path: root/78/48edf1d0f746e94b97039e3e2db723744a99d6

Return-Path: <kimjuan.chan@gmail.com>
Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org
	[172.17.192.35])
	by mail.linuxfoundation.org (Postfix) with ESMTPS id BA3CA2F0C
	for <bitcoin-dev@lists.linuxfoundation.org>;
	Wed, 17 Oct 2018 06:58:24 +0000 (UTC)
X-Greylist: whitelisted by SQLgrey-1.7.6
Received: from mail-wm1-f48.google.com (mail-wm1-f48.google.com
	[209.85.128.48])
	by smtp1.linuxfoundation.org (Postfix) with ESMTPS id 344A87C
	for <bitcoin-dev@lists.linuxfoundation.org>;
	Wed, 17 Oct 2018 06:58:23 +0000 (UTC)
Received: by mail-wm1-f48.google.com with SMTP id e187-v6so926820wmf.0
	for <bitcoin-dev@lists.linuxfoundation.org>;
	Tue, 16 Oct 2018 23:58:23 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025;
	h=mime-version:references:in-reply-to:from:date:message-id:subject:to
	:cc; bh=HpcI2YtCt1jrEBxwFWNoe9sIfu5uo9VhT+dcCUdgypg=;
	b=jFjrRyLN4H4bT51rYeoKxkK4YtjF4rSQHBe+8Eb9vL8QK67CYLhECH1rW7OLEPPFIT
	34DtC/Dcn84xIwA+fWE1/CIk+KrIKjbqrKqjSwQP6LVk/LvPct8nUznwRFr5PRTHi8rM
	NQjN+KG1+NCMIKmam7Sk3UhjyS+W0WwU3kFUkJnZ3GbyAj9R4LnPWs8HcCOg29KyvS/2
	w8xkWT6H1wiZb62F05dkG8L+W5l/+umlS/yFrlEpYrPVAhVUoho4gQdfMoic0MBRC44T
	IO8RuNLFKgWoxnxjoMlhlbNE9TLIUYVLLgjfSqsHFgyZqCfkIEOhMijhmdwa5XCTFc3N
	Gq4Q==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
	d=1e100.net; s=20161025;
	h=x-gm-message-state:mime-version:references:in-reply-to:from:date
	:message-id:subject:to:cc;
	bh=HpcI2YtCt1jrEBxwFWNoe9sIfu5uo9VhT+dcCUdgypg=;
	b=PEBQYzfsiDiY4YAy5JtGNqRlMmf69eIo0YjEZ8mriBBFSyn/sJv8aGsTRY/TKUR0B/
	DUj6aVe9vETbCZcDV8kji/K6P/A5HEnCx482zZnNCOKpQrxDkJ07lHpERNiVLZsvRrat
	lT3POLtKtNgObGL52KQG4Mg4+m5viFi9huJunZal8YW3aK+OnRyr0VLkCYOPyc3XvXgm
	9FMyW5PiNyQOKJkXwVjvFVlpV/9FNjJQpzNrGEFuIrjZEOBpGCqtOEuZUDb4CeiiI2AD
	q7cshhh25fBZISbdIy7DlOVR84AjvRkiQkN++uWrZJmw/XklsxjrmxhiQnYGTfIFwj2s
	STkg==
X-Gm-Message-State: ABuFfogi7vZs/RX7ZXw74jSsoIyZwmuzr9sEEHLCbuw+D1YVYNziw3c0
	bEEJLxZJMlLteG5BrZdbNXjrjIXXD3YjsTs6K60=
X-Google-Smtp-Source: ACcGV612dJf4Fm3V3dulukQ8NmtgU6iXKEpO+u83/E0041QBNzcESGHDF60OlSP1UJhT0IKdYS18Yt/uVli2NakNpLg=
X-Received: by 2002:a1c:1804:: with SMTP id 4-v6mr1394007wmy.29.1539759501730; 
	Tue, 16 Oct 2018 23:58:21 -0700 (PDT)
MIME-Version: 1.0
References: <CAAKtTCt1_MTh38Bsft6_V65cLBcxHOrvsXR8yen_Ag1AgWtxcw@mail.gmail.com>
	<aKb8pkp87oI7Fo4rHKLgrSleyIUNHw1jvwhIo9RrvWxovrnWkJBXGfbnLu-OG3P-ntyHiExpmmut-3nmxkKL9g4qZfSo7or-IcAJRBxgwRk=@protonmail.com>
In-Reply-To: <aKb8pkp87oI7Fo4rHKLgrSleyIUNHw1jvwhIo9RrvWxovrnWkJBXGfbnLu-OG3P-ntyHiExpmmut-3nmxkKL9g4qZfSo7or-IcAJRBxgwRk=@protonmail.com>
From: kim juan <kimjuan.chan@gmail.com>
Date: Wed, 17 Oct 2018 14:58:10 +0800
Message-ID: <CAAKtTCt=G=pH7pchFKoyJwg+aVtmQr4aHfj9_wHOHdQvAaPWXQ@mail.gmail.com>
To: ZmnSCPxj@protonmail.com
Content-Type: multipart/alternative; boundary="00000000000023e91d0578673246"
X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED,
	DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, HTML_MESSAGE,
	RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
	smtp1.linux-foundation.org
X-Mailman-Approved-At: Wed, 17 Oct 2018 07:01:01 +0000
Cc: bitcoin-dev@lists.linuxfoundation.org
Subject: Re: [bitcoin-dev] Request: OP_CHECKTXOUTSCRIPTHASHVERIFY
X-BeenThere: bitcoin-dev@lists.linuxfoundation.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Bitcoin Protocol Discussion <bitcoin-dev.lists.linuxfoundation.org>
List-Unsubscribe: <https://lists.linuxfoundation.org/mailman/options/bitcoin-dev>,
	<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=unsubscribe>
List-Archive: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/>
List-Post: <mailto:bitcoin-dev@lists.linuxfoundation.org>
List-Help: <mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=help>
List-Subscribe: <https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev>,
	<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=subscribe>
X-List-Received-Date: Wed, 17 Oct 2018 06:58:24 -0000

--00000000000023e91d0578673246
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi ZmnSCPxj,

Thanks for the heads up and suggestions.

