📅 Original date posted:2019-02-09
📝 Original message:<--- not replying to list as this is off-topic ---->
Hey Alejandro,
thanks for the pointer. Is there a summary of how the opcode you're proposing would look like?
Is pairing crypto strictly necessary or would interactive key aggregation schemes like Bellare-Neven
work as well?
Best,
Jonas
On 2/9/19 10:01 AM, Alejandro Ranchal Pedrosa via bitcoin-dev wrote:
> Hi all,
>>
>> Side note: I was not able to come up with an similar, eltoo-like protocol that works
>> if you can't predict in advance who will become absent.
>>
> An eltoo-like protocol that works (without going on-chain) if you can't predict in advance who will become absent would be a childchain. If the off-chain protocol can continue updating in the abscence
> of other parties, it means that other parties' signatures must not be required when they are not involved in the off-chain state update. If other parties' signatures must not be required, there must
> be a way of having a common verifiable 'last state' to prevent a party to simultaneously 'fork' the state with two different parties, and double-spend. A solution for this is a childchain for Bitcoin.
> An example of this is what is known as a 'Broken Factory' attack [1] (https://bitcoin.stackexchange.com/questions/77434/how-does-channel-factory-act/81005#81005)
>
>> If the expectation is that the unresponsive party returns, fungibility is
>> not reduced due to output tagging because the above scheme can be used
>> off-chain until the original channel can be continued.
>
> I believe that in many cases other parties won't be able to continue until the unresponsive parties go back online. That might be true in particular scenarios, but generally speaking, the party might
> have gone unresponsive during a factory-level update (i.e. off-chain closing and opening of channels), while some parties might have given out their signature for the update without receiving a fully
> signed transaction. In this case they do not even know which channel they have open (the one of the old state that they have fully signed, or the one for the new state that they have given out their
> signature for). This is known as a 'Stale Factory', and can be exploited by an adversary in a 'Stale Factory' attack [1]. Even if they knew which state they are in (i.e. the party went unresponsive
> but not during a factory-level update), some of them might have run out of funds in some of their channels of the factory, and might want to update, while they will not be willing to wait for a party
> to go back online (something for which they also have zero guarantees of).
>
> An eltoo-like protocol that works (allowing going on-chain) if you can't in advance who will become absent, then this is precisely why 'Transaction Fragments' have been suggested. They allow an
> eltoo-like protocol even when one cannot predict in advance who will become absent, or malicious (by publishing invalid states), cause the non-absent parties can unite their fragments and create a
> valid spendable factory-level transaction that effectively kicks out the malicious parties, while leaving the rest of the factory as it was. To the best of my understanding, the eltoo original
> proposal also allows this though.
>
> Best,
>
> Alejandro.
>
> [1]: Scalable Lightning Factories for Bitcoin, https://eprint.iacr.org/2018/918.pdf
>
>
> On 08/02/2019 20:01, Jonas Nick via bitcoin-dev wrote:
>> Output tagging may result in reduced fungibility in multiparty eltoo channels.
>> If one party is unresponsive, the remaining participants want to remove
>> the party from the channel without downtime. This is possible by creating
>> settlement transactions which pay off the unresponsive party and fund a new
>> channel with the remaining participants.
>>
>> When the party becomes unresponsive, the channel is closed by broadcasting the
>> update transaction as usual. As soon as that happens the remaining
>> participants can start to update their new channel. Their update signatures
>> must use SIGHASH_NOINPUT. This is because in eltoo the settlement txid is not
>> final (because update tx is not confirmed and may have to rebind to another
>> output). Therefore, the funding output of the new channel must be NOINPUT
>> tagged. Assuming the remaining parties later settle cooperatively, this loss
>> of fungibility would not have happened without output tagging.
>>
>> funding output update output settlement outputs update output
>> [ A & B & C ] -> ... -> [ (A & B & C & state CLTV) | (As & Bs & Cs) ] -> [ NOINPUT tagged: (A' & B'), -> ...
>> C' ]
>> If the expectation is that the unresponsive party returns, fungibility is
>> not reduced due to output tagging because the above scheme can be used
>> off-chain until the original channel can be continued.
>>
>> Side note: I was not able to come up with an similar, eltoo-like protocol that works
>> if you can't predict in advance who will become absent.
