ð
Original date posted:2016-08-17
ð Original message:On Wed, Aug 17, 2016 at 9:19 PM, Gregory Maxwell <gmaxwell at gmail.com> wrote:
> On Thu, Aug 18, 2016 at 12:11 AM, Sergio Demian Lerner via bitcoin-dev
> <bitcoin-dev at lists.linuxfoundation.org> wrote:
> > I think that we're not attacking the real source of the problem: that the
> > witness data size is not signed.
>
> It's not possible to do that for the general case, since you may not
> even know the witness size in advance (even for checksig's ECDSA, the
> encoding is variable sized).
>
> That's why scripts can check a maximum witness size, and not necessarily
an exact value.
I think that is overly focusing on "someone might change the feerate",
> yes that is an example of an undesirable witness tampering, but it's
> not the only one.
>
> I don't think fees are the problem. There is another problem. Let me
re-explain.
If I send a transaction to an IoT device (say to an OpenDime or to the old
Firmcoin), and the OpenDime must verify that the transaction has been mined
(SPV verification), then it may expect the witness program to be of certain
maximum size (an implementation-imposed limit). If a Miner modifies the
witness size and makes it too large, then the device may not be able to
accept the transaction and the bitcoins may be lost. Lost because the
private key is in the device, and because the device cannot accept that
cloned transaction, never ever.
The same is true (although less strict) for side-chains and drive-chains:
they may have certain restrictions on the size of transactions they accept
to lock bitcoins.
That's why I'm proposing that a transaction becomes INVALID if the witness
size is higher than the expected size (by the sender).
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20160817/8a7bc92b/attachment.html>;
Sergio Demian Lerner [ARCHIVE] /
npub1fvâŠ3vq7f
2023-06-07 17:52:59
in reply to nevent1qâŠ9x6f
Author Public Key
npub1fvuxqdqg7klqqgy3yy8gdxjv4phu92sll5y8zqm2qe5qdrhxymhqf3vq7fPublished at
2023-06-07 17:52:59Event JSON
{
"id": "9b0cb752b5f8c9756cffad5c51b361cf207516f57452bcb90b283b0f83bfb0a8",
"pubkey": "4b38603408f5be002091210e869a4ca86fc2aa1ffd0871036a0668068ee626ee",
"created_at": 1686160379,
"kind": 1,
"tags": [
[
"e",
"9284d48ee3ec0986e743af41281b218e681b340835d80de299ea9e9d68940884",
"",
"root"
],
[
"e",
"b0b4ac95810847f1994e711f6ef8fb99b84dd47df717eaf5c1b65ef9a1f02e42",
"",
"reply"
],
[
"p",
"4b38603408f5be002091210e869a4ca86fc2aa1ffd0871036a0668068ee626ee"
]
],
"content": "ð
Original date posted:2016-08-17\nð Original message:On Wed, Aug 17, 2016 at 9:19 PM, Gregory Maxwell \u003cgmaxwell at gmail.com\u003e wrote:\n\n\u003e On Thu, Aug 18, 2016 at 12:11 AM, Sergio Demian Lerner via bitcoin-dev\n\u003e \u003cbitcoin-dev at lists.linuxfoundation.org\u003e wrote:\n\u003e \u003e I think that we're not attacking the real source of the problem: that the\n\u003e \u003e witness data size is not signed.\n\u003e\n\u003e It's not possible to do that for the general case, since you may not\n\u003e even know the witness size in advance (even for checksig's ECDSA, the\n\u003e encoding is variable sized).\n\u003e\n\u003e That's why scripts can check a maximum witness size, and not necessarily\nan exact value.\n\n\nI think that is overly focusing on \"someone might change the feerate\",\n\u003e yes that is an example of an undesirable witness tampering, but it's\n\u003e not the only one.\n\u003e\n\u003e I don't think fees are the problem. There is another problem. Let me\nre-explain.\nIf I send a transaction to an IoT device (say to an OpenDime or to the old\nFirmcoin), and the OpenDime must verify that the transaction has been mined\n(SPV verification), then it may expect the witness program to be of certain\nmaximum size (an implementation-imposed limit). If a Miner modifies the\nwitness size and makes it too large, then the device may not be able to\naccept the transaction and the bitcoins may be lost. Lost because the\nprivate key is in the device, and because the device cannot accept that\ncloned transaction, never ever.\n\nThe same is true (although less strict) for side-chains and drive-chains:\nthey may have certain restrictions on the size of transactions they accept\nto lock bitcoins.\n\nThat's why I'm proposing that a transaction becomes INVALID if the witness\nsize is higher than the expected size (by the sender).\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20160817/8a7bc92b/attachment.html\u003e",
"sig": "ee71165c81b50c4dacc8451faad7c7444ad826106f3bd55ce8befbad3c44e28d25fb73c3ef7f846676b6e120c4a62b2536d1fdac26c0dd9f2e6c0cee87832fbb"
}