📅 Original date posted:2018-01-23
📝 Original message:Thanks Greg!
I'd be hesitant to deploy a MAST proposal without this clever application of pay-to-contract-hash now! Looks like the overhead over a more-naive MAST construction is rather trivial, too!
Matt
On January 23, 2018 12:30:06 AM UTC, Gregory Maxwell via bitcoin-dev <bitcoin-dev at lists.linuxfoundation.org> wrote:
>Interest in merkelized scriptPubKeys (e.g. MAST) is driven by two main
>areas: efficiency and privacy. Efficiency because unexecuted forks of
>a script can avoid ever hitting the chain, and privacy because hiding
>unexecuted code leaves scripts indistinguishable to the extent that
>their only differences are in the unexecuted parts.
>
>As Mark Friedenbach and others have pointed out before it is almost
>always the case that interesting scripts have a logical top level
>branch which allows satisfaction of the contract with nothing other
>than a signature by all parties. Other branches would only be used
>where some participant is failing to cooperate. More strongly stated,
>I believe that _any_ contract with a fixed finite participant set
>upfront can be and should be represented as an OR between an N-of-N
>and whatever more complex contract you might want to represent.
>
>One point that comes up while talking about merkelized scripts is can
>we go about making fancier contract use cases as indistinguishable as
>possible from the most common and boring payments. Otherwise, if the
>anonymity set of fancy usage is only other fancy usage it may not be
>very large in practice. One suggestion has been that ordinary
>checksig-only scripts should include a dummy branch for the rest of
>the tree (e.g. a random value hash), making it look like there are
>potentially alternative rules when there aren't really. The negative
>side of this is an additional 32-byte overhead for the overwhelmingly
>common case which doesn't need it. I think the privacy gains are
>worth doing such a thing, but different people reason differently
>about these trade-offs.
>
>It turns out, however, that there is no need to make a trade-off. The
>special case of a top level "threshold-signature OR
>arbitrary-conditions" can be made indistinguishable from a normal
>one-party signature, with no overhead at all, with a special
>delegating CHECKSIG which I call Taproot.
>
>Let's say we want to create a coin that can be redeemed by either
>Alice && Bob or by CSV-timelock && Bob.
>
>Alice has public A, Bob has pubkey B.
>
>We compute the 2-of-2 aggregate key C = A + B. (Simplified; to
>protect against rogue key attacks you may want to use the MuSig key
>aggregation function [1])
>
>We form our timelock script S = "<timeout> OP_CSV OP_DROP B
>OP_CHECKSIGVERIFY"
>
>Now we tweak C to produce P which is the key we'll publish: P = C +
>H(C||S)G.
>
>(This is the attack hardened pay-to-contract construction described in
>[2])
>
>Then we pay to a scriptPubKey of [Taproot supporting version] [EC point
>P].
>
>Now Alice and Bob-- assuming they are both online and agree about the
>resolution of their contract-- can jointly form a 2 of 2 signature for
>P, and spend as if it were a payment to a single party (one of them
>just needs to add H(C||S) to their private key).
>
>Alternatively, the Taproot consensus rules would allow this script to
>be satisfied by someone who provides the network with C (the original
>combined pubkey), S, and does whatever S requires-- e.g. passes the
>CSV check and provides Bob's signature. With this information the
>network can verify that C + H(C||S) == P.
>
>So in the all-sign case there is zero overhead; and no one can tell
>that the contract alternative exists. In the alternative redemption
>branch the only overhead is revealing the original combined pubkey
>and, of course, the existence of the contract is made public.
>
>This composes just fine with whatever other merkelized script system
>we might care to use, as the S can be whatever kind of data we want,
>including the root of some tree.
>
>My example shows 2-of-2 but it works the same for any number of
>participants (and with setup interaction any threshold of
>participants, so long as you don't mind an inability to tell which
>members signed off).
>
>The verification computational complexity of signature path is
>obviously the same as any other plain signature (since its
>indistinguishable). Verification of the branch redemption requires a
>hash and a multiplication with a constant point which is strictly more
>efficient than a signature verification and could be efficiently fused
>into batch signature validation.
>
>The nearest competitor to this idea that I can come up with would
>supporting a simple delegation where the output can be spent by the
>named key, or a spending transaction could provide a script along with
>a signature of that script by the named key, delegating control to the
>signed script. Before paying into that escrow Alice/Bob would
>construct this signature. This idea is equally efficient in the common
>case, but larger and slower to verify in the alternative spend case.