Found my way to the bitcoin-covenant article. That is indeed generalized
and flexible, hence more powerful than this dumbed-down plain comparison of
output bytes-to-bytes.

Interestingly, the vault described in bitcoin covenant, which can mitigate
risk of even losing the secured (or both) key, can also be achieved using
this naive CheckTxoutscriptVerify.

I wish bitcoin-covenant can be materialized, private key management is
something to lose sleep for.


On Wed, Oct 17, 2018 at 1:17 PM ZmnSCPxj <ZmnSCPxj@protonmail.com> wrote:

> Good morning kim,
>
> This seems to be a specific instance of "covenants".  I believe, that
> there are vague plans to possibly include OP_CHECKSIGFROMSTACK, which wou=
ld
> allow covenants much more generally, but with more complex (clever) SCRIP=
T.
>
> The specification of the behavior of the opcode is P2SH-focused and is
> unuseable for SegWit, but possibly it can instead be made a SegWit-only
> opcode instead (especially, since, by my knowledge, future plans for SCRI=
PT
> updates will generally involve only future SegWit versions).
>
> The specification could be improved as below:
>
> The OP_CHECKTXOUTSCRIPTHASHVERIFY will succeed if either of the below are
> true for all outputs of the transaction that is spending this SCRIPT:
>
> 1.  It is a P2WSH whose SegWit version and hash, when concatenated
> together, are equal to the stack top.
> 2.  It is a P2WSH or P2SH-P2WSH that is the same as the transaction outpu=
t
> being spent.
>
> Otherwise, if any output does not match either of the above, this
> operation will fail.
>
> Regards,
> ZmnSCPxj
>
>
> Sent with ProtonMail <https://protonmail.com> Secure Email.
>
> =E2=80=90=E2=80=90=E2=80=90=E2=80=90=E2=80=90=E2=80=90=E2=80=90 Original =
Message =E2=80=90=E2=80=90=E2=80=90=E2=80=90=E2=80=90=E2=80=90=E2=80=90
> On Wednesday, October 17, 2018 12:26 PM, kim juan via bitcoin-dev <
> bitcoin-dev@lists.linuxfoundation.org> wrote:
>
> Discussing the possibility of a new opcode (OP_CHECKTXOUTSCRIPTHASHVERIFY=
)
> for the Bitcoin scripting system that allows a transaction output to be
> only spendable in a predefined manner.
> *Brief Description*
>
> Bitcoin transactions have a txoutScript (scriptPubKey) field for each
> output.
> txoutScriptHash=3DHash160(txoutScript)
>
> *Word*: OP_CHECKTXOUTSCRIPTHASHVERIFY
> *Opcode*: 184 (OP_NOP9)
> *Input*: x
> *Output*: x / fail*
> *Description*:
> Marks transaction as invalid if txoutScriptHash is not equal to top stack
> item and value of txoutScript is not equal to OP_HASH160
> ThisRedeemScriptHash OP_EQUAL*.
>
>
> ** Not entirely certain here, always have this impression new opcode has
> to "NOP or fail" to ensure it can be implemented. As a result, the item m=
ay
> also has to be dropped explicitly.*** So that change can be sent back to
> the this redeem script. There are challenges to generalize this as a scri=
pt
> hash cause of some cyclic reference. Not sure if cyclic is the correct
> term, ie: A =3D hash (B's hash) and B =3D hash (A's hash) is impossible.*
>
> *Sample use case*
>
> Acme has an ordinary key pair and a secure key pair. The ordinary key
> pair is assumed to be in a less secure environment.  The private key of
> the secure key pair will never ever expose itself until the moment it nee=
ds
> to revoke transaction of the ordinary key pair.
>
> redeemScript:
>   IF
>     2 <Acme's pubkey> <securePubkey> 2 CHECKMULTISIG
>   ELSE
>     <txoutScriptHash> CHECKTXOUTSCRIPTHASHVERIFY DROP <Acme's pubkey>
> CHECKSIG
>   ENDIF
>
> The only ways to spend its outputs from this ThisRedeemScript is to
> forward it to NextRedeemScript. Even if the original key pair is compromi=
sed,
> the attacker can only spend it this way and has to publish the transactio=
n.
