Date: Sat, 9 Jun 2018 09:02:55 -0400
From: Peter Todd <pete@petertodd.org>
To: Sergio Demian Lerner <sergio.d.lerner@gmail.com>
Message-ID: <20180609130255.ngtnxumxlfqrutpn@petertodd.org>
References: <20180607171311.6qdjohfuuy3ufriv@petertodd.org>
	<CAHUJnBB7UL3mH6SixP_M4yooMVP3DgZa+5hiQOmF=AiqfdpfOg@mail.gmail.com>
	<20180607222028.zbva4vrv64dzrmxy@petertodd.org>
	<CAHUJnBCj8wnjP1=jobfpg7jkfjkX9iSBLeeAOyQCpobh6-AhUA@mail.gmail.com>
	<CAKzdR-paqYgOxToikaVD=0GMsCjHBaynX3WgB-CN6Sn7B7kRXw@mail.gmail.com>
	<CAKzdR-rz2-D5pbcoSw0CK9tR-UY46ybYaZDmUMYTjBgvkL6ugg@mail.gmail.com>
	<20180609124516.6ms6t7r5t7ikved6@petertodd.org>
	<CAKzdR-omk7wCk5c_9T28O2Hc-Uzui5S4B_BuDLFt27RWSFzdJw@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="7nyfmscui5cbuox5"
Content-Disposition: inline
In-Reply-To: <CAKzdR-omk7wCk5c_9T28O2Hc-Uzui5S4B_BuDLFt27RWSFzdJw@mail.gmail.com>
User-Agent: NeoMutt/20170113 (1.7.2)
Cc: bitcoin-dev <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Trusted merkle tree depth for safe tx inclusion
 proofs without a soft fork
Precedence: list


--7nyfmscui5cbuox5
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sat, Jun 09, 2018 at 02:51:55PM +0200, Sergio Demian Lerner wrote:
> Yo can fool a SPV wallet even if it requires a thousands confirmations
> using this attack, and you don't need a Sybil attack, so yes, it impacts
> SPV wallets also. The protections a SPV node should have to prevent this
> attack are  different, so it must be considered separately.

There's hardly any cases where "thousands of confirmations" change anything.

Anyway, SPV is a discredited concept and we shouldn't be concerning ourselv=
es
with it.

> It should be said that a SPV node can avoid accepting payments if any
> Merkle node is at the same time a valid transaction, and that basically
> almost eliminates the problem.

Indeed it does: between the number of txouts, scriptSig length, scriptPubKey
length, and the upper bits of nValue we have ~32 known bits that we can use=
 to
distinguish between inner nodes and transactions. That's a false positive r=
ate
of under one in a billion, so no issues there.

--=20
https://petertodd.org 'peter'[:-1]@petertodd.org

--7nyfmscui5cbuox5
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEFcyURjhyM68BBPYTJIFAPaXwkfsFAlsbz/sACgkQJIFAPaXw
kft/LAf/a/Ft7Ol4f9Nn+gqBJHBDMNLoggy2QvZLWMUUOL5rzZnn3hIaupymU38U
EZ3PBNrce631lsfzp471Qj/vFsHswcapD6gm690NYrnktYkiGg2jYxyWLJrckxF7
KuoN6jDh1cfg2y9sCZq0n3I1g462zmEbPvtKWHQpNMzbJP3dO7SQG7swUXBPFZkY
YemCSQd/G5wWXjxvsFkD39SXNpcNdy83qR47jr41qksobK6q4y0kJvXn+Qd6lj6y
L7v93e6W0FAtrSW9GHykCAY383mv5DceQPKEHlzS0YgUVxDt1vW0nHCmuF/67lbe
WsIHfxE76cnsxw2PHu+z6TlRrSAoow==
=4LRB
-----END PGP SIGNATURE-----

--7nyfmscui5cbuox5--