Nostr notes by

📅 Original date posted:2019-10-01 📝 Original message: ...

2023-06-09T12:56:23Z

In reply to nevent1q…7wry
_________________________

📅 Original date posted:2019-10-01
📝 Original message:
Thanks Christian for pulling together this concise summary.

1. General agreement on the usefulness of noinput / anyprevoutanyscript /
> anyprevout.
>

I certainly support the unification and adoption of the sighash_noinput and
anyprevoutput* proposals to enable eltoo, but also to make possible better
off-chain protocol designs generally.

Among the various advantages previously discussed, the particular use case
benefits from eltoo I want to take advantage of is less interactive payment
channel negotiation.

In talking with people about eltoo this summer, I found most people
generally support adding this as an option to Lightning. The only general
concern I heard, if any, was the vague idea that rebindable transactions
could be somehow misused or abused.

I believe when these concerns are made more concrete they can be classified
and addressed.

I don't find too compelling the potential problem of a 'bad wallet
designer', whether lazy or dogmatic, misusing noinput. I think there are
simpler ways to cut corners and there will always be plenty of good wallet
options people can choose.

Because scripts signed with no_input signatures are only really exchanged
and used for off-chain negotiations, very few should ever appear on chain.
Those that do should represent non-cooperative situations that involve
signing parties who know not to reuse or share scripts with these public
keys again. No third party has any reason to spend value to a
multisignature script they don't control, whether or not a no_input
signature exists for it.

2. Is there strong support or opposition to the chaperone signatures
> introduced in anyprevout / anyprevoutanyscript? I think it'd be best to
> formulate a concrete set of pros and contras, rather than talk about
> abstract dangers or advantages.
>

As I mentioned before, I don't think the lazy wallet designer advantage is
enough to justify the downsides of chaperone signatures. One additional
downside is the additional code complexity required to flag whether or not
a chaperone output is included. By comparison, the code changes for
creating a no_input digest that skips the prevout and prevscript parts of a
tx is much less intrusive and easier to maintain.

3. The same for output tagging / explicit opt-in. What are the advantages
> and
> disadvantages?
>

I see the point ZmnSCPxj makes about tagged outputs negatively impacting
the anonymity set of taproot transactions. The suggested work around would
impose a cost to unilateral closes of an additional translation transaction
and not using the work around would cause a hit to anonymity for off-chain
script users. I feel both costs are too high relative to the benefit gained
of preventing sloppy reuse of public keys.

4. Shall we merge BIP-118 and bip-anyprevout. This would likely reduce the
> confusion and make for simpler discussions in the end.

I believe they should be merged. I also think both chaperone signatures and
output tagging should become part of the discussion of security
alternatives, but not part of the initial specification.

I understand the desire to be conservative with protocol changes that could
be misused. However, with just taproot and taproot public key types the
anyprevout functionality is already very opt-in and not something that
might accidentally get used. Belt-and-suspender protections like chaperone
signatures and tagged outputs have their own impacts on code complexity,
on-chain transaction sizes and transaction anonymity that also must be
considered.

I believe efforts like descriptors will help people follow best practices
when working with complex scripts without pushing extra complexity for
safety into the consensus layer of bitcoin. Anywhere we can make core code
simpler, and handle foot-guns in higher level non-consensus code, the
better.

_______________________________________________

> Lightning-dev mailing list
> Lightning-dev at lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/lightning-dev
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/lightning-dev/attachments/20191001/f57d3131/attachment-0001.html>;

📅 Original date posted:2019-09-16 📝 Original message: ...

2023-06-09T12:56:04Z

In reply to nevent1q…5k4f
_________________________

📅 Original date posted:2019-09-16
📝 Original message:
Thanks for the feedback ZmnSCPxj.

I imagine a future where most people do not typically have single-signer
> ownership of coins onchain, but are instead share-owners of coins, with
> single-signer ownership occurring onchain only in the case of dispute or
> for long-term cold storage.
>

The change-in-membership ritual you describe seems like a good start for
elaborating on this idea.

Some aspects of multi-party Decker-Russell-Osuntokun channels have analogs
to a signet blockchain that use a n-of-n federation of signers. But other
places, like change-in-membership, do not have direct analogs.

