MIME-Version: 1.0
In-Reply-To: <9CCCE945-9432-41B9-8559-AFE7CF233603@xbt.hk>
References: <9CCCE945-9432-41B9-8559-AFE7CF233603@xbt.hk>
From: "Russell O'Connor" <roconnor@blockstream.io>
Date: Fri, 1 Jun 2018 11:03:46 -0400
Message-ID: <CAMZUoKms85DhtS1mN70nq4LSY7QtXym6E4_yvQk5Q0tizkVwEQ@mail.gmail.com>
To: Johnson Lau <jl2012@xbt.hk>, 
	Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: multipart/alternative; boundary="00000000000038c900056d95e58e"
Subject: Re: [bitcoin-dev] SIGHASH2 for version 1 witness programme
Precedence: list

--00000000000038c900056d95e58e
Content-Type: text/plain; charset="UTF-8"

On Thu, May 31, 2018 at 2:35 PM, Johnson Lau via bitcoin-dev <
bitcoin-dev@lists.linuxfoundation.org> wrote:

>
>   Double SHA256 of the serialization of:
>

Should we replace the Double SHA256 with a Single SHA256?  There is no
possible length extension attack here.  Or are we speculating that there is
a robustness of Double SHA256 in the presence of SHA256 breaking?

I suggest putting `sigversion` at the beginning instead of the end of the
format.  Because its value is constant, the beginning of the SHA-256
computation could be pre-computed in advance.  Furthermore, if we make the
`sigversion` exactly 64-bytes long then the entire first block of the
SHA-256 compression function could be pre-computed.

Can we add CHECKSIGFROMSTACK or do you think that would go into a separate
BIP?

--00000000000038c900056d95e58e
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><br><div class=3D"gmail_extra"><br><div class=3D"gmail_quo=
te">On Thu, May 31, 2018 at 2:35 PM, Johnson Lau via bitcoin-dev <span dir=
=3D"ltr">&lt;<a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.org" targe=
t=3D"_blank">bitcoin-dev@lists.<wbr>linuxfoundation.org</a>&gt;</span> wrot=
e:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-l=
eft:1px #ccc solid;padding-left:1ex"><br>
=C2=A0 Double SHA256 of the serialization of:<br></blockquote><div><br></di=
v><div>Should we replace the Double SHA256 with a Single SHA256?=C2=A0 Ther=
e is no possible length extension attack here.=C2=A0 Or are we speculating =
that there is a robustness of Double SHA256 in the presence of SHA256 break=
ing?<br><br></div><div>I suggest putting `sigversion` at the beginning inst=
ead of the end of the format.=C2=A0 Because its value is constant, the begi=
nning of the SHA-256 computation could be pre-computed in advance.=C2=A0 Fu=
rthermore, if we make the `sigversion` exactly 64-bytes long then the entir=
e first block of the SHA-256 compression function could be pre-computed.<br=
></div><div><br></div><div>Can we add CHECKSIGFROMSTACK or do you think tha=
t would go into a separate BIP?<br></div></div></div></div>

--00000000000038c900056d95e58e--