>>
>> On 12/13/18 12:32 PM, Johnson Lau via bitcoin-dev wrote:
>>> NOINPUT is very powerful, but the tradeoff is the risks of signature replay. While the key holders are expected not to reuse key pair, little could be done to stop payers to reuse an address.
>>> Unfortunately, key-pair reuse has been a social and technical norm since the creation of Bitcoin (the first tx made in block 170 reused the previous public key). I don’t see any hope to change this
>>> norm any time soon, if possible at all.
>>>
>>> As the people who are designing the layer-1 protocol, we could always blame the payer and/or payee for their stupidity, just like those people laughed at victims of Ethereum dumb contracts (DAO,
>>> Parity multisig, etc). The existing bitcoin script language is so restrictive. It disallows many useful smart contracts, but at the same time prevented many dumb contracts. After all, “smart” and
>>> “dumb” are non-technical judgement. The DAO contract has always been faithfully executed. It’s dumb only for those invested in the project. For me, it was just a comedy show.
>>>
>>> So NOINPUT brings us more smart contract capacity, and at the same time we are one step closer to dumb contracts. The target is to find a design that exactly enables the smart contracts we want,
>>> while minimising the risks of misuse.
>>>
>>> The risk I am trying to mitigate is a payer mistakenly pay to a previous address with the exactly same amount, and the previous UTXO has been spent using NOINPUT. Accidental double payment is not
>>> uncommon. Even if the payee was honest and willing to refund, the money might have been spent with a replayed NOINPUT signature. Once people lost a significant amount of money this way, payers
>>> (mostly exchanges) may refuse to send money to anything other than P2PKH, native-P2WPKH and native-P2WSH (as the only 3 types without possibility of NOINPUT)
>>>
>>> The proposed solution is that an output must be “tagged” for it to be spendable with NOINPUT, and the “tag” must be made explicitly by the payer. There are 2 possible ways to do the tagging:
>>>
>>> 1. A certain bit in the tx version must be set
>>> 2. A certain bit in the scriptPubKey must be set
>>>
>>> I will analyse the pros and cons later.
>>>
>>> Using eltoo as example. The setup utxo is a simple 2-of-2 multisig, and should not be tagged. This makes it indistinguishable from normal 1-of-1 utxo. The trigger tx, which spends the setup utxo,
>>> should be tagged, so the update txs could spend the trigger utxo with NOINPUT. Similarly, all update txs should be tagged, so they could be spent by other update txs and settlement tx with NOINPUT.
>>> As the final destination, there is no need to tag in the settlement tx.
>>>
>>> In payer’s perspective, tagging means “I believe this address is for one-time-use only” Since we can’t control how other people manage their addresses, we should never do tagging when paying to
>>> other people.
>>>
>>> I mentioned 2 ways of tagging, and they have pros and cons. First of all, tagging in either way should not complicate the eltoo protocol in anyway, nor bring extra block space overhead.
>>>
>>> A clear advantage of tagging with scriptPubKey is we could tag on a per-output basis. However, scriptPubKey tagging is only possible with native-segwit, not P2SH. That means we have to disallow
>>> NOINPUT in P2SH-segwit (Otherwise, *all* P2SH addresses would become “risky” for payers) This should be ok for eltoo, since it has no reason to use P2SH-segwit in intermediate txs, which is more
>>> expensive.
>>>
>>> Another problem with scriptPubKey tagging is all the existing bech32 implementations will not understand the special tag, and will pay to a tagged address as usual. An upgrade would be needed for
>>> them to refuse sending to tagged addresses by default.
>>>
>>> On the other hand, tagging with tx version will also protect P2SH-segwit, and all existing wallets are protected by default. However, it is somewhat a layer violation and you could only tag all or
>>> none output in the same tx. Also, as Bitcoin Core has just removed the tx version from the UTXO database, adding it back could be a little bit annoying, but doable.
>>>
>>> There is an extension to the version tagging, which could make NOINPUT even safer. In addition to tagging requirement, NOINPUT will also sign the version of the previous tx. If the wallet always
>>> uses a randomised tx version, it makes accidental replay very unlikely. However, that will burn a few more bits in the tx version field.
>>>
>>> While this seems fully compatible with eltoo, is there any other proposals require NOINPUT, and is adversely affected by either way of tagging?
