Received-SPF: pass (sog-mx-3.v43.ch3.sourceforge.com: domain of gmail.com
	designates 209.85.161.47 as permitted sender)
	client-ip=209.85.161.47; envelope-from=gavinandresen@gmail.com;
	helo=mail-fx0-f47.google.com; 
MIME-Version: 1.0
In-Reply-To: <201109261655.59768.luke@dashjr.org>
References: <201109261517.11245.luke@dashjr.org>
	<CABsx9T1gfuiHj9aR=1gDxtEqJzov5iXRqVEiEBUx-VBcearAZQ@mail.gmail.com>
	<201109261655.59768.luke@dashjr.org>
Date: Mon, 26 Sep 2011 17:38:41 -0400
Message-ID: <CABsx9T0TN+Nzzjod7xNJk4PNHnWPMWZUVsTHP3Yxq0C_-EgBLQ@mail.gmail.com>
From: Gavin Andresen <gavinandresen@gmail.com>
To: Luke-Jr <luke@dashjr.org>
Content-Type: text/plain; charset=ISO-8859-1
Cc: bitcoin-development@lists.sourceforge.net
Subject: Re: [Bitcoin-development] Newly introduced DoS
Precedence: list

> The first one I was referring to is a *transaction* with "non-standard" sig op
> count, which is AFAIK allowed in blocks, just not accepted by the mainline
> rules.

I sit corrected. The context is:
    // Checking ECDSA signatures is a CPU bottleneck, so to avoid
denial-of-service
    // attacks disallow transactions with more than one SigOp per 34
bytes.
    // 34 bytes because a TxOut is:
    //   20-byte address + 8 byte bitcoin amount + 5 bytes of ops + 1
byte script length
    if (GetSigOpCount() > nSize / 34 || nSize < 100)
	return DoS(10, error("AcceptToMemoryPool() : transaction with
out-of-bounds SigOpCount"));

I'm having trouble imagining some future world where valid,
new-versions-agree-to-relay-transactions have more than one SigOp per
34 bytes; can you give an example?

> Maybe the person spending it sees it matured beyond 100 confirmations, and you
> only see 99. An attacker could use these things to get nodes to ban each
> other.

That would imply you're on a blockchain fork of more than 99 blocks
with respect to the person spending the transaction, in which case I'd
argue you have much bigger problems and it is a good idea for the DoS
code to kick in and kick either you or them off the network...

-- 
--
Gavin Andresen