For example, some signet concepts with multi-party channel analogs:

block script:
* the first 'update' and 'settle' transactions, aka 'setup' and 'refund'
transactions, define the set of signers that must sign subsequent channel
updates

genesis block:
* the initial 'funding' transaction, aka outpoint of the commitment
transaction, which establishes the funded channel

utxo set:
* the specific set of on-chain outputs from the 'settlement' transaction
that spends the balance of the latest 'update' transaction signed by the
complete set of channel parties.

mempool:
* the set of proposals for specific changes to the set of outputs from the
latest 'settlement' transaction (similar to update_add_htlc,
update_fail_htlc, etc)

Concepts where layer two channels do not have an obvious analog to a layer
one signet blockchain:

cooperative close:
* when all parties mutually agree to close the channel
* close the channel with a layer one transaction which finalizes the
outputs from the most recent channel output state
* should be optimized for privacy and low on-chain fees

membership change (ZmnSCPxj ritual):
* when channel parties want to leave or add new members to the channel
* close and reopen a new channel via something like a channel splicing
transaction to the layer one blockchain
* should be optimized for privacy and low on-chain fees paid for by parties
entering and leaving the channel

balance change (similar to membership change):
* when channel parties want to add or remove some of the finalized value in
the channel
* close and reopen a new channel via something like a channel splicing
transaction to the layer one blockchain
* should be optimized for privacy and low on-chain fees paid for by parties
adding and removing value from the channel

uncooperative close:
* when one or more nodes fails to sign the next channel state update
* use a layer one transaction to commit both finalized and un-finalized
outputs from the most recent channel output state
* script timeouts determine when channel parties should uncooperatively
close the channel if not all parties have signed the next 'update' and
'settlement' transaction

uncooperative membership change:
* a subset of channel parties might want to cooperatively sign a channel
splicing transaction to 'splice out' uncooperative parties

mining, mining reward and difficulty adjustment
* no equivalent concept for multi-party channels

transaction fees:
* updates to layer two channels do not incur transactions fees
* invalid updates dropped to layer one should be paid by cheating node
* splice in/out transactions should be paid by requesting signers only
* do transaction fees prevent 'griefing' attacks?

privacy:
* disassociate a particular update from signer(s)
* disassociate IP address of signers from signature
* using SIGHASH_ALL for cooperative closes

liveness:
* if signers know they will be offline, can they pre-sign updates that just
commit their own outputs, rather then splice out?
* contingent tap-leafs to splice out non-responsive signers

The "block" that would need to be signed by the participants would actually
> be a Decker-Russell-Osuntokun update+state transaction, and would commit to
> the UTXO set rather than the transaction set.
> Unless I misunderstand your meaning here.
>

Oops, ya, I did mean a "block" to be a particular Decker-Russell-Osuntokun
update+state transaction.

I think it will be useful to have these ideas in the back of my mind as I
work on making eltoo scripts that support multi-party channels.

--
Richard Myers
Decentralized Applications Engineer, goTenna
gotenna.com
@gotenna
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/lightning-dev/attachments/20190916/afc6b87e/attachment.html>;

📅 Original date posted:2022-04-24 📝 Original message:Hi ...

2023-06-07T23:08:00Z

In reply to nevent1q…w7qe
_________________________

📅 Original date posted:2022-04-24
📝 Original message:Hi darosior,

Thanks for sharing your thoughts on this.

> I would like to know people's sentiment about doing (a very slightly tweaked version of) BIP118 in place of
> (or before doing) BIP119.

Sounds good to me. Although from an activation perspective it may not be either/or, both proposals do compete for scarce reviewer time so their ordering will necessarily be driven by reviewer's priorities. My priority is eltoo which is why I focus on BIP-118.

> SIGHASH_ANYPREVOUTANYSCRIPT, if its "ANYONECANPAY" behaviour is made optional [0], can emulate CTV just fine.

For someone not as versed in CTV, why is it necessary that ANYONECANPAY be optional to emulate CTV? Is there a write-up that explains how APO-AS w/out ANYONECANPAY approximates CTV?

In the case of eltoo commit txs, we use bring-your-own-fee (BYOF) to late-bind fees; that means ANYONECANPAY will always be paired with APO-AS for eltoo. Settlement txs in eltoo use just APO and do not necessarily need to be paired with ANYONECANPAY.

I would guess making ANYONECANPAY the default for APO-AS was a way to squeeze in one more sighash flag. Perhaps there's another way to do it?

Including SIGHASH_GROUP with APO for eltoo is also tempting. Specifically so the counter-party who commits a settlement tx can use for fees their settled to_self balance. How to rejigger the sighash flags to accommodate both APO and GROUP may be worth some discussion.

The BIP-118 proposal will certainly benefit from having input from reviewers looking at other protocols than eltoo.