>>> _______________________________________________
>>> bitcoin-dev mailing list
>>> bitcoin-dev at lists.linuxfoundation.org
>>> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>>>
>> _______________________________________________
>> bitcoin-dev mailing list
>> bitcoin-dev at lists.linuxfoundation.org
>> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev at lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
Jonas Nick [ARCHIVE] /
npub1at…y3z5a
2023-06-07 18:16:12
in reply to nevent1q…pnc9
Author Public Key
npub1at3pav59gkeqz9kegzqhk2v4j4r435x42ytf23pxs8crt74tuc8s2y3z5aPublished at
2023-06-07 18:16:12Event JSON
{
"id": "3c129130ea365a6acd828470ff89ef98ace9f3f2de164dd7375601116a48d061",
"pubkey": "eae21eb28545b20116d940817b2995954758d0d5511695442681f035faabe60f",
"created_at": 1686161772,
"kind": 1,
"tags": [
[
"e",
"d115c2cf2fc1879f7295a540eec6df49284da7ea0208c40bff09a5bb6df1c817",
"",
"root"
],
[
"e",
"ab709360fa7c080997b10f10f8569d9dc2015a4dd505a895173474f61a676757",
"",
"reply"
],
[
"p",
"f0feda6ad58ea9f486e469f87b3b9996494363a26982b864667c5d8acb0542ab"
]
],
"content": "📅 Original date posted:2019-02-09\n📝 Original message:\u003c--- not replying to list as this is off-topic ----\u003e\n\nHey Alejandro,\n\nthanks for the pointer. Is there a summary of how the opcode you're proposing would look like?\nIs pairing crypto strictly necessary or would interactive key aggregation schemes like Bellare-Neven\nwork as well?\n\nBest,\nJonas\n\nOn 2/9/19 10:01 AM, Alejandro Ranchal Pedrosa via bitcoin-dev wrote:\n\u003e Hi all,\n\u003e\u003e\n\u003e\u003e Side note: I was not able to come up with an similar, eltoo-like protocol that works\n\u003e\u003e if you can't predict in advance who will become absent.\n\u003e\u003e\n\u003e An eltoo-like protocol that works (without going on-chain) if you can't predict in advance who will become absent would be a childchain. If the off-chain protocol can continue updating in the abscence\n\u003e of other parties, it means that other parties' signatures must not be required when they are not involved in the off-chain state update. If other parties' signatures must not be required, there must\n\u003e be a way of having a common verifiable 'last state' to prevent a party to simultaneously 'fork' the state with two different parties, and double-spend. A solution for this is a childchain for Bitcoin.\n\u003e An example of this is what is known as a 'Broken Factory' attack [1] (https://bitcoin.stackexchange.com/questions/77434/how-does-channel-factory-act/81005#81005)\n\u003e \n\u003e\u003e If the expectation is that the unresponsive party returns, fungibility is\n\u003e\u003e not reduced due to output tagging because the above scheme can be used\n\u003e\u003e off-chain until the original channel can be continued.\n\u003e \n\u003e I believe that in many cases other parties won't be able to continue until the unresponsive parties go back online. That might be true in particular scenarios, but generally speaking, the party might\n\u003e have gone unresponsive during a factory-level update (i.e. off-chain closing and opening of channels), while some parties might have given out their signature for the update without receiving a fully\n\u003e signed transaction. In this case they do not even know which channel they have open (the one of the old state that they have fully signed, or the one for the new state that they have given out their\n\u003e signature for). This is known as a 'Stale Factory', and can be exploited by an adversary in a 'Stale Factory' attack [1]. Even if they knew which state they are in (i.e. the party went unresponsive\n\u003e but not during a factory-level update), some of them might have run out of funds in some of their channels of the factory, and might want to update, while they will not be willing to wait for a party\n\u003e to go back online (something for which they also have zero guarantees of).\n\u003e \n\u003e An eltoo-like protocol that works (allowing going on-chain) if you can't in advance who will become absent, then this is precisely why 'Transaction Fragments' have been suggested. They allow an\n\u003e eltoo-like protocol even when one cannot predict in advance who will become absent, or malicious (by publishing invalid states), cause the non-absent parties can unite their fragments and create a\n\u003e valid spendable factory-level transaction that effectively kicks out the malicious parties, while leaving the rest of the factory as it was. To the best of my understanding, the eltoo original\n\u003e proposal also allows this though.