>Setting up the signature requires additional interaction between
>participants and the resulting signature must be durably stored and
>couldn't just be recomputed using single-party information.
>
>I believe this construction will allow the largest possible anonymity
>set for fixed party smart contracts by making them look like the
>simplest possible payments. It accomplishes this without any overhead
>in the common case, invoking any sketchy or impractical techniques,
>requiring extra rounds of interaction between contract participants,
>and without requiring the durable storage of other data.
>
>
>[1] https://eprint.iacr.org/2018/068
>[2] https://blockstream.com/sidechains.pdf Appendix A
>_______________________________________________
>bitcoin-dev mailing list
>bitcoin-dev at lists.linuxfoundation.org
>https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20180123/2ff10ec6/attachment-0001.html>;
Matt Corallo [ARCHIVE] /
npub1e4…jxmcu
2023-06-07 18:10:06
in reply to nevent1q…mner
Author Public Key
npub1e46n428mcyfwznl7nlsf6d3s7rhlwm9x3cmkuqzt3emmdpadmkaqqjxmcuPublished at
2023-06-07 18:10:06Event JSON
{
"id": "faee4bb3a83c5d8985ecf942fcbc18e9be7135977b0030102da8642829e1e689",
"pubkey": "cd753aa8fbc112e14ffe9fe09d3630f0eff76ca68e376e004b8e77b687adddba",
"created_at": 1686161406,
"kind": 1,
"tags": [
[
"e",
"3098b6cd22aeee78f0db7c45c94594dc578b6094452b2f8e3129789af2cd6fd4",
"",
"root"
],
[
"e",
"6acdf2921f40c255a649934f7bc9e901a6b963834fec003696b2871251e0a311",
"",
"reply"
],
[
"p",
"cd99305dce8f7a8772455d28d44a8451787c19b2ffd2c8b1010acecc3c5f95c7"
]
],
"content": "📅 Original date posted:2018-01-23\n📝 Original message:Thanks Greg!\n\nI'd be hesitant to deploy a MAST proposal without this clever application of pay-to-contract-hash now! Looks like the overhead over a more-naive MAST construction is rather trivial, too!\n\nMatt\n\nOn January 23, 2018 12:30:06 AM UTC, Gregory Maxwell via bitcoin-dev \u003cbitcoin-dev at lists.linuxfoundation.org\u003e wrote:\n\u003eInterest in merkelized scriptPubKeys (e.g. MAST) is driven by two main\n\u003eareas: efficiency and privacy. Efficiency because unexecuted forks of\n\u003ea script can avoid ever hitting the chain, and privacy because hiding\n\u003eunexecuted code leaves scripts indistinguishable to the extent that\n\u003etheir only differences are in the unexecuted parts.\n\u003e\n\u003eAs Mark Friedenbach and others have pointed out before it is almost\n\u003ealways the case that interesting scripts have a logical top level\n\u003ebranch which allows satisfaction of the contract with nothing other\n\u003ethan a signature by all parties. Other branches would only be used\n\u003ewhere some participant is failing to cooperate. More strongly stated,\n\u003eI believe that _any_ contract with a fixed finite participant set\n\u003eupfront can be and should be represented as an OR between an N-of-N\n\u003eand whatever more complex contract you might want to represent.\n\u003e\n\u003eOne point that comes up while talking about merkelized scripts is can\n\u003ewe go about making fancier contract use cases as indistinguishable as\n\u003epossible from the most common and boring payments. Otherwise, if the\n\u003eanonymity set of fancy usage is only other fancy usage it may not be\n\u003every large in practice. One suggestion has been that ordinary\n\u003echecksig-only scripts should include a dummy branch for the rest of\n\u003ethe tree (e.g. a random value hash), making it look like there are\n\u003epotentially alternative rules when there aren't really. The negative\n\u003eside of this is an additional 32-byte overhead for the overwhelmingly\n\u003ecommon case which doesn't need it. I think the privacy gains are\n\u003eworth doing such a thing, but different people reason differently\n\u003eabout these trade-offs.\n\u003e\n\u003eIt turns out, however, that there is no need to make a trade-off. The\n\u003especial case of a top level \"threshold-signature OR\n\u003earbitrary-conditions\" can be made indistinguishable from a normal\n\u003eone-party signature, with no overhead at all, with a special\n\u003edelegating CHECKSIG which I call Taproot.\n\u003e\n\u003eLet's say we want to create a coin that can be redeemed by either\n\u003eAlice \u0026\u0026 Bob or by CSV-timelock \u0026\u0026 Bob.