{"type":"rich","version":"1.0","author_name":"npub1t9vk487xpf4nh0cd4pesvw0wsa5yj3pskq2llle9vg0smvrexyts90lya2","author_url":"https://nostr.ae/npub1t9vk487xpf4nh0cd4pesvw0wsa5yj3pskq2llle9vg0smvrexyts90lya2","provider_name":"njump","provider_url":"https://nostr.ae","html":"📅 Original date posted:2020-05-01\n📝 Original message:Hi Jeremy,\n\nWhat you are saying is correct and I am not disputing that there is\nsufficient cryptographic commitment in the signature message. As I tried to\nexplain, my proposal is about avoiding the need for the metadata protocol\nyou speak of. Avoiding such a protocol has been a design goal in both\nBIP-143 [1, 2] and BIP-341 [3, 4], because having to acquire each of the\ntransactions being spent in their entirety places a significant burden on\noffline signing devices.\n\nCheers,\nAndrew\n\n[1]\nhttps://github.com/bitcoin/bips/blob/master/bip-0143.mediawiki#motivation\n[2] https://bitcointalk.org/index.php?topic=181734.0\n[3]\nhttps://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki#cite_note-16\n[4]\nhttps://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki#cite_note-17\n\nOn Fri, May 1, 2020 at 8:56 AM Jeremy \u003cjlrubin at mit.edu\u003e wrote:\n\n\u003e Hi Andrew,\n\u003e\n\u003e If you use SIGHASH_ALL it shall sign the COutPoints of all inputs which\n\u003e commit to the scriptPubKeys of the txn.\n\u003e\n\u003e Thus the 341 hash doesn't need to sign any additional data.\n\u003e\n\u003e As a metadata protocol you can provide all input transactions to check the\n\u003e scriptPubKeys.\n\u003e\n\u003e Best,\n\u003e\n\u003e Jeremy\n\u003e --\n\u003e @JeremyRubin \u003chttps://twitter.com/JeremyRubin\u003e\n\u003e\n\u003e\n\u003e On Thu, Apr 30, 2020 at 1:22 AM Andrew Kozlik via bitcoin-dev \u003c\n\u003e bitcoin-dev at lists.linuxfoundation.org\u003e wrote:\n\u003e\n\u003e\u003e Hi everyone,\n\u003e\u003e\n\u003e\u003e In the current draft of BIP-0341 [1] the signature message commits to the\n\u003e\u003e scriptPubKey of the output being spent by the input. I propose that the\n\u003e\u003e signature message should commit to the scriptPubKeys of *all* transaction\n\u003e\u003e inputs.\n\u003e\u003e\n\u003e\u003e In certain applications like CoinJoin, a wallet has to deal with\n\u003e\u003e transactions containing external inputs. To calculate the actual amount\n\u003e\u003e that the user is spending, the wallet needs to reliably determine for each\n\u003e\u003e input whether it belongs to the wallet or not. Without such a mechanism an\n\u003e\u003e adversary can fool the wallet into displaying incorrect information about\n\u003e\u003e the amount being spent, which can result in theft of user funds [2].\n\u003e\u003e\n\u003e\u003e In order to ascertain non-ownership of an input which is claimed to be\n\u003e\u003e external, the wallet needs the scriptPubKey of the previous output spent by\n\u003e\u003e this input. It must acquire the full transaction being spent and verify its\n\u003e\u003e hash against that which is given in the outpoint. This is an obstacle in\n\u003e\u003e the implementation of lightweight air-gapped wallets and hardware wallets\n\u003e\u003e in general. If the signature message would commit to the scriptPubKeys of\n\u003e\u003e all transaction inputs, then the wallet would only need to acquire the\n\u003e\u003e scriptPubKey of the output being spent without having to acquire and verify\n\u003e\u003e the hash of the entire previous transaction. If an attacker would provide\n\u003e\u003e an incorrect scriptPubKey, then that would cause the wallet to generate an\n\u003e\u003e invalid signature message.\n\u003e\u003e\n\u003e\u003e Note that committing only to the scriptPubKey of the output being spent\n\u003e\u003e is insufficient for this application, because the scriptPubKeys which are\n\u003e\u003e needed to ascertain non-ownership of external inputs are precisely the ones\n\u003e\u003e that would not be included in any of the signature messages produced by the\n\u003e\u003e wallet.\n\u003e\u003e\n\u003e\u003e The obvious way to implement this is to add another hash to the signature\n\u003e\u003e message:\n\u003e\u003e sha_scriptPubKeys (32): the SHA256 of the serialization of all\n\u003e\u003e scriptPubKeys of the previous outputs spent by this transaction.\n\u003e\u003e\n\u003e\u003e Cheers,\n\u003e\u003e Andrew Kozlik\n\u003e\u003e\n\u003e\u003e [1]\n\u003e\u003e https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki#common-signature-message\n\u003e\u003e [2]\n\u003e\u003e https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2017-August/014843.html\n\u003e\u003e _______________________________________________\n\u003e\u003e bitcoin-dev mailing list\n\u003e\u003e bitcoin-dev at lists.linuxfoundation.org\n\u003e\u003e https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev\n\u003e\u003e\n\u003e\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20200501/a04d22c8/attachment-0001.html\u003e"}