Return-Path: Received: from smtp3.osuosl.org (smtp3.osuosl.org [140.211.166.136]) by lists.linuxfoundation.org (Postfix) with ESMTP id 3D7E6C002A for ; Fri, 5 May 2023 21:18:30 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id 1211360AD8 for ; Fri, 5 May 2023 21:18:30 +0000 (UTC) DKIM-Filter: OpenDKIM Filter v2.11.0 smtp3.osuosl.org 1211360AD8 Authentication-Results: smtp3.osuosl.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20221208 header.b=ZXEHk6xD X-Virus-Scanned: amavisd-new at osuosl.org X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dFgsQDd9lXDi for ; Fri, 5 May 2023 21:18:29 +0000 (UTC) X-Greylist: whitelisted by SQLgrey-1.8.0 DKIM-Filter: OpenDKIM Filter v2.11.0 smtp3.osuosl.org E114160A9C Received: from mail-oa1-x35.google.com (mail-oa1-x35.google.com [IPv6:2001:4860:4864:20::35]) by smtp3.osuosl.org (Postfix) with ESMTPS id E114160A9C for ; Fri, 5 May 2023 21:18:28 +0000 (UTC) Received: by mail-oa1-x35.google.com with SMTP id 586e51a60fabf-18665c1776dso1920234fac.2 for ; Fri, 05 May 2023 14:18:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1683321508; x=1685913508; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=EQiemWKY3UxXheS04ZvjvqVsWAxuPU5hQhZBF19yQSw=; b=ZXEHk6xDdPflwqv49ie1TFIq/1aFz5J0BzLsToYGTbPo5D2EPFS/b1aiAfzUO/zEVs 6XzNtOmJKoI2PP95LQcyilxW2LJiIRMs9FliEZ9C/yrgvRFS74ZLWuumODVOc8hx3CAM Y98W14IL/74mVMuKX0qasbUHLCEunocnK3G2LUbXEPEbN2urCAwunJBBC3PS+WpyP8NX 4pxmZCvfTGM+g6QgLKzvKlRYDxKAVwBtHtVArHhwRyePMe4ICGz1Z0LViUrcaZ7Zvbs8 gfOj5oaCK9X6PgW7etl+zuXF0Z+OLEnAWzUPNntAQMq7tar7ZQtyZrqUX9m9aa3PbHy7 qXuQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1683321508; x=1685913508; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=EQiemWKY3UxXheS04ZvjvqVsWAxuPU5hQhZBF19yQSw=; b=UhgN1Jb+Ol5tZHieqvYJ/zZshYh5fxXVywIm806G8ljCr31YXMwd0Mq5YdxFrvR2Ni DcGDJJf2Vn4g9EL8DWxmY8re0g8QzrsojIfFCckg18CQPY8A3uAbQ/wEk3eJm5fmJOfL 9m7nMU87imr/Nt6ZJpFDTxsH6oiQe2DtZwB32dULxaZQBSlkKeH4T+jdAs7TwVAuIdDh RSEuv4wUBwiIyoHKmb/rTzrrl9JHCpx1nUMjO4fQsfA4eT0orpwUwBwkZmmZFhdRf+Sz nqVBNp4vvbWNrOsuLR9nG8mgS8TpLIVAQNzpcv4+qBaOaCbZ9i24aukF3dcFh4CwhH1n Ie9g== X-Gm-Message-State: AC+VfDzqw0SKer9rkP9cakstBhUOl8qQZ+fCeRcGB8zu81vK50yOrh1j MxrEjeHKcrWZsgsob2WQO88fYE9zT0tm6rG8W3E= X-Google-Smtp-Source: ACHHUZ6E2nwZVSThTVAeZ+xxvzGnXcH6gog8Z3U/UiEjUa6j7VUHJwUp0Fff4wm5zwlKhHGYnI4gIPIkepjZDuJnCeM= X-Received: by 2002:a05:6870:4294:b0:187:be3c:28b6 with SMTP id y20-20020a056870429400b00187be3c28b6mr1813281oah.41.1683321507788; Fri, 05 May 2023 14:18:27 -0700 (PDT) MIME-Version: 1.0 References: <0f352f70-c93a-614f-e443-67d198ec2c26@protonmail.com> <7f3674d1-c1ad-9a82-e30f-7cf24d697faf@protonmail.com> In-Reply-To: From: Salvatore Ingala Date: Fri, 5 May 2023 23:18:16 +0200 Message-ID: To: =?UTF-8?Q?Johan_Tor=C3=A5s_Halseth?= Content-Type: multipart/alternative; boundary="00000000000083c17705faf8d4be" X-Mailman-Approved-At: Sat, 06 May 2023 09:38:04 +0000 Cc: Bitcoin Protocol Discussion Subject: Re: [bitcoin-dev] Merkleize All The Things X-BeenThere: bitcoin-dev@lists.linuxfoundation.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Bitcoin Protocol Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 05 May 2023 21:18:30 -0000 --00000000000083c17705faf8d4be Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, 4 May 2023 at 10:34, Johan Tor=C3=A5s Halseth w= rote: > > It sounds like we can generalize the description of the construct to: > Access to (the hash of) embedded data of inputs and outputs, and the > enforcement of output keys and (static) taptrees. In other words, as > long as you can dynamically compute the output embedded data in > Script, you can enforce more or less anything (since you can make the > output script enforce presenting a witness "satisfying" the embedded > data). > > Does that sound about right? Yes. Fraud proofs allow us to extend beyond what Script can do (with the necessary tradeoffs), but there is plenty that can be done without them. > For instance, I believe you could simulate coin pools pretty easily: > Commit to the set of pubkeys and amounts owned by the participants in > the pool, and an output taptree where each participant has their own > spending path. Now, to exit the pool unilaterally, the participant > must present a proof that their pubkey+amount is committed to in the > input and an output where it is no longer committed. I don't think one would want to have a tapleaf for each participant: that would make you pay log n hashes just to reveal the tapleaf, and then you still need to pay log n hashes to access the embedded data. Instead, the "unilateral withdrawal Script" can be the same for all the participants. The witness would be the Merkle proof, plus perhaps some additional information to identify the leaf in the tree (depending on how the Merkle tree is implemented). In a complete Merkle tree for N =3D 2^n participants, the witness could contain the n hashes that allow to prove the value of the leaf, plus n bits to identify the path to the leaf (0/1 for 'left/right" child), since Script doesn't have enough opcodes to extract the bits from the leaf index. The data in the leaf can contain a commitment to all the information relevant for that participant (e.g.: their balance and pubkey, in a CoinPool construction). Then, the same witness can easily be reused to compute the new Merkle root after the data in the leaf is modified (for example, setting the amount to 0 for one participant). > A question that arises is how one would efficiently (in Script) prove > the inclusion/exclusion of the data in the commitment. One could > naively hash all the data twice during script execution (once for the > input, once for the output), but that is costly. It would be natural > to show merkle tree inclusion/exclusion in script, but perhaps there > are more efficient ways to prove it? A Merkle tree as described above commits to an entire vector that you can index positionally. That's quite versatile, and easier to handle than more complex constructions like accumulators with exclusion proofs. A Merkle proof for 2^7 =3D 128 participants requires about 8 hashes, so around 250 bytes in total of witness size; 2^10 =3D 1024 should bring that to the ballpark of 350 bytes. Best, Salvatore Ingala --00000000000083c17705faf8d4be Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Thu, 4 May 2023 at 10:34, Johan Tor=C3=A5s Halseth <= johanth@gmail.com> wrote:
&g= t;
> It sounds like we can generalize the description of the construc= t to:
> Access to (the hash of) embedded data of inputs and outputs, = and the
> enforcement of output keys and (static) taptrees. In other = words, as
> long as you can dynamically compute the output embedded d= ata in
> Script, you can enforce more or less anything (since you can= make the
> output script enforce presenting a witness "satisfyi= ng" the embedded
> data).
>
> Does that sound about = right?