\n\u003e \n\u003e Best,\n\u003e \n\u003e Alejandro.\n\u003e \n\u003e [1]: Scalable Lightning Factories for Bitcoin, https://eprint.iacr.org/2018/918.pdf\n\u003e \n\u003e \n\u003e On 08/02/2019 20:01, Jonas Nick via bitcoin-dev wrote:\n\u003e\u003e Output tagging may result in reduced fungibility in multiparty eltoo channels.\n\u003e\u003e If one party is unresponsive, the remaining participants want to remove\n\u003e\u003e the party from the channel without downtime. This is possible by creating\n\u003e\u003e settlement transactions which pay off the unresponsive party and fund a new\n\u003e\u003e channel with the remaining participants.\n\u003e\u003e\n\u003e\u003e When the party becomes unresponsive, the channel is closed by broadcasting the\n\u003e\u003e update transaction as usual. As soon as that happens the remaining\n\u003e\u003e participants can start to update their new channel. Their update signatures\n\u003e\u003e must use SIGHASH_NOINPUT. This is because in eltoo the settlement txid is not\n\u003e\u003e final (because update tx is not confirmed and may have to rebind to another\n\u003e\u003e output). Therefore, the funding output of the new channel must be NOINPUT\n\u003e\u003e tagged. Assuming the remaining parties later settle cooperatively, this loss\n\u003e\u003e of fungibility would not have happened without output tagging.\n\u003e\u003e\n\u003e\u003e funding output update output settlement outputs update output\n\u003e\u003e [ A \u0026 B \u0026 C ] -\u003e ... -\u003e [ (A \u0026 B \u0026 C \u0026 state CLTV) | (As \u0026 Bs \u0026 Cs) ] -\u003e [ NOINPUT tagged: (A' \u0026 B'), -\u003e ...\n\u003e\u003e C' ]\n\u003e\u003e If the expectation is that the unresponsive party returns, fungibility is\n\u003e\u003e not reduced due to output tagging because the above scheme can be used\n\u003e\u003e off-chain until the original channel can be continued.\n\u003e\u003e\n\u003e\u003e Side note: I was not able to come up with an similar, eltoo-like protocol that works\n\u003e\u003e if you can't predict in advance who will become absent.\n\u003e\u003e\n\u003e\u003e On 12/13/18 12:32 PM, Johnson Lau via bitcoin-dev wrote:\n\u003e\u003e\u003e NOINPUT is very powerful, but the tradeoff is the risks of signature replay. While the key holders are expected not to reuse key pair, little could be done to stop payers to reuse an address.\n\u003e\u003e\u003e Unfortunately, key-pair reuse has been a social and technical norm since the creation of Bitcoin (the first tx made in block 170 reused the previous public key). I don’t see any hope to change this\n\u003e\u003e\u003e norm any time soon, if possible at all.\n\u003e\u003e\u003e\n\u003e\u003e\u003e As the people who are designing the layer-1 protocol, we could always blame the payer and/or payee for their stupidity, just like those people laughed at victims of Ethereum dumb contracts (DAO,\n\u003e\u003e\u003e Parity multisig, etc). The existing bitcoin script language is so restrictive. It disallows many useful smart contracts, but at the same time prevented many dumb contracts. After all, “smart” and\n\u003e\u003e\u003e “dumb” are non-technical judgement. The DAO contract has always been faithfully executed. It’s dumb only for those invested in the project. For me, it was just a comedy show.\n\u003e\u003e\u003e\n\u003e\u003e\u003e So NOINPUT brings us more smart contract capacity, and at the same time we are one step closer to dumb contracts. The target is to find a design that exactly enables the smart contracts we want,\n\u003e\u003e\u003e while minimising the risks of misuse.