-- Richard

📅 Original date posted:2020-08-03 📝 Original message:Thanks ...

2023-06-07T18:26:07Z

In reply to nevent1q…mp2t
_________________________

📅 Original date posted:2020-08-03
📝 Original message:Thanks AJ for the updated BIP - very exciting!

I'm also interested in this in the context of a Taproot version of
Decker-Russell-Osuntokun (eltoo). Thanks ZmnSCPxj for summarizing your
thoughts on how this would work. I have had some difficulty understanding
when someone might want to use ANYPREVOUT vs. ANYPREVOUTANYSCRIPT and this
is a clever demonstration of how the differences can be exploited.

I sketched out the protocol you described to help my understand it (below)
and some questions came to mind:

1) If you do a collaborative close, would you need to use script-path
spending, or could you use key-path spending instead to improve privacy?

2) You mention 1.5 round trips for the (two party) MuSig signing session.
Must there be separate 1.5 round trips for each of the two signatures
produced (update, settlement) for each state update?

3) A related question: can the 1.5 round trips for signing be combined with
the 1.5 round trips required to update the channel (ie. A signs settlement
tx, B signs settlement & update txs, A signs update tx)?

Perhaps something like this:
-> A provides partial signature for settlement tx
<- B provides complete signature for settlement tx and partial signature
for update tx
-> A provides complete signature for update tx

4) I'm not sure why AJ's formulation included an addition sig(X), but
otherwise is it similar to what you're suggesting?

https://lists.linuxfoundation.org/pipermail/lightning-dev/2019-May/001996.html

All the best,

-- Richard

------- my interpretation of your scheme ----

[Fund Channel]
|
|
|
v
P=Musig(A,B)+scripts (Taproot internal key, aka script path key?)
Q=Musig(A,B) (Taproot output key, aka root key?)

OR ----------- [Cooperative Close]
||| Sig(Q) -----+
||| |----> Sig(A)...
||| |
||| |----> Sig(B)...
|||
|||
||+-->[Update(n)]
|| nlocktime/state > n
|| Sig(P)+ANYPREVOUTANYSCRIPT
||
|| OR ---------->[Settle(n)] [Uncooperative Close @
state n]
|| | Sig(P)+ANYPREVOUT
|| | csv [delay] --------+---> Sig(A)... [HTLCs
& Settled
|| | |
Outputs ]
|| | |---> Sig(B)...
|| v
|+---->[Update(n+1)]
| nlocktime/state > n+1
| Sig(P)+ANYPREVOUTANYSCRIPT
|
| OR ----------->[Settle(n+1)] [Uncooperative Close @
state n+1]
| | Sig(P)+ANYPREVOUT
| | csv [delay] -------+---> Sig(A)... [HTLCs
& Settled
| | |
Outputs ]
v v |---> Sig(B)...

On Fri, Jul 10, 2020 at 5:30 AM ZmnSCPxj via bitcoin-dev
<bitcoin-dev at lists.linuxfoundation.org> wrote:

...

> Slightly off-topic, but I suppose a Decker-Russell-Osuntokun construction
> could, in theory, have only a single internal taproot pubkey, `P = MuSig(A,
> B)` for a channel between A and B.
>
> So the funding outpoint would be spent with a taprooted P + a single
> tapscript `<1> OP_CHECKSIG`.
>
> Update transactions would be signed with the internal taproot pubkey using
> `SIGHASH_ANYPREVOUTANYSCRIPT`.
> The update transaction output would be spendable with a taprooted P + a
> single tapscript `<index + 1> OP_CHECKLOCKTIMEVERIFY OP_DROP <1>
> OP_CHECKSIG`.
> Each update transaction would have a monotonically-increasing `nLockTime`,
> i.e. the above `index`.
>
> Then a state transaction would be signed with the internal taproot pubkey
> using `SIGHASH_ANYPREVOUT`, which commits to the exact script including
> `<index + 1>`, which is unique for each update transaction.
> Thus a state transaction can only spend the specific update transaction,
> but the update transaction can spend the funding outpoint or any update
> transaction outpoint.
> State transaction input would have an `nSequence` requiring a relative
> locktime of the agreed-upon unilateral close delay.
>
> The above assumes MuSig signing, which requires 1.5 round trips for a
> channel, or three broadcast rounds for a multiparticipant (n >= 3)
> construction.
>
>
> Regards,
> ZmnSCPxj
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20200803/fadaa364/attachment.html>;

📅 Original date posted:2020-05-20 📝 Original ...

