summaryrefslogtreecommitdiff
path: root/e5/c790dd1daf1a3fc899e3d126f9fd0711be93d2
blob: 5d63bf6d113c2f1d7a62741fb6cd076d4eb05124 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
Return-Path: <karljohan-alm@garage.co.jp>
Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org
	[172.17.192.35])
	by mail.linuxfoundation.org (Postfix) with ESMTPS id 20DD3ED9
	for <bitcoin-dev@lists.linuxfoundation.org>;
	Wed, 12 Sep 2018 07:56:42 +0000 (UTC)
X-Greylist: from auto-whitelisted by SQLgrey-1.7.6
Received: from mo.garage.hdemail.jp (mo.garage.hdemail.jp [46.51.242.127])
	by smtp1.linuxfoundation.org (Postfix) with ESMTPS id ABA9C13A
	for <bitcoin-dev@lists.linuxfoundation.org>;
	Wed, 12 Sep 2018 07:56:40 +0000 (UTC)
Received: from ip-10-217-1-36.ap-northeast-1.compute.internal
	(localhost.localdomain [127.0.0.1])
	by mo.garage.hdemail.jp (hde-mf-postfix) with SMTP id 2C19D14C0C5
	for <bitcoin-dev@lists.linuxfoundation.org>;
	Wed, 12 Sep 2018 16:56:39 +0900 (JST)
	(envelope-from karljohan-alm@garage.co.jp)
X-Received: from unknown (HELO mo.garage.hdemail.jp) (127.0.0.1)
	by 0 with SMTP; 12 Sep 2018 16:56:39 +0900
X-Received: from mo.garage.hdemail.jp (localhost.localdomain [127.0.0.1])
	by mo.garage.hdemail.jp (hde-ma-postfix) with ESMTP id 1FE4C4C086
	for <bitcoin-dev@lists.linuxfoundation.org>;
	Wed, 12 Sep 2018 16:56:39 +0900 (JST)
	(envelope-from karljohan-alm@garage.co.jp)
Received: from gw22.oz.hdemail.jp
	(ip-10-127-175-123.ap-northeast-1.compute.internal [10.127.175.123])
	by mo.garage.hdemail.jp (hde-mf-postfix) with ESMTP id 126DC14C0C5
	for <bitcoin-dev@lists.linuxfoundation.org>;
	Wed, 12 Sep 2018 16:56:39 +0900 (JST)
	(envelope-from karljohan-alm@garage.co.jp)
X-Received: from mail-it0-f71.google.com (lb07.oz.hdemail.jp [54.238.57.67])
	(using TLSv1 with cipher AES128-SHA (128/128 bits))
	(No client certificate requested)
	by gw22.oz.hdemail.jp (Postfix) with ESMTP id 8FA21148C127
	for <bitcoin-dev@lists.linuxfoundation.org>;
	Wed, 12 Sep 2018 16:56:38 +0900 (JST)
X-Received: by mail-it0-f71.google.com with SMTP id w68-v6so2268293ith.0
	for <bitcoin-dev@lists.linuxfoundation.org>;
	Wed, 12 Sep 2018 00:56:38 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
	d=1e100.net; s=20161025;
	h=x-gm-message-state:mime-version:references:in-reply-to:from:date
	:message-id:subject:to;
	bh=b41ibZqRgHiDxUPyH40URy4962orpZobnPU2CSr2ay0=;
	b=ttDhiZAR3eWa1R13xIAVDJvM6nJYoNifw6qId/1XI/c93tuKMp7tQUWxPzKhW2PLfl
	+Z0Tf2rCcx0PROHmxlxmZjxDoTPdwgR8afJGT04bzg68ghEV1ch3aJlCc5A043ErOD4r
	o0QjtspqVzzDfgkaNkiyijZJQneF3cMMUEY9L0JN1yVMWhU34EABBtuaAJx6b5V/69tc
	uUQLuhDuKKXhimsULsYcI3KWo8elBEplA9TjQicWPXw96eWmZrn1XcFOIaqsWV47Tlwv
	uuYhr+CTaVayrDgItw3yk5uykJZRO7S7ouakwJjnyfyc0zt4IwgOSnaqE0bwYctPboRD
	xbGA==
X-Gm-Message-State: APzg51D5RwSwrYefZoNaMBIu2pmb47iGtqvNFCQC2aH/QELgVKh2Rgo6
	46OTG/hRqLkjT3OtHKFxw/3KMSIP1t+T2RYLHkfiEEtRkqcdlS9AGeXFfHOWgyIXXHFxjBbNJ2a
	m3z6bpQ9yV8zcErIMHYP2eXsVCRukiolpXb8eK1xjsVrkYzuVr5Miu/v3+CSR276X/4lSbBRstr
	f8JcEm2sOwOQ32gZsXajERwpIp2qSwskhSu6epf6HN1Yd4D03uZBbVQUjYt8NmJcwfQ4dZZinE/
	7ZQoz8cGcLOWl/soB28ES4m8B/9u0UuGqUOs59H4mj3Lr6mgrFbjtANe4zeWLljc5+yLYnIt2pa
	PK9+/En442qaSsce9wFRXYEXbno=
X-Received: by 2002:a6b:b242:: with SMTP id
	b63-v6mr506804iof.172.1536738997062; 
	Wed, 12 Sep 2018 00:56:37 -0700 (PDT)
X-Google-Smtp-Source: ANB0VdYM8KE3ZIRsThcic+5sKk4IXuYLlwEuQ4tEjZb+RlDCfDACA9SaCgthM29bUqy5y+wyYyqBQdMN7v7OnlKFZUc=
X-Received: by 2002:a6b:b242:: with SMTP id
	b63-v6mr506792iof.172.1536738996755; 
	Wed, 12 Sep 2018 00:56:36 -0700 (PDT)
MIME-Version: 1.0
References: <CALJw2w6m4iJWC_ySt32-oKD_1e4p1UcJqJG1Lm5gZDnrPgEwmQ@mail.gmail.com>
In-Reply-To: <CALJw2w6m4iJWC_ySt32-oKD_1e4p1UcJqJG1Lm5gZDnrPgEwmQ@mail.gmail.com>
From: Karl-Johan Alm <karljohan-alm@garage.co.jp>
Date: Wed, 12 Sep 2018 16:56:25 +0900
Message-ID: <CALJw2w7w9DvOcnx8DZS6T4cDiBRxPBuFwjxnstg3BL11KMn_eg@mail.gmail.com>
To: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: text/plain; charset="UTF-8"
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_NONE
	autolearn=ham version=3.3.1
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
	smtp1.linux-foundation.org
X-Mailman-Approved-At: Wed, 12 Sep 2018 13:44:49 +0000
Subject: Re: [bitcoin-dev] RFC: BIP 322: Generic Signed Message Format
X-BeenThere: bitcoin-dev@lists.linuxfoundation.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Bitcoin Protocol Discussion <bitcoin-dev.lists.linuxfoundation.org>
List-Unsubscribe: <https://lists.linuxfoundation.org/mailman/options/bitcoin-dev>,
	<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=unsubscribe>
List-Archive: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/>
List-Post: <mailto:bitcoin-dev@lists.linuxfoundation.org>
List-Help: <mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=help>
List-Subscribe: <https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev>,
	<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=subscribe>
X-List-Received-Date: Wed, 12 Sep 2018 07:56:42 -0000