\n\u003e\u003e\u003e\n\u003e\u003e\u003e The risk I am trying to mitigate is a payer mistakenly pay to a previous address with the exactly same amount, and the previous UTXO has been spent using NOINPUT. Accidental double payment is not\n\u003e\u003e\u003e uncommon. Even if the payee was honest and willing to refund, the money might have been spent with a replayed NOINPUT signature. Once people lost a significant amount of money this way, payers\n\u003e\u003e\u003e (mostly exchanges) may refuse to send money to anything other than P2PKH, native-P2WPKH and native-P2WSH (as the only 3 types without possibility of NOINPUT)\n\u003e\u003e\u003e\n\u003e\u003e\u003e The proposed solution is that an output must be “tagged” for it to be spendable with NOINPUT, and the “tag” must be made explicitly by the payer. There are 2 possible ways to do the tagging:\n\u003e\u003e\u003e\n\u003e\u003e\u003e 1. A certain bit in the tx version must be set\n\u003e\u003e\u003e 2. A certain bit in the scriptPubKey must be set\n\u003e\u003e\u003e\n\u003e\u003e\u003e I will analyse the pros and cons later.\n\u003e\u003e\u003e\n\u003e\u003e\u003e Using eltoo as example. The setup utxo is a simple 2-of-2 multisig, and should not be tagged. This makes it indistinguishable from normal 1-of-1 utxo. The trigger tx, which spends the setup utxo,\n\u003e\u003e\u003e should be tagged, so the update txs could spend the trigger utxo with NOINPUT. Similarly, all update txs should be tagged, so they could be spent by other update txs and settlement tx with NOINPUT.\n\u003e\u003e\u003e As the final destination, there is no need to tag in the settlement tx.\n\u003e\u003e\u003e\n\u003e\u003e\u003e In payer’s perspective, tagging means “I believe this address is for one-time-use only” Since we can’t control how other people manage their addresses, we should never do tagging when paying to\n\u003e\u003e\u003e other people.\n\u003e\u003e\u003e\n\u003e\u003e\u003e I mentioned 2 ways of tagging, and they have pros and cons. First of all, tagging in either way should not complicate the eltoo protocol in anyway, nor bring extra block space overhead.\n\u003e\u003e\u003e\n\u003e\u003e\u003e A clear advantage of tagging with scriptPubKey is we could tag on a per-output basis. However, scriptPubKey tagging is only possible with native-segwit, not P2SH. That means we have to disallow\n\u003e\u003e\u003e NOINPUT in P2SH-segwit (Otherwise, *all* P2SH addresses would become “risky” for payers) This should be ok for eltoo, since it has no reason to use P2SH-segwit in intermediate txs, which is more\n\u003e\u003e\u003e expensive.\n\u003e\u003e\u003e\n\u003e\u003e\u003e Another problem with scriptPubKey tagging is all the existing bech32 implementations will not understand the special tag, and will pay to a tagged address as usual. An upgrade would be needed for\n\u003e\u003e\u003e them to refuse sending to tagged addresses by default.\n\u003e\u003e\u003e\n\u003e\u003e\u003e On the other hand, tagging with tx version will also protect P2SH-segwit, and all existing wallets are protected by default. However, it is somewhat a layer violation and you could only tag all or\n\u003e\u003e\u003e none output in the same tx. Also, as Bitcoin Core has just removed the tx version from the UTXO database, adding it back could be a little bit annoying, but doable.\n\u003e\u003e\u003e\n\u003e\u003e\u003e There is an extension to the version tagging, which could make NOINPUT even safer. In addition to tagging requirement, NOINPUT will also sign the version of the previous tx. If the wallet always\n\u003e\u003e\u003e uses a randomised tx version, it makes accidental replay very unlikely. However, that will burn a few more bits in the tx version field.\n\u003e\u003e\u003e\n\u003e\u003e\u003e While this seems fully compatible with eltoo, is there any other proposals require NOINPUT, and is adversely affected by either way of tagging?\n\u003e\u003e\u003e _______________________________________________\n\u003e\u003e\u003e bitcoin-dev mailing list\n\u003e\u003e\u003e bitcoin-dev at lists.linuxfoundation.org\n\u003e\u003e\u003e https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev\n\u003e\u003e\u003e\n\u003e\u003e _______________________________________________\n\u003e\u003e bitcoin-dev mailing list\n\u003e\u003e bitcoin-dev at lists.linuxfoundation.org\n\u003e\u003e https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev\n\u003e _______________________________________________\n\u003e bitcoin-dev mailing list\n\u003e bitcoin-dev at lists.linuxfoundation.org\n\u003e https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev",
"sig": "10453d1f4266602d06b787138068d7f3a4be5748ad2f2c399094a525107a7cd6b2b6f5652064cd7d8f7796579ccde2782f404fb99100c3d9117a64ba6cd75982"
}