2023-06-07T18:24:35Z

In reply to nevent1q…s0ls
_________________________

📅 Original date posted:2020-05-20
📝 Original message:I've been looking at using compressed block headers from the perspective of
a node that wants to use SMS messages to sync block headers. I realized
that it would be helpful if sendheaders2 took a parameter for how often to
send compact blockheaders. For example, in the case of an SMS transport
layer, it would make sense to request 4 headers at a time to optimally fill
a 160 byte SMS message.

Although using SMS messages would be about the most expensive way to
receive block headers, it is also the most universally available to
smartphone users, even where mobile data might be expensive or unavailable.
If we assume an SMS costs a bulk sender 0.025 USD per SMS, then sending 4
at a time (4 x 39 + 1 byte < 160 byte max SMS) reduces costs 1/4 to 252
instead of 1008 messages at a total weekly cost of ~7 instead of 26 USD.
Still not ideal, but a huge savings.

Since you're proposing a new message anyway, it doesn't break compatibility
to add a parameter for how often sendheaders2 chunks up recent headers.

On Fri, May 8, 2020 at 3:34 PM Will Clark via bitcoin-dev <
bitcoin-dev at lists.linuxfoundation.org> wrote:

> Hello list,
>
> I would like to propose a compressed block header scheme for IBD and block
> announcements. This proposal is derivative of previous proposals found on
> this list (see links in spec below) with some modifications and
> clarifications.
>
> The below specification (also found at
> https://github.com/willcl-ark/compressed-block-headers/blob/v1.0/compressed-block-headers.adoc
> ) details the compression recommended along with the generated bandwidth
> savings in the best-case scenario.
>
> I look forward to any feedback anyone has to offer on the specification
> itself, as well as any additions or objections to the motivation.
>
> Cheers,
> Will
>
>
> = Compressed block headers
> Will Clark <will8clark at gmail.com>
> v1.0, May 2020:
> :toc: preamble
> :toclevels: 4
>
>
> This work is a derivation of these mailing list posts:
>
> 1.
> https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017-August/014876.html[bitcoin-dev:
> "Compressed" headers stream - 2017] (with resurrection
> https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017-December/015385.html[here]
> )
>
> 2.
> https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2018-March/015851.html[bitcoin-dev:
> Optimized Header Sync]
>
> '''
>
> == Motivation
>
> Block headers as exchanged by nodes over the p2p network are currently 81
> bytes each.
>
> For low bandwidth nodes who are doing a headers-only sync, reducing the
> size of the headers can provide a significant bandwidth saving. Also, nodes
> can support more header-only peers for IBD and protection against eclipse
> attacks if header bandwidth is reduced.
>
> === Background
>
> Currently headers are sent over the p2p network as a vector of
> `block_headers`, which are composed of the following sized fields:
>
> [cols="<,>"]
> |===
> |Field |Size
>
> |Version |4 bytes
> |Previous block hash |32 bytes
> |Merkle root hash |32 bytes
> |Time |4 bytes
> |nBits |4 bytes
> |nonce |4 bytes
> |txn_count |1 byte
> |*Total* |81 bytes
> |===
>
> Some fields can be removed completely, others can be compressed under
> certain conditions.
>
> == Proposed specification
>
> === block_header2 data type
>
> The following table illustrates the proposed `block_header2` data type
> specification.
>
> [cols="<,>,>"]
> |===
> |Field |Size |Compressed
>
> |Bitfield |1 byte | 1 byte
> |Version |4 bytes |0 \| 4 bytes
> |Previous block hash |32 bytes |0 \| 32 bytes
> |Merkle root hash |32 bytes |32 bytes
> |Time |4 bytes |2 \| 4 bytes
> |nBits |4 bytes |0 \| 4 bytes
> |nonce |4 bytes |4 bytes
> |*Total* |81 bytes |range: 39 - 81 bytes
> |===
>
> This compression results in a maximum reduction from an 81 byte header to
> best-case 39 byte header. With 629,474 blocks in the current blockchain, a
> continuous header sync from genesis (requiring a single full 81 byte header
> followed by only compressed `block_header2`) has been tested to have its
> required bandwidth reduced from 50.98MB down to 25.86MB, a saving of 49%.
>
> ==== Bitfield
>
> To make parsing of header messages easier and further increase header
> compression, a single byte bitfield was suggested by gmaxwell footnote:[
> https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017-December/015397.html].
> We propose the following amended bitfield meanings (bits re-ordered to
> match `headers2` field order):
>
> [cols="<,<"]
> |===
> |Bit |Meaning + field size to read
>
> |0 +
> 1 +
> 2 |version: same as the last *distinct* value 1st ... 7th (0 byte
> field) or a new 32bit distinct value (4 byte field).
> |3 |prev_block_hash: is omitted (0 byte field) or included (32 byte
> field)
> |4 |timestamp: as small offset (2 byte field) or full (4 byte field).
> |5 |nbits: same as last header (0 byte field) or new (4 byte field).
> |6 |possibly to signal "more headers follow" to make the encoding
> self-delimiting.
> |7 |currently undefined
> |===
>
> This bitfield adds 1 byte for every block in the chain, for a current
> total increase of 629,474B.
>
> ==== Version
>
> In most cases the Version field will be identical to one referenced in one
> of the previous 7 unique versions, as indicated by bits 0,1,2 of the
> Bitfield.
>
> To block 629,474 there were 616,137 blocks whose version was in the
