Date: Sat, 5 Oct 2019 11:49:02 -0400
From: Peter Todd <pete@petertodd.org>
To: Jeremy <jlrubin@mit.edu>
Message-ID: <20191005154902.ck236q65xha25ore@petertodd.org>
References: <87wodp7w9f.fsf@gmail.com>
	<20191001155929.e2yznsetqesx2jxo@erisian.com.au>
	<CR-etCjXB-JWkvecjDog4Pkq1SuLUgndtSrZo-V4f4EGcNXzNCeAHRvCZGrxDWw7aHVdDY0pAF92jNLb_Hct0bMb3ew6JEpB9AfIm1tSGaQ=@protonmail.com>
	<CAEM=y+XbP3Dn7X8rHu7h0vbX6DkKA0vFK5nQqzcJ_V+D4EVMmw@mail.gmail.com>
	<C1OLL5FLxdOgfQ_A15mf88wIyztDapkyXJ2HZ0HxwmQADhRXGRe3le7Veso4tMIlbis6I0qiCd22xug5_GCKtgrjGnBtojWxOCMgn1UldkE=@protonmail.com>
	<CAEM=y+WCGSF_=WXpgXJUZCZcGUQhxzXF6Wv1_iX+VwEyYSWypg@mail.gmail.com>
	<CAD5xwhi7=5eiv1jjf72-rUezZMfj3caR+PGfZEa8i8rjNjodFg@mail.gmail.com>
	<20191004111536.w7snbgpoe27xutfu@petertodd.org>
	<CAD5xwhhLd9Ufv50kOi+yaJ5dTX9LhB1dPsK_0bqjz038tChcjw@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="as5ahu4hs27l4qst"
Content-Disposition: inline
In-Reply-To: <CAD5xwhhLd9Ufv50kOi+yaJ5dTX9LhB1dPsK_0bqjz038tChcjw@mail.gmail.com>
User-Agent: NeoMutt/20170113 (1.7.2)
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>,
	"lightning-dev@lists.linuxfoundation.org"
	<lightning-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] [Lightning-dev] OP_CAT was Re: Continuing the
 discussion about noinput / anyprevout
Precedence: list


--as5ahu4hs27l4qst
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Fri, Oct 04, 2019 at 11:40:53AM -0700, Jeremy wrote:
> Interesting point.
>=20
> The script is under your control, so you should be able to ensure that you
> are always using a correctly constructed midstate, e.g., something like:
>=20
> scriptPubKey: <-1> OP_SHA256STREAM DEPTH OP_SHA256STREAM <-2>
> OP_SHA256STREAM
> <hash> OP_EQUALVERIFY
>=20
> would hash all the elements on the stack and compare to a known hash.
> How is that sort of thing weak to midstateattacks?

Obviously with care you can get the computation right. But at that point wh=
at's
the actual advantage over OP_CAT?

We're limited by the size of the script anyway; if the OP_CAT output size l=
imit
is comparable to that for almost anything you could use SHA256STREAM on you
could just as easily use OP_CAT, followed by a single OP_SHA256.

--=20
https://petertodd.org 'peter'[:-1]@petertodd.org

--as5ahu4hs27l4qst
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEE0RcYcKRzsEwFZ3N5Lly11TVRLzcFAl2Yu2sACgkQLly11TVR
Lzei4Q/7BHvAwCHYt0r98nFB2n/H2b9iBkbngtLlN6VF4wrUwJev0Adjsc1khlEY
Y1/N4/lqOmvTowZClek2idz6YDPf+AoNR78SRl0JZcraZLfHCGd7MFO/0uVQxeyO
vw9MLDzRBalIhJKT3PLL23PUJyULiLvWxblWWw2jdSWroxVJHi+CHH+5OfranJY6
KlHjjQPrwT3JW2mWmP2AwV3ZLROWX6Col4nHEIdSJivBFgP2FF2EDrkkLwU8Hgjf
El6jCtYgFpdnu5dXplKLdmHeuCPGYUvWDO//dTtbTYaKcQkTyBeeH/QUHhELrspN
S7+5XBpx3PB504zlDH52ROozbF3w/ZZrJ7Oz8hT3hjSuAavx/UP00cXEq6GAjJyQ
3AmYrgz8xx+v6Z02cjivnXWLZsrkkp2J2QGzRdNFrRR/Hnhtvjp7pEcTmkKkrOCJ
wmvVO73bgcwD+jnWA73wRDqpvGmKt5bFsPBlpGNjsV8+kHMgKtHZ+oMeAyUKZ8DF
DgV79difFbY2MElP2X/5mOKmNx/LvsG1fHmKOE6QzGjs3YprEcJUp5+F3jykXHK4
/mu2XPFunNA3cSNZFuW4BzcIzMwM5KtEWP6MzVWRVO3G2B6xBrdjp1Lmx60TqMbY
gBtVi010JalC4K3Z43V2vPBXCid5Y2zUPSS/YwVOXDbDiqToSZQ=
=Fr7x
-----END PGP SIGNATURE-----

--as5ahu4hs27l4qst--