📅 Original date posted:2019-07-28
📝 Original message:Hi David,
Aquiring coin age is hard not only for an attacker but for any user that
happened to move his funds lately.
Even if coin age is available, proofs of using it to fund a particular operation
are not sybill resistant. Only a centralized service would know for sure that
proof is only used once and such centralization would defeat the purpose.
In contrast time locking such that it is uniquely linked with the operation
is always possible as funds could also be rented to lock in a decentralized manner.
Regards,
Tamas Blummer
> On Jul 27, 2019, at 21:34, David A. Harding via bitcoin-dev <bitcoin-dev at lists.linuxfoundation.org> wrote:
>
> On Thu, Jul 25, 2019 at 12:47:54PM +0100, Chris Belcher via bitcoin-dev wrote:
>> A way to create a fidelity bond is to burn an amount of bitcoins by
>> sending to a OP_RETURN output. Another kind is time-locked addresses
>> created using OP_CHECKLOCKTIMEVERIFY where the valuable thing being
>> sacrificed is time rather than money, but the two are related because of
>> the time-value-of-money.
>
> Timelocking bitcoins, especially for long periods, carries some special
> risks in Bitcoin:
>
> 1. Inability to sell fork coins, also creating an inability to influence
> the price signals that help determine the outcome of chainsplits.
>
> 2. Possible inability to transition to new security mechanisms if
> a major weakness is discovered in ECC or a hash function.
>
> An alternative to timelocks might be coin age---the value of a UTXO
> multiplied by the time since that UTXO was confirmed. Coin age may be
> even harder for an attacker to acquire given that it is a measure of
> past patience rather than future sacrifice. It also doesn't require
> using any particular script and so is flexible no matter what policy the
> coin owner wants to use (especially if proof-of-funds signatures are
> generated using something like BIP322).
>
> Any full node (archival or pruned) can verify coin age using the UTXO
> set.[1] Unlike script-based timelock (CLTV or CSV), there is no current
> SPV-level secure way to prove to lite clients that an output is still
> unspent, however such verification may be possible within each lite
> client's own security model related to transaction withholding attacks:
>
> - Electrum-style clients can poll their server to see if a particular
> UTXO is unspent.
>
> - BIP158 users who have saved their past filters to disk can use them to
> determine which blocks subsequent to the one including the UTXO may
> contain a spend from it. However, since a UTXO can be spent in the
> same block, they'd always need to download the block containing the
> UTXO (alternatively, the script could contain a 1-block CSV delay
> ensuring any spend occurred in a later block). If BIP158 filters
> become committed at some point, this mechanism is upgraded to SPV-level
> security.
>
>> Note that a long-term holder (or hodler) of bitcoins can buy time-locked
>> fidelity bonds essentially for free, assuming they never intended to
>> transact with their coins much anyway.
>
> This is the thing I most like about the proposal. I suspect most
> honest makers are likely to have only a small portion of their funds
> under JoinMarket control, with the rest sitting idle in a cold wallet.
> Giving makers a way to communicate that they fit that user template
> would indeed seem to provide significant sybil resistance.
>
> -Dave
>
> [1] See, bitcoin-cli help gettxout
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev at lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: Message signed with OpenPGP
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20190728/496e9d8c/attachment-0001.sig>;
Tamas Blummer [ARCHIVE] /
npub1cc…ex8m8
2023-06-07 18:19:44
in reply to nevent1q…mj7m
Author Public Key
npub1ccegg9n9lnx6huppxg43m95488yur7pfemkn3pz0agjws5ffvtts0ex8m8Published at
2023-06-07 18:19:44Event JSON
{
"id": "705c6bd9450fee25b4278d1bc34660cbf1e1b712fbdb6c02009bf3b2e163315e",
"pubkey": "c632841665fccdabf021322b1d969539c9c1f829ceed38844fea24e8512962d7",
"created_at": 1686161984,
"kind": 1,
"tags": [
[
"e",
"e5951fd065af963dd1caf477c2dc7ac75e75b8c5de9df2bf7554616176c13878",
"",
"root"
],
[
"e",
"20ffd240a86e98ba0a43c1fe69f9f75ce9fef6d422e2cabae9cde6566d75fae9",
"",
"reply"
],
[
"p",
"d3574a24208f4e3d0821bb4a69a0c3ae842043d444fa5c4a8c49c369918a6fb2"
]
],