> previous 7 distinct versions, and only 13,338 blocks whose version was not,
> this includes any version bit manipulation done via overt ASIC boost.
>
> [cols=">,>,>,>"]
> |===
> |Genesis to block |Current (B) |Compressed (B) |Saving (%)
>
> |629,474 |2,517,896 |53,352 |98
> |===
>
> ==== Previous block hash
>
> The previous block hash will always be the
> `SHA256(SHA256(<previous_header>))` so is redundant, presuming you have
> the previous header in the chain.
>
> [cols=">,>,>,>"]
> |===
> |Genesis to block |Current (B) |Compressed (B) |Saving (%)
>
> |629,474 |20,143,168 |0 |100
> |===
>
> ==== Time
>
> The timestamp (in seconds) is consensus bound, based both on the time in
> the previous
> header: `MAX_FUTURE_BLOCK_TIME = 2 * 60 * 60 = 7200`, and being greater
> than the `MedianTimePast` of the previous 11 blocks. Therefore this can be
> safely represented as an offset from the previous headers' timestamp using
> a 2 byte `signed short int`.
>
> [cols=">,>,>,>"]
> |===
> |Genesis to block |Current (B) |Compressed (B) |Saving (%)
>
> |629,474 |2,517,896 |1,258,952 |50
> |===
>
> ==== nBits
>
> nBits currently changes once every 2016 blocks. It could be entirely
> calculated by the client from the timestamps of the previous 2015 blocks
> footnote:[2015 blocks are used in the adjustment calculation due to an
> off-by-one error:
> https://bitcointalk.org/index.php?topic=43692.msg521772#msg521772";].
>
> To simplify 'light' client implementations which would otherwise require
> consensus-valid calculation of the adjustments, we propose to transmit this
> according to the <<Bitfield>> specification above.
>
> To block 629,474 there have been 298 nBits adjustments (vs an expected 311
> -- there was none before block 32,256).
>
> [cols=">,>,>,>"]
> |===
> |Genesis to block |Current (B) |Compressed (B) |Saving (%)
>
> |629,474 |2,517,896 |1,196 |99.6
> |===
>
> ==== txn_count
>
> txn_count is included to make parsing of these messages compatible with
> parsing of `block` messages footnote:[
> https://bitcoin.stackexchange.com/questions/2104/why-is-the-block-header-txn-count-field-always-zero].
> Therefore this field and its associated byte can be removed for
> transmission of compact headers.
>
> [cols=">,>,>,>"]
> |===
> |Genesis to block |Current (B) |Compressed (B) |Saving (%)
>
> |629,474 |629,474 |0 |100
> |===
>
> === Service Bit
>
> A new service bit would be required so that the nodes can advertise their
> ability to supply compact headers.
>
> === P2P Messages
>
> Three new messages would be used by nodes that enable compact block header
> support, two query messages: `getheaders2` and `sendheaders2` and one
> response: `headers2`.
>
> ==== `getheaders2` -- Requesting compact headers
>
> The new p2p message required to request compact block headers would
> require the same fields as the current `getheaders` message:
>
> [cols=">,<,<,<"]
> |===
> |Field Size |Description |Data type |Comments
>
> |4 |version |uint32_t |the protocol version
> |1+ |hash count |var_int |number of block locator hash
> entries
> |32+ |block locator hashes |char[32] |block locator object; newest
> back to genesis block (dense to start, but then sparse)
> |32 |hash_stop |char[32] |hash of the last desired
> block header; set to zero to get as many blocks as possible (2000)
> |===
>
> ==== `sendheaders2` -- Request compact header announcements
>
> Since
> https://github.com/bitcoin/bips/blob/master/bip-0130.mediawiki[BIP-130],
> nodes have been able to request to receive new headers directly in
> `headers` messages, rather than via an `inv` of the new block hash and
> subsequent `getheader` request and `headers` response (followed by a final
> `getdata` to get the tip block itself, if desired). This is requested by
> transmitting an empty `sendheaders` message after the version handshake is
> complete.]
>
> Upon receipt of this message, the node is permitted, but not required, to
> preemptively announce new headers with the `headers2` message (instead of
> `inv`). Preemptive header announcement is supported by the protocol version
> ≥ 70012 | Bitcoin Core version ≥ 0.12.0.
>
> For the motivational use-case it makes sense to also update this mechanism
> to support sending header updates using compact headers using a new message.
>
> ==== `headers2` -- Receiving compact headers
>
> A `headers2` message is returned in response to `getheaders2` or at new
> header announcement following a `sendheaders2` request. It contains both
> `length` and `headers` fields. The `headers` field contains a variable
> length vector of `block_header2`:
>
> |===
> |Field Size |Description |Data type |Comments
>
> |1+ |length |var_int |Length of `headers`
> |39-81x? |headers |block_header2[] |Compressed block headers in
> <<block_header2 data type>> format
> |===
>
> === Implementation
>
> * The first header in the first `block_header2[]` vector to a
> newly-connected client MUST contain the full nBits`, `timestamp`, `version`
> and `prev_block_hash` fields, along with a correctly populated `bitfield`
> byte.
> * Subsequent headers in a contiguous vector SHOULD follow the compressed
> <<block_header2 data type>> format.
> * Subsequent compressed headers supplied to an already-connected client
> (requesting compressed headers), SHOULD follow the compressed
> <<block_header2 data type>> format.
>
>
>
>
>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev at lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>