Greetings,

(The quoted proposal is already outdated, and I recommend you check
out the up to date formatted version here:
https://github.com/kallewoof/bips/blob/bip-generic-signmessage/bip-0322.mediawiki
The PR with comments is here: https://github.com/bitcoin/bips/pull/725)

A big part of the feedback boils down to conflicts of opinion related
to whether or not proofs should be given as transactions or not.

I am attempting to write down the pros and cons below, some of which
are contradictory/complementary based on multiple people's opinions.

Pros of using transaction format:
1. works out of the box with existing HSM:s, some of which may be
purposefully built to not be upgradable for security reasons (unless
sighash modified; see below)
2. easier to incorporate into existing software
3. forward compatible with bitcoin extensions (e.g. mimblewimble,
confidential transactions, etc)
4. HSM:s *should* be blind to whether or not a transaction or a
message or proof of funds is being signed (see Con #3)

Cons:
1. dangerous if challenger is able to convince prover to sign a
message that corresponds to an actual transaction; modifying sighash
is suggested, but defeats pro #1 above; can define in tx to have txin
as sighash to guarantee invalid on chain
2. unupgraded software are unable to make distinction between message
sign and transaction sign
3. if HSM:s do not support it and do not support upgrading, this is by
design, and message signing should be explicitly supported or not be
possible (see Pro #4)
4. severely cripples UX for hardware wallets that actually show the
contents of the transaction during the signing

If anyone has comments on this, it would be tremendously appreciated.

