Received-SPF: pass (sog-mx-4.v43.ch3.sourceforge.com: domain of taplink.co
	designates 50.117.27.232 as permitted sender)
	client-ip=50.117.27.232; envelope-from=jeremy@taplink.co;
	helo=mail.taplink.co; 
Content-Type: multipart/alternative; boundary=----------F30ly8iv54fevWQyOqsWmx
To: "Alan Reiner" <etotheipi@gmail.com>, "Allen Piscitello"
	<allen.piscitello@gmail.com>
References: <CAPg+sBgPG+2AMbEHSRQNFn6FikbRzxkWduj5MSZLz-O6Wh940w@mail.gmail.com>
	<20140210030048.GB31925@savin>
	<CAH2=CKzNGN7mpe1NLtsLRNSszSD2ZNwjoAsaH40EvGtA5ezDeQ@mail.gmail.com>
	<CALf2ePyDTZ_43uBfS9-5znhTyBR-5H10SpZ=N-z1DBacM_rDgA@mail.gmail.com>
	<CAJfRnm5pVA+gd3t=bXO188S4uwtUvx5F8V_bO_YV+74Ev4Q9jg@mail.gmail.com>
Date: Wed, 19 Feb 2014 11:15:39 -0800
MIME-Version: 1.0
From: "Jeremy Spilman" <jeremy@taplink.co>
Organization: TapLink
Message-ID: <op.xbjmgdcfyldrnw@laptop-air>
In-Reply-To: <CAJfRnm5pVA+gd3t=bXO188S4uwtUvx5F8V_bO_YV+74Ev4Q9jg@mail.gmail.com>
User-Agent: Opera Mail/1.0 (Win32)
Cc: Bitcoin Dev <bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] [RFC] [BIP proposal] Dealing with
 malleability
Precedence: list

------------F30ly8iv54fevWQyOqsWmx
Content-Type: text/plain; charset=iso-8859-15; format=flowed; delsp=yes
Content-Transfer-Encoding: 7bit


> Longer term it would be more ideal have a canonical identifier for the  
> transaction before it even gets to the chain to support these use cases,  
> even if >wallets are able to properly identify the status of it's  
> transactions.  
> -Allen
>
>

One possible work-around to get back trusted transaction chaining for  
payment channels and locked refunds from multi-sig would be to make the  
initial transaction include zero fee, and depend on child-pays-for-parent  
in order to get the first and follow-on transactions into a block. This of  
course only works for protocols where the parties don't need the initial  
funding transaction to actually hit the blockchain right away.

But this relies on two assumptions; 1) that miners won't include a  
zero-fee transaction in the blockchain, and 2) that miners actually  
implement child-pays-for-parent. It's definitely not the same security  
as-if you had immutable txid, but it's something to consider.

1) Mutants may cause wallet spam and difficulty calculating balance (and  
wallets will evolve to deal with it)
2) Mutants cause DoS because they can interfere with your own transaction  
chains, which for example makes batch off-line processing much more  
difficult
3) Mutants introduce a 3rd party attacker into any two-party protocol that  
relies on chains

There's a lot to digest in the 'v3' transaction/block proposal. It sounds  
like there may be some uncertainty over whether we can *prove* that v3  
transactions in v3 blocks would actually be guaranteed immutable with  
these changes?

If we cannot fully prove a Tx is immutable, then is it actually worth  
taking steps to make it seem immutable, or is that just a false sense of  
security in the cases where chained transactions were actually expected to  
be reliable? Under that thinking, maybe it's best to accept mutants as a  
fact of life, and only consider protocols and techniques that cannot be  
broken by mutants.

In what cases does reducing the sources of malleability, but not  
necessarily eliminating from a security proof perspective, actually help?  
Basically, if we don't know that we will succeed, isn't there really no  
point in trying?
------------F30ly8iv54fevWQyOqsWmx
Content-Type: multipart/related; boundary=----------F30ly8iv54fevWYBgCGUP7

------------F30ly8iv54fevWYBgCGUP7
Content-Type: text/html; charset=iso-8859-15
Content-ID: <op.1392837339210.57e1ce665d6b4ecc@192.168.168.135>
Content-Transfer-Encoding: Quoted-Printable

<!DOCTYPE html><html><head>
<style type=3D"text/css">body { font-family:'Times New Roman'; font-size=
:13px}</style>
</head>
<body><div>
<div><br></div><blockquote style=3D"margin: 0 0 0.80ex; border-left: #00=
00FF 2px solid; padding-left: 1ex"><div dir=3D"ltr"><div>Longer term it =
would be more ideal have a canonical identifier for the transaction befo=
re it even gets to the chain to support these use cases, even if wallets=
 are able to properly identify the status of it's transactions. &nbsp;</=
div>
<div><br></div><div>-Allen</div></div><div class=3D"gmail_extra"><br><br=
></div></blockquote></div><div>
<div>One possible work-around to get back trusted transaction chaining f=
or payment channels and locked refunds from multi-sig would be to make t=
he initial transaction include zero fee, and depend on child-pays-for-pa=
rent in order to get the first and follow-on transactions into a block. =
This of course only works for protocols where the parties don't need the=
 initial funding transaction to actually hit the blockchain right away.<=
/div><div><br></div><div>But this relies on two assumptions; 1) that min=
ers won't include a zero-fee transaction in the blockchain, and 2) that =
miners actually implement child-pays-for-parent. It's definitely not the=
 same security as-if you had immutable txid, but it's something to consi=
der.</div></div><div><br></div><div>
<div>1) Mutants may cause wallet spam and difficulty calculating balance=
 (and wallets will evolve to deal with it)</div><div>2) Mutants cause Do=
S because they can interfere with your own transaction chains, which for=
 example makes batch off-line processing much more difficult</div><div>3=
) Mutants introduce a 3rd party attacker into any two-party protocol tha=
t relies on chains</div></div><div><br></div><div>There's a lot to diges=
t in the 'v3' transaction/block proposal. It sounds like there may be so=
me uncertainty over whether we can *prove* that v3 transactions in v3 bl=
ocks would actually be guaranteed immutable with these changes?</div><di=
v><br></div><div>If we cannot fully prove a Tx is immutable, then is it =
actually worth taking steps to make it seem immutable, or is that just a=
 false sense of security in the cases where chained transactions were ac=
tually expected to be reliable? Under that thinking, maybe it's best to =
accept mutants as a fact of life, and only consider protocols and techni=
ques that cannot be broken by mutants.</div><div><br></div><div>In what =
cases does reducing the sources of malleability, but not necessarily eli=
minating from a security proof perspective, actually help? Basically, if=
 we don't know that we will succeed, isn't there really no point in tryi=
ng?</div></body></html>
------------F30ly8iv54fevWYBgCGUP7--

------------F30ly8iv54fevWQyOqsWmx--