>
> tx1:
>   scriptSig: <sig> <pubKey> 0
>   scriptPubKey: HASH160 <Hash160(NextRedeemScript)> EQUAL
>
> tx2: //if there is change
>   scriptSig: <sig> <Acme's pubKey>
>   scriptPubKey: HASH160 ThisRedeemScriptHash EQUAL
>
> NextRedeemScript is time locked. Acme is able to monitor for unauthorized
> transactions and react within the sequence-defined duration. The
> combination of 2 key pair as one multisig can spend the output immediatel=
y
> regardless of the timelock.
>
> NextRedeemScript:
>   IF
>     2 <Acme's pubkey> <securePubkey> 2 CHECKMULTISIG
>   ELSE
>     "12h" CHECKSEQUENCEVERIFY DROP <Acme's pubkey> CHECKSIG
>   ENDIF
>
> After 12 hours, Acme is can spend the output as normal.
>
> tx:
>   scriptSig: <sig> <pubkey> 0
>   scriptPubKey: DUP HASH160 <recipient's pubkeyHash> EQUALVERIFY CHECKSIG
>
> *Description*
>
> CSV and CTLV already laid the groundwork for retroactive invalidation,
> showcased in innovative protocols such as HTLC of lightning network.
>
> As illustrated from the sample use case, there are other classes of
> problems that may requires retroactive invalidation in different and
> less-interactive way from channels. Most of those problems require a
> primitive opcode to influence how the output can be spent.
>
> If the use case works as expected, attacks will be *less* rewarding.
> There are still other attack vectors if Acme's original key pair is
> compromised, i.e;
>
> > The attacker can drain the output as transaction fees.
> There could be ways to reduce that risk, but do not intent to add
> complexity to a request. This additional depth of defense is an improveme=
nt
> to deter attacks especially if an attack is costly to pull.
>
> > After 12 hours, it may be still possible for attacker to submit
> transactions in concurrent or ahead of Acme.
> Acme should submit the transaction before the 12 hours and leave it in
> mempool, waiting for nSequence to elapse. Attacker's transaction
> submitted after it *should be(?)* rejected by the network. Attacker's
> transaction submitted before it will be caught by the monitoring function=
.
> Even if the above assumption is misguided, the use-case is still useful i=
f
> transactions have value smaller quantity than total, that limits loss to
> only the transaction's value. At the same time, that reveals the fact tha=
t
> the key pair is compromised and the further preventive actions can be
> carried out using the secure key pair.
>
> Possible privacy concern: The use case demonstrated change to be sent bac=
k
> to self (there may be related concern such as wrongly configured digital
> signature). The use case assumed P2SH is exceptional case, kind of like
> multisignature wallets, for custodians like e-commerce merchants, exchang=
es.
>
>
>

--00000000000023e91d0578673246
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi ZmnSCPxj,<br><br>Thanks for the heads up and suggestion=
s.<br><br>Found my way to the bitcoin-covenant article. That is indeed gene=
ralized and flexible, hence more powerful than this dumbed-down plain compa=
rison of output bytes-to-bytes.<br><br>Interestingly, the vault described i=
n bitcoin covenant, which can mitigate risk of even losing the secured (or =
both) key, can also be achieved using this naive CheckTxoutscriptVerify.<br=
><br>I wish bitcoin-covenant can be materialized, private key management is=
 something to lose sleep for.<div class=3D"gmail-yj6qo gmail-ajU" style=3D"=
outline:none;padding:10px 0px;width:22px;margin:2px 0px 0px"><br class=3D"g=
mail-Apple-interchange-newline"></div></div><br><div class=3D"gmail_quote">=
<div dir=3D"ltr">On Wed, Oct 17, 2018 at 1:17 PM ZmnSCPxj &lt;<a href=3D"ma=
ilto:ZmnSCPxj@protonmail.com">ZmnSCPxj@protonmail.com</a>&gt; wrote:<br></d=
iv><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left=
:1px #ccc solid;padding-left:1ex"><div>Good morning kim,<br></div><div><br>=
</div><div>This seems to be a specific instance of &quot;covenants&quot;.=
=C2=A0 I believe, that there are vague plans to possibly include OP_CHECKSI=
GFROMSTACK, which would allow covenants much more generally, but with more =
complex (clever) SCRIPT.<br></div><div><br></div><div>The specification of =
the behavior of the opcode is P2SH-focused and is unuseable for SegWit, but=
 possibly it can instead be made a SegWit-only opcode instead (especially, =
since, by my knowledge, future plans for SCRIPT updates will generally invo=
lve only future SegWit versions).<br></div><div><br></div><div>The specific=
ation could be improved as below:<br></div><div><br></div><div>The OP_CHECK=