There is also a divided opinion on whether an "OP_MESSAGEONLY" opcode
should be introduced, but I'd like to address the above first, if
possible.
On Tue, Sep 11, 2018 at 1:41 PM Karl-Johan Alm
<karljohan-alm@garage.co.jp> wrote:
>
> Hi.
>
> [note: BIP number was assigned to PR before this email was sent; I did
> not self-assign the BIP number]
>
> Below is a proposal to extend the existing sign/verifymessage format
> to a more generalized variant relying on the script verification
> mechanism in Bitcoin itself for message signing/verification, based on
> the original discussion
> (https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2018-March/015818.html)
> .
>
> PR is here: https://github.com/bitcoin/bips/pull/725
>
> A formatted version of this text can be seen here:
> https://github.com/kallewoof/bips/blob/bip-generic-signmessage/bip-generic-signmessage.mediawiki
>
> Note: I am not sure how to best deal with CLTV/CSV stuff here, ultimately.
>
> Note 2: I have received suggestions from several people to use a
> Bitcoin transaction instead. If someone could explain why this is
> beneficial, it would be very helpful. I'm not against it, just feels
> like the whole transaction part is unnecessary complexity/overhead.
>
> ---
> <pre>
>   BIP: 322
>   Layer: Applications
>   Title: Generic Signed Message Format
>   Author: Karl-Johan Alm <karljohan-alm@garage.co.jp>
>   Comments-Summary: No comments yet.
>   Comments-URI: https://github.com/bitcoin/bips/wiki/Comments:BIP-0322
>   Status: Draft
>   Type: Standards Track
>   Created: 2018-09-10
>   License: CC0-1.0
> </pre>
>
> == Abstract ==
>
> A standard for interoperable generic signed messages based on the
> Bitcoin Script format.
>
> == Motivation ==
>
> The current message signing standard only works for P2PKH (1...)
> addresses. By extending it to use a Bitcoin Script based approach, it
> could be made more generic without causing a too big burden on
> implementers, who most likely have access to Bitcoin Script
> interpreters already.
>
> == Specification ==
>
> A new structure <code>SignatureProof</code> is added, which is a
> simple serializable scriptSig & witnessProgram container.
>
> Two actions "Sign" and "Verify" are defined.
>
> === SignatureProof container ===
>
> {|class="wikitable" style="text-align: center;"
> |-
> !Type
> !Length
> !Name
> !Comment
> |-
> |Uint32||4||flags||standard flags (1-to-1 with standard flags in Bitcoin Core)
> |-
> |VarInt||1-8||msglen||Number of bytes in message string, excluding NUL
> termination
> |-
> |Char*||[msglen]||msg||The message being signed for all subjects,
> excluding NUL termination
> |-
> |Uint8||1||entries||Number of proof entries<ref><strong>Why support
> multiple proofs?</strong> In particular with proof of funds, it is
> non-trivial to check a large number of individual proofs (one per
> UTXO) for duplicates. Software could be written to do so, but it seems
> more efficient to build this check into the specification
> itself.</ref>
> |}
>
> The above is followed by [entries] number of signature entries:
>
> {|class="wikitable" style="text-align: center;"
> |-
> !Type
> !Length
> !Name
> !Comment
> |-
> |VarInt||1-8||scriptsiglen||Number of bytes in scriptSig data
> |-
> |Uint8*||[scriptsiglen]||scriptsig||ScriptSig data
> |-
> |VarInt||1-8||witlen||Number of bytes in witness program data
> |-
> |Uint8*||[witlen]||wit||Witness program
> |}
>
> In some cases, the scriptsig may be empty (scriptsiglen=0).
>
> === Signing ===
>
> The "Sign" action takes as input a scriptPubKey and a message (e.g.
> "hello world"). It succeeds or fails.
>
> # FAIL if scriptPubKey already exists in scriptPubKeys set, otherwise
> insert it<ref><strong>Why track duplicates?</strong> Because a 3-entry
> proof is not proving 3 scriptPubKeys unless they are all distinct, or
> unless they are proving different UTXO:s (see Future Extensions)</ref>