\n\u003e\n\u003eAlice has public A, Bob has pubkey B.\n\u003e\n\u003eWe compute the 2-of-2 aggregate key C = A + B. (Simplified; to\n\u003eprotect against rogue key attacks you may want to use the MuSig key\n\u003eaggregation function [1])\n\u003e\n\u003eWe form our timelock script S = \"\u003ctimeout\u003e OP_CSV OP_DROP B\n\u003eOP_CHECKSIGVERIFY\"\n\u003e\n\u003eNow we tweak C to produce P which is the key we'll publish: P = C +\n\u003eH(C||S)G.\n\u003e\n\u003e(This is the attack hardened pay-to-contract construction described in\n\u003e[2])\n\u003e\n\u003eThen we pay to a scriptPubKey of [Taproot supporting version] [EC point\n\u003eP].\n\u003e\n\u003eNow Alice and Bob-- assuming they are both online and agree about the\n\u003eresolution of their contract-- can jointly form a 2 of 2 signature for\n\u003eP, and spend as if it were a payment to a single party (one of them\n\u003ejust needs to add H(C||S) to their private key).\n\u003e\n\u003eAlternatively, the Taproot consensus rules would allow this script to\n\u003ebe satisfied by someone who provides the network with C (the original\n\u003ecombined pubkey), S, and does whatever S requires-- e.g. passes the\n\u003eCSV check and provides Bob's signature. With this information the\n\u003enetwork can verify that C + H(C||S) == P.\n\u003e\n\u003eSo in the all-sign case there is zero overhead; and no one can tell\n\u003ethat the contract alternative exists. In the alternative redemption\n\u003ebranch the only overhead is revealing the original combined pubkey\n\u003eand, of course, the existence of the contract is made public.\n\u003e\n\u003eThis composes just fine with whatever other merkelized script system\n\u003ewe might care to use, as the S can be whatever kind of data we want,\n\u003eincluding the root of some tree.\n\u003e\n\u003eMy example shows 2-of-2 but it works the same for any number of\n\u003eparticipants (and with setup interaction any threshold of\n\u003eparticipants, so long as you don't mind an inability to tell which\n\u003emembers signed off).\n\u003e\n\u003eThe verification computational complexity of signature path is\n\u003eobviously the same as any other plain signature (since its\n\u003eindistinguishable). Verification of the branch redemption requires a\n\u003ehash and a multiplication with a constant point which is strictly more\n\u003eefficient than a signature verification and could be efficiently fused\n\u003einto batch signature validation.\n\u003e\n\u003eThe nearest competitor to this idea that I can come up with would\n\u003esupporting a simple delegation where the output can be spent by the\n\u003enamed key, or a spending transaction could provide a script along with\n\u003ea signature of that script by the named key, delegating control to the\n\u003esigned script. Before paying into that escrow Alice/Bob would\n\u003econstruct this signature. This idea is equally efficient in the common\n\u003ecase, but larger and slower to verify in the alternative spend case.\n\u003eSetting up the signature requires additional interaction between\n\u003eparticipants and the resulting signature must be durably stored and\n\u003ecouldn't just be recomputed using single-party information.\n\u003e\n\u003eI believe this construction will allow the largest possible anonymity\n\u003eset for fixed party smart contracts by making them look like the\n\u003esimplest possible payments. It accomplishes this without any overhead\n\u003ein the common case, invoking any sketchy or impractical techniques,\n\u003erequiring extra rounds of interaction between contract participants,\n\u003eand without requiring the durable storage of other data.\n\u003e\n\u003e\n\u003e[1] https://eprint.iacr.org/2018/068\n\u003e[2] https://blockstream.com/sidechains.pdf Appendix A\n\u003e_______________________________________________\n\u003ebitcoin-dev mailing list\n\u003ebitcoin-dev at lists.linuxfoundation.org\n\u003ehttps://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20180123/2ff10ec6/attachment-0001.html\u003e",
"sig": "a04fbc8827432c425559556b30fa7854e51b2dff6a82f24a6db0a9b67cb7da2b449a8ed721dfeabc45173a0e41a5a4acf81cbb19b6cb766bedaa25ca88478c41"
}