TXOUTSCRIPTHASHVERIFY will succeed if either of the below are true for all =
outputs of the transaction that is spending this SCRIPT:<br></div><div><br>=
</div><div>1.=C2=A0 It is a P2WSH whose SegWit version and hash, when conca=
tenated together, are equal to the stack top.<br></div><div>2.=C2=A0 It is =
a P2WSH or P2SH-P2WSH that is the same as the transaction output being spen=
t.<br></div><div><br></div><div>Otherwise, if any output does not match eit=
her of the above, this operation will fail.<br></div><div><br></div><div>Re=
gards,<br></div><div>ZmnSCPxj<br></div><div><br></div><div class=3D"m_-7856=
430591641183749protonmail_signature_block"><div class=3D"m_-785643059164118=
3749protonmail_signature_block-user m_-7856430591641183749protonmail_signat=
ure_block-empty"><br></div><div class=3D"m_-7856430591641183749protonmail_s=
ignature_block-proton">Sent with <a href=3D"https://protonmail.com" target=
=3D"_blank">ProtonMail</a> Secure Email.<br></div></div><div><br></div><div=
>=E2=80=90=E2=80=90=E2=80=90=E2=80=90=E2=80=90=E2=80=90=E2=80=90 Original M=
essage =E2=80=90=E2=80=90=E2=80=90=E2=80=90=E2=80=90=E2=80=90=E2=80=90<br><=
/div><div> On Wednesday, October 17, 2018 12:26 PM, kim juan via bitcoin-de=
v &lt;<a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.org" target=3D"_b=
lank">bitcoin-dev@lists.linuxfoundation.org</a>&gt; wrote:<br></div><div> <=
br></div><blockquote type=3D"cite" class=3D"m_-7856430591641183749protonmai=
l_quote"><div dir=3D"ltr"><p style=3D"box-sizing:border-box;margin-top:0px;=
margin-bottom:16px"></p><div><span style=3D"color:#24292e" class=3D"m_-7856=
430591641183749colour">Discussing the possibility of a new opcode (</span><=
span style=3D"font-family:monospace,monospace" class=3D"m_-7856430591641183=
749font"><span style=3D"color:#24292e" class=3D"m_-7856430591641183749colou=
r">OP_CHECKTXOUTSCRIPTHASHVERIFY</span></span><span style=3D"color:#24292e"=
 class=3D"m_-7856430591641183749colour">) for the Bitcoin scripting system =
that allows a transaction output to be only spendable in a predefined manne=
r.<br></span></div><div><b><span style=3D"font-size:18px" class=3D"m_-78564=
30591641183749size">Brief Description</span></b><br></div><div><br></div><d=
iv><span style=3D"color:#24292e" class=3D"m_-7856430591641183749colour">Bit=
coin transactions have a=C2=A0</span><span style=3D"font-family:monospace,m=
onospace" class=3D"m_-7856430591641183749font"><span style=3D"color:#24292e=
" class=3D"m_-7856430591641183749colour">txoutScript</span></span><span sty=
le=3D"color:#24292e" class=3D"m_-7856430591641183749colour">=C2=A0(</span><=
span style=3D"font-family:monospace,monospace" class=3D"m_-7856430591641183=
749font"><span style=3D"color:#24292e" class=3D"m_-7856430591641183749colou=
r">scriptPubKey</span></span><span style=3D"color:#24292e" class=3D"m_-7856=
430591641183749colour"><span style=3D"font-family:arial,helvetica,sans-seri=
f" class=3D"m_-7856430591641183749font">) field for each output.<br></span>=
<span style=3D"font-family:monospace,monospace" class=3D"m_-785643059164118=
3749font">txoutScriptHash=3D</span></span><span style=3D"background-color:r=
gb(248,249,250)" class=3D"m_-7856430591641183749highlight"><span style=3D"f=
ont-family:monospace,monospace" class=3D"m_-7856430591641183749font">Hash16=
0(txoutScript)</span></span><span style=3D"font-family:arial,helvetica,sans=
-serif" class=3D"m_-7856430591641183749font"></span></div><p></p><p style=
=3D"box-sizing:border-box;margin-top:0px;margin-bottom:16px"><span style=3D=
"background-color:rgb(248,249,250)" class=3D"m_-7856430591641183749highligh=
t"><span style=3D"font-family:arial,helvetica,sans-serif" class=3D"m_-78564=
30591641183749font"><b>Word</b>:=C2=A0</span></span><span style=3D"backgrou=
nd-color:rgb(248,249,250)" class=3D"m_-7856430591641183749highlight"><span =
style=3D"font-family:monospace,monospace" class=3D"m_-7856430591641183749fo=
nt">OP_CHECKTXOUTSCRIPTHASHVERIFY</span><br><span style=3D"font-family:aria=
l,helvetica,sans-serif" class=3D"m_-7856430591641183749font"><b>Opcode</b>:=
=C2=A0</span><span style=3D"font-family:monospace,monospace" class=3D"m_-78=
56430591641183749font">184 (OP_NOP9)</span><br></span><span style=3D"backgr=
ound-color:rgb(248,249,250)" class=3D"m_-7856430591641183749highlight"><spa=
n style=3D"font-family:arial,helvetica,sans-serif" class=3D"m_-785643059164=
1183749font"><b>Input</b>:=C2=A0</span><span style=3D"font-family:monospace=
,monospace" class=3D"m_-7856430591641183749font">x</span></span><span style=