Yes. Fraud proofs allow us to extend beyond what Script can d= o (with the
necessary tradeoffs), but there is plenty that can be done w= ithout them.


> For instance, I believe you could simulate coi= n pools pretty easily:
> Commit to the set of pubkeys and amounts own= ed by the participants in
> the pool, and an output taptree where eac= h participant has their own
> spending path. Now, to exit the pool un= ilaterally, the participant
> must present a proof that their pubkey+= amount is committed to in the
> input and an output where it is no lo= nger committed.

I don't think one would want to have a tapleaf f= or each participant:
that would make you pay log n hashes just to reveal= the tapleaf, and
then you still need to pay log n hashes to access the = embedded data.

Instead, the "unilateral withdrawal Script"= can be the same for all the
participants. The witness would be the Merk= le proof, plus perhaps some
additional information to identify the leaf = in the tree (depending on
how the Merkle tree is implemented). In a comp= lete Merkle tree for
N =3D 2^n participants, the witness could contain t= he n hashes that allow
to prove the value of the leaf, plus n bits to id= entify the path to the
leaf (0/1 for 'left/right" child), since= Script doesn't have enough
opcodes to extract the bits from the lea= f index.

The data in the leaf can contain a commitment to all the in= formation
relevant for that participant (e.g.: their balance and pubkey,= in a
CoinPool construction).

Then, the same witness can easily b= e reused to compute the new Merkle
root after the data in the leaf is mo= dified (for example, setting the
amount to 0 for one participant).
=C2=A0
> A question that arises is how one would efficiently (in Sc= ript) prove
> the inclusion/exclusion of the data in the commitment. = One could
> naively hash all the data twice during script execution (= once for the
> input, once for the output), but that is costly. It wo= uld be natural
> to show merkle tree inclusion/exclusion in script, b= ut perhaps there
> are more efficient ways to prove it?

A Merk= le tree as described above commits to an entire vector that you
can inde= x positionally. That's quite versatile, and easier to handle
than mo= re complex constructions like accumulators with exclusion proofs.

A = Merkle proof for 2^7 =3D 128 participants requires about 8 hashes, so
ar= ound 250 bytes in total of witness size; 2^10 =3D 1024 should bring thatto the ballpark of 350 bytes.

Best,
Salvatore Ingala
--00000000000083c17705faf8d4be--