--
Richard Myers
Decentralized Applications Engineer, goTenna
gotenna.com
@gotenna
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20200520/f9b6f40d/attachment-0001.html>;

📅 Original date posted:2020-05-11 📝 Original message:Thanks ...

2023-06-07T18:24:33Z

In reply to nevent1q…ckw0
_________________________

📅 Original date posted:2020-05-11
📝 Original message:Thanks for resurrecting this idea for discussion Will.

I see three reasons for reducing block header bandwidth:

1. support for long range block header broadcast via alternative
communication modalities like radio where every byte counts
2. where repurposed mobile devices with SPV wallets are used because
metered bandwidth and hardware costs are high relative to income
3. full nodes could potentially support twice as many header only peers
(is that a thing?) for better eclipse protection

Nodes could also run an additional daemon (eg. electrs) that serves
compressed block headers to light clients, but then it would be less likely
to see widespread use to reduce bandwidth between full nodes.

What are the negatives?
- higher computation? probably minimal compared to serving the same
uncompressed headers.
- memory for caching the last few versions? bounded to last seven, so not
too large.
- complexity/bugs? minor and opt in for node operators, though you could
argue the gain isn't worth any kind of change for nodes with high bandwidth
connections.
- use of low-bandwidth light clients should not be encouraged? that is a
separate discussion, but I do not currently see any proposals to remove
light client support.

I'm curious what other people think. Are the motivations enough to justify
a change to the protocol that produces a high percentage (but low absolute)
bandwidth reduction for transmitting block headers?

-- Richard

On Fri, May 8, 2020 at 3:34 PM Will Clark via bitcoin-dev <
bitcoin-dev at lists.linuxfoundation.org> wrote:

