
X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED,
DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM,
RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
smtp1.linux-foundation.org
X-Mailman-Approved-At: Tue, 20 Nov 2018 03:21:03 +0000
Subject: [bitcoin-dev] Safer sighashes and more granular SIGHASH_NOINPUT
X-BeenThere: bitcoin-dev@lists.linuxfoundation.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Bitcoin Protocol Discussion <bitcoin-dev.lists.linuxfoundation.org>
List-Unsubscribe: <https://lists.linuxfoundation.org/mailman/options/bitcoin-dev>,
<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=unsubscribe>
List-Archive: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/>
List-Post: <mailto:bitcoin-dev@lists.linuxfoundation.org>
List-Help: <mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=help>
List-Subscribe: <https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev>,
<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=subscribe>
X-List-Received-Date: Mon, 19 Nov 2018 22:38:11 -0000
Hello everyone,
For future segwit versions, I think it would be good add a few things
to the sighash by default that were overlooked in BIP143:
* Committing to the absolute transaction fee (in addition to just the
amount being spent in each input) would categorically remove concerns
about wallets lying about fees to HW devices or airgapped signers.
* Committing to the scriptPubKey (in addition to the scriptCode) would
prevent lying to devices about the type of output being spent, even
when the scriptCode is correct. As a reminder, the scriptCode is the
actually executed script (which is the redeemscript in non-segwit
P2SH, and the witnesscript in P2WSH/P2WPKH).
As this implies additional information that may not be desirable to
commit to in all circumstances, it makes sense to make these optional.
This obviously interacts with SIGHASH_NOINPUT, which really adds two
different ways of rebinding signatures to inputs:
* Changing the prevout (so that the txid doesn't need to be known when
the signature is created)
* Changing the script (so that the exact scriptPubKey/redeemScript/...
doesn't need to be known when the signature is created)
Of course, the second implies the first, but do all use cases require
both being able to change the prevout and (arbitrarily) changing the
scriptPubKey? While BIP118 correctly points out this is secure if the
same keys are only used in scripts with which binding is to be
permitted, I feel it would be preferable if signatures/scripts would
explicitly state what can change. One way to accomplish this is by
indicating exactly what in a script is subject to change.
Here is a combined proposal:
* Three new sighash flags are added: SIGHASH_NOINPUT, SIGHASH_NOFEE,
and SIGHASH_SCRIPTMASK.
* A new opcode OP_MASK is added, which acts as a NOP during execution.
* The sighash is computed like in BIP143, but:
* If SIGHASH_SCRIPTMASK is present, for every OP_MASK in scriptCode
the subsequent opcode/push is removed.
* The scriptPubKey being spent is added to the sighash, unless
SIGHASH_SCRIPTMASK is set.
* The transaction fee is added to the sighash, unless SIGHASH_NOFEE is set.
* hashPrevouts, hashSequence, and outpoint are set to null when
SIGHASH_NOINPUT is set (like BIP118, but not for scriptCode).
So my question is whether anyone can see ways in which this introduces
redundant flexibility, or misses obvious use cases?
Cheers,
--
Pieter
|