=3D"background-color:rgb(248,249,250)" class=3D"m_-7856430591641183749highl=
ight"><span style=3D"font-family:arial,helvetica,sans-serif" class=3D"m_-78=
56430591641183749font"><br><b>Output</b>:</span></span><span style=3D"backg=
round-color:rgb(248,249,250)" class=3D"m_-7856430591641183749highlight"><sp=
an style=3D"font-family:arial,helvetica,sans-serif" class=3D"m_-78564305916=
41183749font">=C2=A0</span></span><span style=3D"background-color:rgb(248,2=
49,250)" class=3D"m_-7856430591641183749highlight"><span style=3D"font-fami=
ly:monospace,monospace" class=3D"m_-7856430591641183749font">x / fail*</spa=
n><br></span><span style=3D"background-color:rgb(248,249,250)" class=3D"m_-=
7856430591641183749highlight"><span style=3D"font-family:arial,helvetica,sa=
ns-serif" class=3D"m_-7856430591641183749font"><b>Description</b>:<br>Marks=
 transaction as invalid if=C2=A0</span></span><span style=3D"background-col=
or:rgb(248,249,250)" class=3D"m_-7856430591641183749highlight"><span style=
=3D"font-family:monospace,monospace" class=3D"m_-7856430591641183749font">t=
xoutScriptHash</span></span><span style=3D"background-color:rgb(248,249,250=
)" class=3D"m_-7856430591641183749highlight"><span style=3D"font-family:ari=
al,helvetica,sans-serif" class=3D"m_-7856430591641183749font">=C2=A0is not =
equal to top stack item and value of=C2=A0</span></span><span style=3D"back=
ground-color:rgb(248,249,250)" class=3D"m_-7856430591641183749highlight"><s=
pan style=3D"font-family:monospace,monospace" class=3D"m_-78564305916411837=
49font">txoutScript</span></span><span style=3D"background-color:rgb(248,24=
9,250)" class=3D"m_-7856430591641183749highlight"><span style=3D"font-famil=
y:arial,helvetica,sans-serif" class=3D"m_-7856430591641183749font">=C2=A0is=
 not equal to=C2=A0</span></span><span style=3D"color:rgb(26,26,26)" class=
=3D"m_-7856430591641183749colour"><span style=3D"font-family:monospace,mono=
space" class=3D"m_-7856430591641183749font">OP_HASH160 ThisRedeemScriptHash=
 OP_EQUAL</span></span><span style=3D"color:rgb(26,26,26)" class=3D"m_-7856=
430591641183749colour"><span style=3D"font-family:arial,helvetica,sans-seri=
f" class=3D"m_-7856430591641183749font">*.</span></span></p><p style=3D"box=
-sizing:border-box;margin-top:0px;margin-bottom:16px"><span style=3D"font-f=
amily:arial,helvetica,sans-serif" class=3D"m_-7856430591641183749font"><spa=
n style=3D"font-size:10px" class=3D"m_-7856430591641183749size"><i><span st=
yle=3D"background-color:rgb(248,249,250)" class=3D"m_-7856430591641183749hi=
ghlight">* Not entirely certain here, always have this impression new opcod=
e has to &quot;</span><span style=3D"background-color:rgb(248,249,250)" cla=
ss=3D"m_-7856430591641183749highlight">NOP or fail&quot; to ensure it can b=
e implemented</span><span style=3D"background-color:rgb(248,249,250)" class=
=3D"m_-7856430591641183749highlight">. As a result,=C2=A0</span><span style=
=3D"background-color:rgb(248,249,250)" class=3D"m_-7856430591641183749highl=
ight">t</span><span style=3D"background-color:rgb(248,249,250)" class=3D"m_=
-7856430591641183749highlight">he item may also has to be dropped explicitl=
y</span><span style=3D"background-color:rgb(248,249,250)" class=3D"m_-78564=
30591641183749highlight">.<br></span></i><i>* So that change can be sent ba=
ck to the this redeem script. There are challenges to generalize this as a =
script hash cause of some cyclic reference. Not sure if cyclic is the corre=
ct term, ie: A =3D hash (B&#39;s hash) and B =3D hash (A&#39;s hash) is imp=
ossible.</i></span></span></p><p style=3D"box-sizing:border-box;margin-top:=
0px;margin-bottom:16px"><span style=3D"color:rgb(36,41,46)" class=3D"m_-785=
6430591641183749colour"><b><span style=3D"font-size:18px" class=3D"m_-78564=
30591641183749size">Sample use case</span></b></span><br></p><p style=3D"bo=
x-sizing:border-box;margin-top:0px;margin-bottom:16px"><span style=3D"color=
:rgb(36,41,46)" class=3D"m_-7856430591641183749colour">Acme has an ordinary=
 key pair and a secure key pair.=C2=A0</span><span style=3D"color:rgb(36,41=
,46)" class=3D"m_-7856430591641183749colour">The ordinary key pair is assum=
ed to be in a less secure environment.=C2=A0=C2=A0</span><span style=3D"col=
or:rgb(36,41,46)" class=3D"m_-7856430591641183749colour">The private key of=
 the secure key pair will never ever expose itself until the moment it need=
s to revoke transaction of the ordinary key pair.</span><br></p><p style=3D=
"box-sizing:border-box;margin-top:0px;margin-bottom:16px"><span style=3D"co=