> Hello list,
>
> I would like to propose a compressed block header scheme for IBD and block
> announcements. This proposal is derivative of previous proposals found on
> this list (see links in spec below) with some modifications and
> clarifications.
>
> The below specification (also found at
> https://github.com/willcl-ark/compressed-block-headers/blob/v1.0/compressed-block-headers.adoc
> ) details the compression recommended along with the generated bandwidth
> savings in the best-case scenario.
>
> I look forward to any feedback anyone has to offer on the specification
> itself, as well as any additions or objections to the motivation.
>
> Cheers,
> Will
>
>
> = Compressed block headers
> Will Clark <will8clark at gmail.com>
> v1.0, May 2020:
> :toc: preamble
> :toclevels: 4
>
>
> This work is a derivation of these mailing list posts:
>
> 1.
> https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017-August/014876.html[bitcoin-dev:
> "Compressed" headers stream - 2017] (with resurrection
> https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017-December/015385.html[here]
> )
>
> 2.
> https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2018-March/015851.html[bitcoin-dev:
> Optimized Header Sync]
>
> '''
>
> == Motivation
>
> Block headers as exchanged by nodes over the p2p network are currently 81
> bytes each.
>
> For low bandwidth nodes who are doing a headers-only sync, reducing the
> size of the headers can provide a significant bandwidth saving. Also, nodes
> can support more header-only peers for IBD and protection against eclipse
> attacks if header bandwidth is reduced.
>
> === Background
>
> Currently headers are sent over the p2p network as a vector of
> `block_headers`, which are composed of the following sized fields:
>
> [cols="<,>"]
> |===
> |Field |Size
>
> |Version |4 bytes
> |Previous block hash |32 bytes
> |Merkle root hash |32 bytes
> |Time |4 bytes
> |nBits |4 bytes
> |nonce |4 bytes
> |txn_count |1 byte
> |*Total* |81 bytes
> |===
>
> Some fields can be removed completely, others can be compressed under
> certain conditions.
>
> == Proposed specification
>
> === block_header2 data type
>
> The following table illustrates the proposed `block_header2` data type
> specification.
>
> [cols="<,>,>"]
> |===
> |Field |Size |Compressed
>
> |Bitfield |1 byte | 1 byte
> |Version |4 bytes |0 \| 4 bytes
> |Previous block hash |32 bytes |0 \| 32 bytes
> |Merkle root hash |32 bytes |32 bytes
> |Time |4 bytes |2 \| 4 bytes
> |nBits |4 bytes |0 \| 4 bytes
> |nonce |4 bytes |4 bytes
> |*Total* |81 bytes |range: 39 - 81 bytes
> |===
>
> This compression results in a maximum reduction from an 81 byte header to
> best-case 39 byte header. With 629,474 blocks in the current blockchain, a
> continuous header sync from genesis (requiring a single full 81 byte header
> followed by only compressed `block_header2`) has been tested to have its
> required bandwidth reduced from 50.98MB down to 25.86MB, a saving of 49%.
>
> ==== Bitfield
>
> To make parsing of header messages easier and further increase header
> compression, a single byte bitfield was suggested by gmaxwell footnote:[
> https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017-December/015397.html].
> We propose the following amended bitfield meanings (bits re-ordered to
> match `headers2` field order):
>
> [cols="<,<"]
> |===
> |Bit |Meaning + field size to read
>
> |0 +
> 1 +
> 2 |version: same as the last *distinct* value 1st ... 7th (0 byte
> field) or a new 32bit distinct value (4 byte field).
> |3 |prev_block_hash: is omitted (0 byte field) or included (32 byte
> field)
> |4 |timestamp: as small offset (2 byte field) or full (4 byte field).
> |5 |nbits: same as last header (0 byte field) or new (4 byte field).
> |6 |possibly to signal "more headers follow" to make the encoding
> self-delimiting.
> |7 |currently undefined
> |===
>
> This bitfield adds 1 byte for every block in the chain, for a current
> total increase of 629,474B.
>
> ==== Version
>
> In most cases the Version field will be identical to one referenced in one
> of the previous 7 unique versions, as indicated by bits 0,1,2 of the
> Bitfield.
>
> To block 629,474 there were 616,137 blocks whose version was in the
> previous 7 distinct versions, and only 13,338 blocks whose version was not,
> this includes any version bit manipulation done via overt ASIC boost.
>
> [cols=">,>,>,>"]
> |===
> |Genesis to block |Current (B) |Compressed (B) |Saving (%)
>
> |629,474 |2,517,896 |53,352 |98
> |===
>
> ==== Previous block hash
>
> The previous block hash will always be the
> `SHA256(SHA256(<previous_header>))` so is redundant, presuming you have
> the previous header in the chain.
>
> [cols=">,>,>,>"]
> |===
> |Genesis to block |Current (B) |Compressed (B) |Saving (%)
>
> |629,474 |20,143,168 |0 |100
> |===
>
> ==== Time
>
> The timestamp (in seconds) is consensus bound, based both on the time in
> the previous