> # Derive the private key privkey for the scriptPubKey, or FAIL
> # Define the message pre-image as the sequence "Bitcoin Message:"
> concatenated with the message, encoded in UTF-8 using Normalization
> Form Compatibility Decomposition (NFKD)
> # Let sighash = sha256(sha256(scriptPubKey || pre-image))
> # Generate a signature sig with privkey=privkey, sighash=sighash
>
> Repeat the above operation for each scriptPubKey, retaining the
> scriptPubKeys set. As noted, if the same scriptPubKey appears more
> than once, the sign operation must fail.
>
> === Verifying ===
>
> The "Verify" action takes as input a standard flags value, a
> scriptPubKey, a message, a script sig, and a witness program.
> It emits one of INCONCLUSIVE, VALID, INVALID, or ERROR.
>
> # Return ERROR if scriptPubKey already exists in scriptPubKeys set,
> otherwise insert it
> # If one or more of the standard flags are unknown, return INCONCLUSIVE
> # Define the message pre-image as the sequence "Bitcoin Message:"
> concatenated with the message, encoded in UTF-8 using Normalization
> Form Compatibility Decomposition (NFKD).
> # Let sighash = sha256(sha256(scriptPubKey || pre-image))
> # Verify Script with flags=standard flags, scriptSig=script sig,
> scriptPubKey=scriptPubKey, witness=witness program, and
> sighash=sighash
> # Return VALID if verify succeeds, otherwise return INVALID
>
> Repeat the above operation for each scriptPubKey, retaining the
> scriptPubKeys set. As noted, if the same scriptPubKey appears more
> than once, the verify operation must fail with an ERROR.
>
> * If a verification call returns ERROR or INVALID, return ERROR or
> INVALID immediately, ignoring as yet unverified entries.
> * After all verifications complete, return INCONCLUSIVE if any
> verification call returned INCONCLUSIVE.
> * Return VALID if and only if every verification returned VALID.
>
> == Future Extensions ==
>
> === Proof of Funds ===
>
> The specification can be extended to handle proof of funds in the
> following manner:
>
> * Let the message be prefixed with "POF:", followed by a
> newline-terminated string<ref><strong>Why not just the UTXO
> data?</strong> We want the verifier to be able to challenge the prover
> with a custom message to sign, or anyone can reuse the POF proof for a
> set of UTXO:s once they have seen it, and the funds have not yet been
> spent</ref>, followed by [entries] series of hex-encoded transaction
> ID:vout pairs, separated by a single space (" ") character
> * Fail if the number of txid:vout pairs is not exactly equal to [entries]
> * Retain the message as is for all sighash operations (i.e. all sign
> and verify operations should sign and verify the entire list of
> UTXO:s)<ref><strong>Why use same sighash?</strong> The prover is
> proving that they have a set of UTXO:s at their disposal. Taking a
> sub-set of the proofs and turning them into a new proof should not be
> valid.</ref>
> * Add a verification that the txid/vout is a valid UTXO according to a
> synced up Bitcoin node, and that its corresponding scriptPubKey
> matches the one given by the proof. Return ERROR if scriptPubKey
> mismatch, and SPENT error if spent
> * Extend the scriptPubKeys set check to only fail if the same
> scriptPubKey and proof-of-funds txid/vout combination is encountered
>
> == Compatibility ==
>
> This specification is not backwards compatible with the legacy
> signmessage/verifymessage specification. However, legacy addresses
> (1...) may be used in this implementation without any problems.
>
> == Rationale ==
>
> <references/>
>
> == Reference implementation ==
>
> To do.
>
> == Acknowledgements ==
>
> TODO
>
> == References ==
>
> # Original mailing list thread:
> https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2018-March/015818.html
>
> == Copyright ==
>
> This document is licensed under the Creative Commons CC0 1.0 Universal license.
> ---
>
> -Kalle.