lor:rgb(26,26,26)" class=3D"m_-7856430591641183749colour"><span style=3D"fo=
nt-family:monospace,monospace" class=3D"m_-7856430591641183749font">redeemS=
cript:<br>=C2=A0=C2=A0</span></span><span style=3D"color:rgb(36,41,46)" cla=
ss=3D"m_-7856430591641183749colour"><span style=3D"font-family:monospace,mo=
nospace" class=3D"m_-7856430591641183749font">IF<br></span></span><span sty=
le=3D"color:rgb(36,41,46)" class=3D"m_-7856430591641183749colour"><span sty=
le=3D"font-family:monospace,monospace" class=3D"m_-7856430591641183749font"=
>=C2=A0 =C2=A0 2=C2=A0</span></span><span style=3D"color:rgb(26,26,26)" cla=
ss=3D"m_-7856430591641183749colour"><span style=3D"font-family:monospace,mo=
nospace" class=3D"m_-7856430591641183749font">&lt;Acme&#39;s pubkey&gt;=C2=
=A0</span></span><span style=3D"color:rgb(26,26,26)" class=3D"m_-7856430591=
641183749colour"><span style=3D"font-family:monospace,monospace" class=3D"m=
_-7856430591641183749font">&lt;securePubkey&gt; 2</span></span><span style=
=3D"color:rgb(26,26,26)" class=3D"m_-7856430591641183749colour"><span style=
=3D"font-family:monospace,monospace" class=3D"m_-7856430591641183749font">=
=C2=A0</span></span><span style=3D"color:rgb(26,26,26)" class=3D"m_-7856430=
591641183749colour"><span style=3D"font-family:monospace,monospace" class=
=3D"m_-7856430591641183749font">CHECKMULTISIG<br></span></span><span style=
=3D"color:rgb(26,26,26)" class=3D"m_-7856430591641183749colour"><span style=
=3D"font-family:monospace,monospace" class=3D"m_-7856430591641183749font">=
=C2=A0 ELSE<br>=C2=A0 =C2=A0 &lt;txoutScriptHash&gt;=C2=A0</span></span><sp=
an style=3D"background-color:rgb(248,249,250)" class=3D"m_-7856430591641183=
749highlight"><span style=3D"font-family:monospace,monospace" class=3D"m_-7=
856430591641183749font">CHECKTXOUTSCRIPTHASHVERIFY=C2=A0</span></span><span=
 style=3D"color:#000000" class=3D"m_-7856430591641183749colour"><span style=
=3D"background-color:rgb(248,249,250)" class=3D"m_-7856430591641183749highl=
ight">DROP </span></span><span style=3D"color:rgb(26,26,26)" class=3D"m_-78=
56430591641183749colour"><span style=3D"font-family:monospace,monospace" cl=
ass=3D"m_-7856430591641183749font">&lt;Acme&#39;s pubkey&gt;=C2=A0</span></=
span><span style=3D"color:rgb(26,26,26)" class=3D"m_-7856430591641183749col=
our"><span style=3D"font-family:monospace,monospace" class=3D"m_-7856430591=
641183749font">CHECKSIG<br>=C2=A0 ENDIF</span></span></p><p style=3D"box-si=
zing:border-box;margin-top:0px;margin-bottom:16px"><span style=3D"color:rgb=
(36,41,46)" class=3D"m_-7856430591641183749colour">The only ways to spend i=
ts outputs from this=C2=A0<span style=3D"font-family:monospace,monospace" c=
lass=3D"m_-7856430591641183749font">ThisRedeemScript</span>=C2=A0is to forw=
ard it to=C2=A0<span style=3D"font-family:monospace,monospace" class=3D"m_-=
7856430591641183749font">NextRedeemScript</span>.=C2=A0</span><span style=
=3D"color:rgb(36,41,46)" class=3D"m_-7856430591641183749colour">Even if the=
 original key pair is</span><span style=3D"color:rgb(36,41,46)" class=3D"m_=
-7856430591641183749colour">=C2=A0compromised, the attacker can only spend =
it this way and has to publish the transaction.</span><br></p><p style=3D"b=
ox-sizing:border-box;margin-top:0px;margin-bottom:16px"><span style=3D"font=
-family:monospace,monospace" class=3D"m_-7856430591641183749font">tx1:<br><=
span style=3D"background-color:rgb(248,249,250)" class=3D"m_-78564305916411=
83749highlight">=C2=A0 scriptSig: &lt;sig&gt; &lt;pubKey&gt; 0<br></span></=
span><span style=3D"color:#1a1a1a" class=3D"m_-7856430591641183749colour"><=
span style=3D"font-family:monospace,monospace" class=3D"m_-7856430591641183=
749font">=C2=A0 scriptPubKey:=C2=A0</span></span><span style=3D"color:rgb(2=
6,26,26)" class=3D"m_-7856430591641183749colour"><span style=3D"font-family=
:monospace,monospace" class=3D"m_-7856430591641183749font">HASH160 &lt;Hash=
160(NextRedeemScript)&gt; EQUAL<br><br></span></span><span style=3D"font-fa=
mily:monospace,monospace" class=3D"m_-7856430591641183749font">tx2: //if th=
ere is change<br><span style=3D"background-color:rgb(248,249,250)" class=3D=
"m_-7856430591641183749highlight">=C2=A0 scriptSig: &lt;sig&gt; &lt;Acme&#3=
9;s pubKey&gt;<br></span></span><span style=3D"color:#1a1a1a" class=3D"m_-7=
856430591641183749colour"><span style=3D"font-family:monospace,monospace" c=
lass=3D"m_-7856430591641183749font">=C2=A0 scriptPubKey:=C2=A0</span></span=
><span style=3D"color:rgb(26,26,26)" class=3D"m_-7856430591641183749colour"=