> header: `MAX_FUTURE_BLOCK_TIME = 2 * 60 * 60 = 7200`, and being greater
> than the `MedianTimePast` of the previous 11 blocks. Therefore this can be
> safely represented as an offset from the previous headers' timestamp using
> a 2 byte `signed short int`.
>
> [cols=">,>,>,>"]
> |===
> |Genesis to block |Current (B) |Compressed (B) |Saving (%)
>
> |629,474 |2,517,896 |1,258,952 |50
> |===
>
> ==== nBits
>
> nBits currently changes once every 2016 blocks. It could be entirely
> calculated by the client from the timestamps of the previous 2015 blocks
> footnote:[2015 blocks are used in the adjustment calculation due to an
> off-by-one error:
> https://bitcointalk.org/index.php?topic=43692.msg521772#msg521772";].
>
> To simplify 'light' client implementations which would otherwise require
> consensus-valid calculation of the adjustments, we propose to transmit this
> according to the <<Bitfield>> specification above.
>
> To block 629,474 there have been 298 nBits adjustments (vs an expected 311
> -- there was none before block 32,256).
>
> [cols=">,>,>,>"]
> |===
> |Genesis to block |Current (B) |Compressed (B) |Saving (%)
>
> |629,474 |2,517,896 |1,196 |99.6
> |===
>
> ==== txn_count
>
> txn_count is included to make parsing of these messages compatible with
> parsing of `block` messages footnote:[
> https://bitcoin.stackexchange.com/questions/2104/why-is-the-block-header-txn-count-field-always-zero].
> Therefore this field and its associated byte can be removed for
> transmission of compact headers.
>
> [cols=">,>,>,>"]
> |===
> |Genesis to block |Current (B) |Compressed (B) |Saving (%)
>
> |629,474 |629,474 |0 |100
> |===
>
> === Service Bit
>
> A new service bit would be required so that the nodes can advertise their
> ability to supply compact headers.
>
> === P2P Messages
>
> Three new messages would be used by nodes that enable compact block header
> support, two query messages: `getheaders2` and `sendheaders2` and one
> response: `headers2`.
>
> ==== `getheaders2` -- Requesting compact headers
>
> The new p2p message required to request compact block headers would
> require the same fields as the current `getheaders` message:
>
> [cols=">,<,<,<"]
> |===
> |Field Size |Description |Data type |Comments
>
> |4 |version |uint32_t |the protocol version
> |1+ |hash count |var_int |number of block locator hash
> entries
> |32+ |block locator hashes |char[32] |block locator object; newest
> back to genesis block (dense to start, but then sparse)
> |32 |hash_stop |char[32] |hash of the last desired
> block header; set to zero to get as many blocks as possible (2000)
> |===
>
> ==== `sendheaders2` -- Request compact header announcements
>
> Since
> https://github.com/bitcoin/bips/blob/master/bip-0130.mediawiki[BIP-130],
> nodes have been able to request to receive new headers directly in
> `headers` messages, rather than via an `inv` of the new block hash and
> subsequent `getheader` request and `headers` response (followed by a final
> `getdata` to get the tip block itself, if desired). This is requested by
> transmitting an empty `sendheaders` message after the version handshake is
> complete.]
>
> Upon receipt of this message, the node is permitted, but not required, to
> preemptively announce new headers with the `headers2` message (instead of
> `inv`). Preemptive header announcement is supported by the protocol version
> ≥ 70012 | Bitcoin Core version ≥ 0.12.0.
>
> For the motivational use-case it makes sense to also update this mechanism
> to support sending header updates using compact headers using a new message.
>
> ==== `headers2` -- Receiving compact headers
>
> A `headers2` message is returned in response to `getheaders2` or at new
> header announcement following a `sendheaders2` request. It contains both
> `length` and `headers` fields. The `headers` field contains a variable
> length vector of `block_header2`:
>
> |===
> |Field Size |Description |Data type |Comments
>
> |1+ |length |var_int |Length of `headers`
> |39-81x? |headers |block_header2[] |Compressed block headers in
> <<block_header2 data type>> format
> |===
>
> === Implementation
>
> * The first header in the first `block_header2[]` vector to a
> newly-connected client MUST contain the full nBits`, `timestamp`, `version`
> and `prev_block_hash` fields, along with a correctly populated `bitfield`
> byte.
> * Subsequent headers in a contiguous vector SHOULD follow the compressed
> <<block_header2 data type>> format.
> * Subsequent compressed headers supplied to an already-connected client
> (requesting compressed headers), SHOULD follow the compressed
> <<block_header2 data type>> format.
>
>
>
>
>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev at lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>

--
Richard Myers
Decentralized Applications Engineer, goTenna
gotenna.com
@gotenna
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20200511/dc570025/attachment-0001.html>;