Return-Path: Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id 28F8152C9 for ; Mon, 6 May 2019 20:17:52 +0000 (UTC) X-Greylist: from auto-whitelisted by SQLgrey-1.7.6 Received: from zinan.dashjr.org (zinan.dashjr.org [192.3.11.21]) by smtp1.linuxfoundation.org (Postfix) with ESMTP id 7C949837 for ; Mon, 6 May 2019 20:17:51 +0000 (UTC) Received: from ishibashi.lan (adsl-98-70-227-48.gnv.bellsouth.net [98.70.227.48]) (Authenticated sender: luke-jr) by zinan.dashjr.org (Postfix) with ESMTPSA id 97D2738A0C7D; Mon, 6 May 2019 20:17:18 +0000 (UTC) X-Hashcash: 1:25:190506:pieter.wuille@gmail.com::h3DGkU2P/woJMy/e:IjFy X-Hashcash: 1:25:190506:bitcoin-dev@lists.linuxfoundation.org::i6pxjpHMvHp64l1R:c6Epp From: Luke Dashjr To: Pieter Wuille , Bitcoin Protocol Discussion Date: Mon, 6 May 2019 20:17:09 +0000 User-Agent: KMail/1.9.10 References: In-Reply-To: X-KMail-QuotePrefix: > MIME-Version: 1.0 Content-Type: Text/Plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Content-Disposition: inline Message-Id: <201905062017.11396.luke@dashjr.org> X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org X-Mailman-Approved-At: Tue, 07 May 2019 12:16:18 +0000 Subject: Re: [bitcoin-dev] Taproot proposal X-BeenThere: bitcoin-dev@lists.linuxfoundation.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Bitcoin Protocol Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 May 2019 20:17:52 -0000 There are multiple references to "space savings", but no rationale for treating "space" as something to save or even define. The costs are in CPU time and I/O (which "space saving" doesn't necessarily reduce) and bandwidth (which can often be reduced without "space saving" in commitments). The proposal can apparently be made simpler by ignoring this irrelevant "space saving" goal. Tagged hashes put the tagging at the start of the hash input. This means implementations can pre-cache SHA2 states, but it also means they can't reuse states to produce data for different contexts. (I'm not sure if there is a use for doing so... but maybe as part of further hiding MAST branches?) Is there any way to use the Taproot construct here while retaining external script limitations that the involved party(ies) *cannot* agree to override? For example, it is conceivable that one might wish to have an unconditional CLTV enforced in all circumstances. It may be useful to have a way to add a salt to tap branches. Some way to sign an additional script (not committed to by the witness program) seems like it could be a trivial addition. On Monday 06 May 2019 17:57:57 Pieter Wuille via bitcoin-dev wrote: > Hello everyone, > > Here are two BIP drafts that specify a proposal for a Taproot > softfork. A number of ideas are included: > > * Taproot to make all outputs and cooperative spends indistinguishable > from eachother. > * Merkle branches to hide the unexecuted branches in scripts. > * Schnorr signatures enable wallet software to use key > aggregation/thresholds within one input. > * Improvements to the signature hashing algorithm (including signing > all input amounts). > * Replacing OP_CHECKMULTISIG(VERIFY) with OP_CHECKSIGADD, to support > batch validation. > * Tagged hashing for domain separation (avoiding issues like > CVE-2012-2459 in Merkle trees). > * Extensibility through leaf versions, OP_SUCCESS opcodes, and > upgradable pubkey types. > > The BIP drafts can be found here: > * https://github.com/sipa/bips/blob/bip-schnorr/bip-taproot.mediawiki > specifies the transaction input spending rules. > * https://github.com/sipa/bips/blob/bip-schnorr/bip-tapscript.mediawiki > specifies the changes to Script inside such spends. > * https://github.com/sipa/bips/blob/bip-schnorr/bip-schnorr.mediawiki > is the Schnorr signature proposal that was discussed earlier on this > list (See > https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2018-July/016203.ht >ml) > > An initial reference implementation of the consensus changes, plus > preliminary construction/signing tests in the Python framework can be > found on https://github.com/sipa/bitcoin/commits/taproot. All > together, excluding the Schnorr signature module in libsecp256k1, the > consensus changes are around 520 LoC. > > While many other ideas exist, not everything is incorporated. This > includes several ideas that can be implemented separately without loss > of effectiveness. One such idea is a way to integrate SIGHASH_NOINPUT, > which we're working on as an independent proposal. > > The document explains basic wallet operations, such as constructing > outputs and signing. However, a wide variety of more complex > constructions exist. Standardizing these is useful, but out of scope > for now. It is likely also desirable to define extensions to PSBT > (BIP174) for interacting with Taproot. That too is not included here. > > Cheers,