><span style=3D"font-family:monospace,monospace" class=3D"m_-78564305916411=
83749font">HASH160=C2=A0</span></span><span style=3D"color:rgb(26,26,26)" c=
lass=3D"m_-7856430591641183749colour"><span style=3D"font-family:monospace,=
monospace" class=3D"m_-7856430591641183749font">ThisRedeemScriptHash</span>=
</span><span style=3D"color:rgb(26,26,26)" class=3D"m_-7856430591641183749c=
olour"><span style=3D"font-family:monospace,monospace" class=3D"m_-78564305=
91641183749font">=C2=A0EQUAL<br></span></span><span style=3D"color:rgb(26,2=
6,26)" class=3D"m_-7856430591641183749colour"><span style=3D"font-family:mo=
nospace,monospace" class=3D"m_-7856430591641183749font"><br></span></span><=
span style=3D"font-family:monospace,monospace" class=3D"m_-7856430591641183=
749font">NextRedeemScript</span><span style=3D"color:rgb(36,41,46)" class=
=3D"m_-7856430591641183749colour">=C2=A0is time locked. Acme is able to mon=
itor for=C2=A0</span><span style=3D"color:rgb(36,41,46)" class=3D"m_-785643=
0591641183749colour">unauthorized transactions</span><span style=3D"color:r=
gb(36,41,46)" class=3D"m_-7856430591641183749colour">=C2=A0and react within=
 the sequence-defined duration. The combination of 2 key pair as one multis=
ig can spend the output immediately regardless of the timelock.</span></p><=
p style=3D"box-sizing:border-box;margin-top:0px;margin-bottom:16px"><span s=
tyle=3D"color:rgb(26,26,26)" class=3D"m_-7856430591641183749colour"><span s=
tyle=3D"font-family:monospace,monospace" class=3D"m_-7856430591641183749fon=
t">NextRedeemScript</span></span><span style=3D"font-family:monospace,monos=
pace" class=3D"m_-7856430591641183749font"><span style=3D"color:#1a1a1a" cl=
ass=3D"m_-7856430591641183749colour">:<br></span></span><span style=3D"colo=
r:rgb(36,41,46)" class=3D"m_-7856430591641183749colour"><span style=3D"font=
-family:monospace,monospace" class=3D"m_-7856430591641183749font">=C2=A0 IF=
<br></span></span><span style=3D"color:rgb(36,41,46)" class=3D"m_-785643059=
1641183749colour"><span style=3D"font-family:monospace,monospace" class=3D"=
m_-7856430591641183749font">=C2=A0 =C2=A0 2=C2=A0</span></span><span style=
=3D"color:rgb(26,26,26)" class=3D"m_-7856430591641183749colour"><span style=
=3D"font-family:monospace,monospace" class=3D"m_-7856430591641183749font">&=
lt;Acme&#39;s pubkey&gt;=C2=A0</span></span><span style=3D"color:rgb(26,26,=
26)" class=3D"m_-7856430591641183749colour"><span style=3D"font-family:mono=
space,monospace" class=3D"m_-7856430591641183749font">&lt;securePubkey&gt; =
2</span></span><span style=3D"color:rgb(26,26,26)" class=3D"m_-785643059164=
1183749colour"><span style=3D"font-family:monospace,monospace" class=3D"m_-=
7856430591641183749font">=C2=A0</span></span><span style=3D"color:rgb(26,26=
,26)" class=3D"m_-7856430591641183749colour"><span style=3D"font-family:mon=
ospace,monospace" class=3D"m_-7856430591641183749font">CHECKMULTISIG<br></s=
pan></span><span style=3D"color:rgb(26,26,26)" class=3D"m_-7856430591641183=
749colour"><span style=3D"font-family:monospace,monospace" class=3D"m_-7856=
430591641183749font">=C2=A0 ELSE<br></span></span><span style=3D"color:rgb(=
26,26,26)" class=3D"m_-7856430591641183749colour"><span style=3D"font-famil=
y:monospace,monospace" class=3D"m_-7856430591641183749font">=C2=A0 =C2=A0=
=C2=A0</span></span><span style=3D"color:#1a1a1a" class=3D"m_-7856430591641=
183749colour">&quot;12h&quot; CHECKSEQUENCEVERIFY DROP=C2=A0</span><span st=
yle=3D"color:rgb(26,26,26)" class=3D"m_-7856430591641183749colour"><span st=
yle=3D"font-family:monospace,monospace" class=3D"m_-7856430591641183749font=
">&lt;Acme&#39;s pubkey&gt;=C2=A0</span></span><span style=3D"color:rgb(26,=
26,26)" class=3D"m_-7856430591641183749colour"><span style=3D"font-family:m=
onospace,monospace" class=3D"m_-7856430591641183749font">CHECKSIG<br></span=
></span><span style=3D"color:rgb(26,26,26)" class=3D"m_-7856430591641183749=
colour"><span style=3D"font-family:monospace,monospace" class=3D"m_-7856430=
591641183749font">=C2=A0 ENDIF</span></span></p><p style=3D"box-sizing:bord=
er-box;margin-top:0px;margin-bottom:16px"><span style=3D"color:rgb(36,41,46=
)" class=3D"m_-7856430591641183749colour">After 12 hours, Acme is can spend=
 the output as normal.</span><br></p><p style=3D"box-sizing:border-box;marg=
in-top:0px;margin-bottom:16px"><span style=3D"font-family:monospace,monospa=
ce" class=3D"m_-7856430591641183749font">tx:<br><span style=3D"background-c=
olor:rgb(248,249,250)" class=3D"m_-7856430591641183749highlight">=C2=A0 scr=