"content": "📅 Original date posted:2019-07-28\n📝 Original message:Hi David,\n\nAquiring coin age is hard not only for an attacker but for any user that\nhappened to move his funds lately.\n\nEven if coin age is available, proofs of using it to fund a particular operation\nare not sybill resistant. Only a centralized service would know for sure that\nproof is only used once and such centralization would defeat the purpose.\n\nIn contrast time locking such that it is uniquely linked with the operation\nis always possible as funds could also be rented to lock in a decentralized manner.\n\nRegards,\n\nTamas Blummer\n\n\u003e On Jul 27, 2019, at 21:34, David A. Harding via bitcoin-dev \u003cbitcoin-dev at lists.linuxfoundation.org\u003e wrote:\n\u003e \n\u003e On Thu, Jul 25, 2019 at 12:47:54PM +0100, Chris Belcher via bitcoin-dev wrote:\n\u003e\u003e A way to create a fidelity bond is to burn an amount of bitcoins by\n\u003e\u003e sending to a OP_RETURN output. Another kind is time-locked addresses\n\u003e\u003e created using OP_CHECKLOCKTIMEVERIFY where the valuable thing being\n\u003e\u003e sacrificed is time rather than money, but the two are related because of\n\u003e\u003e the time-value-of-money.\n\u003e \n\u003e Timelocking bitcoins, especially for long periods, carries some special\n\u003e risks in Bitcoin:\n\u003e \n\u003e 1. Inability to sell fork coins, also creating an inability to influence\n\u003e the price signals that help determine the outcome of chainsplits.\n\u003e \n\u003e 2. Possible inability to transition to new security mechanisms if\n\u003e a major weakness is discovered in ECC or a hash function.\n\u003e \n\u003e An alternative to timelocks might be coin age---the value of a UTXO\n\u003e multiplied by the time since that UTXO was confirmed. Coin age may be\n\u003e even harder for an attacker to acquire given that it is a measure of\n\u003e past patience rather than future sacrifice. It also doesn't require\n\u003e using any particular script and so is flexible no matter what policy the\n\u003e coin owner wants to use (especially if proof-of-funds signatures are\n\u003e generated using something like BIP322).\n\u003e \n\u003e Any full node (archival or pruned) can verify coin age using the UTXO\n\u003e set.[1] Unlike script-based timelock (CLTV or CSV), there is no current\n\u003e SPV-level secure way to prove to lite clients that an output is still\n\u003e unspent, however such verification may be possible within each lite\n\u003e client's own security model related to transaction withholding attacks:\n\u003e \n\u003e - Electrum-style clients can poll their server to see if a particular\n\u003e UTXO is unspent.\n\u003e \n\u003e - BIP158 users who have saved their past filters to disk can use them to\n\u003e determine which blocks subsequent to the one including the UTXO may\n\u003e contain a spend from it. However, since a UTXO can be spent in the\n\u003e same block, they'd always need to download the block containing the\n\u003e UTXO (alternatively, the script could contain a 1-block CSV delay\n\u003e ensuring any spend occurred in a later block). If BIP158 filters\n\u003e become committed at some point, this mechanism is upgraded to SPV-level\n\u003e security.\n\u003e \n\u003e\u003e Note that a long-term holder (or hodler) of bitcoins can buy time-locked\n\u003e\u003e fidelity bonds essentially for free, assuming they never intended to\n\u003e\u003e transact with their coins much anyway.\n\u003e \n\u003e This is the thing I most like about the proposal. I suspect most\n\u003e honest makers are likely to have only a small portion of their funds\n\u003e under JoinMarket control, with the rest sitting idle in a cold wallet.\n\u003e Giving makers a way to communicate that they fit that user template\n\u003e would indeed seem to provide significant sybil resistance.\n\u003e \n\u003e -Dave\n\u003e \n\u003e [1] See, bitcoin-cli help gettxout\n\u003e _______________________________________________\n\u003e bitcoin-dev mailing list\n\u003e bitcoin-dev at lists.linuxfoundation.org\n\u003e https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev\n\n-------------- next part --------------\nA non-text attachment was scrubbed...\nName: signature.asc\nType: application/pgp-signature\nSize: 488 bytes\nDesc: Message signed with OpenPGP\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20190728/496e9d8c/attachment-0001.sig\u003e",
"sig": "42693d35a74fe5cce06f1f04d8eacb087bd29dae2f706bfa8244bf8582d8962b54a36f33d96f0724672c07737df9c1a3769fcbb00e969368b4b66c197bd2f728"
}