iptSig: &lt;sig&gt; &lt;pubkey&gt; 0<br></span></span><span style=3D"color:=
#1a1a1a" class=3D"m_-7856430591641183749colour"><span style=3D"font-family:=
monospace,monospace" class=3D"m_-7856430591641183749font">=C2=A0 scriptPubK=
ey:=C2=A0</span></span><span style=3D"background-color:rgb(248,249,250)" cl=
ass=3D"m_-7856430591641183749highlight"><span style=3D"color:rgb(0,0,0)" cl=
ass=3D"m_-7856430591641183749colour"><span style=3D"font-family:monospace,c=
ourier" class=3D"m_-7856430591641183749font"><span style=3D"font-size:14px"=
 class=3D"m_-7856430591641183749size">DUP HASH160 &lt;recipient&#39;s pubke=
yHash&gt; EQUALVERIFY CHECKSIG</span></span></span></span></p><p style=3D"b=
ox-sizing:border-box;margin-top:0px;margin-bottom:16px"><b style=3D"color:r=
gb(36,41,46);font-size:large;font-family:arial,helvetica,sans-serif">Descri=
ption</b><br></p><p style=3D"box-sizing:border-box;margin-top:0px;margin-bo=
ttom:16px"><span style=3D"color:rgb(36,41,46)" class=3D"m_-7856430591641183=
749colour"><span style=3D"color:rgb(34,34,34)" class=3D"m_-7856430591641183=
749colour"><span style=3D"font-family:arial,helvetica,sans-serif" class=3D"=
m_-7856430591641183749font">CSV and CTLV already laid the groundwork for r<=
/span></span><span style=3D"color:rgb(34,34,34)" class=3D"m_-78564305916411=
83749colour"><span style=3D"font-family:arial,helvetica,sans-serif" class=
=3D"m_-7856430591641183749font">etroactive invalidation, showcased in innov=
ative protocols such as HTLC of lightning network.<br><br>As illustrated fr=
om the sample use case, t</span></span><span style=3D"color:rgb(34,34,34)" =
class=3D"m_-7856430591641183749colour"><span style=3D"font-family:arial,hel=
vetica,sans-serif" class=3D"m_-7856430591641183749font">here are other clas=
ses of problems that may requires retroactive invalidation in different</sp=
an></span><span style=3D"color:rgb(34,34,34)" class=3D"m_-78564305916411837=
49colour"><span style=3D"font-family:arial,helvetica,sans-serif" class=3D"m=
_-7856430591641183749font">=C2=A0and less-interactive way from channels. Mo=
st of those problems require a primitive opcode to influence how the output=
 can be spent.</span></span></span></p><p style=3D"box-sizing:border-box;ma=
rgin-top:0px;margin-bottom:16px"><span style=3D"color:rgb(36,41,46)" class=
=3D"m_-7856430591641183749colour">If the use case works as expected, attack=
s will be=C2=A0<i>less</i>=C2=A0rewarding. There are still other attack vec=
tors if Acme&#39;s original key pair is compromised, i.e;<br><br>&gt; The a=
ttacker can drain the output as transaction fees.<br>There could be ways to=
 reduce that risk, but do not intent to add complexity to a request. This a=
dditional depth of defense is an improvement to deter attacks especially if=
 an attack is costly to pull.<br><br>&gt; After 12 hours, it may be still p=
ossible for attacker to submit transactions in concurrent or ahead of Acme.=
<br>Acme should submit the transaction before the 12 hours and leave it=C2=
=A0<span style=3D"color:rgb(36,39,41)" class=3D"m_-7856430591641183749colou=
r"><span style=3D"font-family:Arial,&quot;Helvetica Neue&quot;,Helvetica,sa=
ns-serif" class=3D"m_-7856430591641183749font">in mempool, waiting for nSeq=
uence to elapse.</span></span>=C2=A0Attacker&#39;s transaction submitted af=
ter it=C2=A0<i>should be(?)</i><span style=3D"color:rgb(36,39,41)" class=3D=
"m_-7856430591641183749colour"><span style=3D"font-family:Arial,&quot;Helve=
tica Neue&quot;,Helvetica,sans-serif" class=3D"m_-7856430591641183749font">=
=C2=A0rejected by the network. Attacker&#39;s transaction submitted before =
it will be caught by the monitoring function. Even if the above assumption =
is misguided, the use-case is still useful if transactions have value small=
er quantity than total, that limits loss to only the transaction&#39;s valu=
e. At the same time, that reveals the fact that the key pair is compromised=
 and the further preventive actions can be carried out using the secure key=
 pair.</span></span></span></p><p style=3D"box-sizing:border-box;margin-top=
:0px;margin-bottom:16px"><span style=3D"color:rgb(36,41,46)" class=3D"m_-78=
56430591641183749colour">Possible privacy concern: The use case demonstrate=
d change to be sent back to self (there may be related concern such as wron=
gly configured digital signature). The use case assumed P2SH is exceptional=
 case, kind of like multisignature wallets, for custodians like e-commerce =
merchants, exchanges.</span><br></p></div></blockquote><div><br></div></blo=
ckquote></div>

--00000000000023e91d0578673246--