📅 Original date posted:2018-03-14
📝 Original message:Thank you.
I can't really see from your proposal if you had thought of this: A soft
fork can make old nodes accept invalid message signatures as valid. For
example, a "signer" can use a witness version unknown to the verifier to
fool the verifier. Witness version is detectable (just reject unknown
witness versions) but there may be more subtle changes. Segwit was not
"detectable" in that way, for example.
This is the reason why I withdrew BIP120. If you have thought about the
above, I'd be very interested.
/Kalle
Sent from my Sinclair ZX81
Den 14 mars 2018 16:10 skrev "Karl Johan Alm via bitcoin-dev" <
bitcoin-dev at lists.linuxfoundation.org>:
Hello,
I am considering writing a replacement for the message signing tools
that are currently broken for all but the legacy 1xx addresses. The
approach (suggested by Pieter Wuille) is to do a script based
approach. This does not seem to require a lot of effort for
implementing in Bitcoin Core*. Below is my proposal for this system:
A new structure SignatureProof is added, which is a simple scriptSig &
witnessProgram container that can be serialized. This is passed out
from/into the signer/verifier.
RPC commands:
sign <address> <message> [<prehashed>=false]
Generates a signature proof for <message> using the same method that
would be used to spend coins sent to <address>.**
verify <address> <message> <proof> [<prehashed>=false]
Deserializes and executes the proof using a custom signature checker
whose sighash is derived from <message>. Returns true if the check
succeeds, and false otherwise. The scriptPubKey is derived directly
from <address>.**
Feedback welcome.
-Kalle.
(*) Looks like you can simply use VerifyScript with a new signature
checker class. (h/t Nicolas Dorier)
(**) If <prehashed> is true, <message> is the sighash, otherwise
sighash=sha256d(message).
_______________________________________________
bitcoin-dev mailing list
bitcoin-dev at lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20180314/a857358a/attachment.html>;
Kalle Rosenbaum [ARCHIVE] /
npub1uw…55zf7
2023-06-07 18:11:12
in reply to nevent1q…x6jn
Author Public Key
npub1uwweecasakwtk96j3vjmkjenhnhyv4rku382txq0kmexjwuh4w2st55zf7Published at
2023-06-07 18:11:12Event JSON
{
"id": "658cca8111e361bba60ebfe6be0606048499035d47e935b09a5a10c1d5c398b8",
"pubkey": "e39d9ce3b0ed9cbb17528b25bb4b33bcee465476e44ea5980fb6f2693b97ab95",
"created_at": 1686161472,
"kind": 1,
"tags": [
[
"e",
"fde6d8b8cd384fa838810364bd9a6edd18aea9246ae8127a644187087642ae18",
"",
"root"
],
[
"e",
"e5d1f6f4b41513103c043311381f3466c8626d6817e10809f382f72ea2d9e1fe",
"",
"reply"
],
[
"p",
"cf98d015f410ea690e93370543fcb2c3129303ca3921fd6d463206f557722518"
]
],
"content": "📅 Original date posted:2018-03-14\n📝 Original message:Thank you.\n\nI can't really see from your proposal if you had thought of this: A soft\nfork can make old nodes accept invalid message signatures as valid. For\nexample, a \"signer\" can use a witness version unknown to the verifier to\nfool the verifier. Witness version is detectable (just reject unknown\nwitness versions) but there may be more subtle changes. Segwit was not\n\"detectable\" in that way, for example.\n\nThis is the reason why I withdrew BIP120. If you have thought about the\nabove, I'd be very interested.\n\n/Kalle\n\nSent from my Sinclair ZX81\n\nDen 14 mars 2018 16:10 skrev \"Karl Johan Alm via bitcoin-dev\" \u003c\nbitcoin-dev at lists.linuxfoundation.org\u003e:\n\nHello,\n\nI am considering writing a replacement for the message signing tools\nthat are currently broken for all but the legacy 1xx addresses. The\napproach (suggested by Pieter Wuille) is to do a script based\napproach. This does not seem to require a lot of effort for\nimplementing in Bitcoin Core*. Below is my proposal for this system:\n\nA new structure SignatureProof is added, which is a simple scriptSig \u0026\nwitnessProgram container that can be serialized. This is passed out\nfrom/into the signer/verifier.\n\nRPC commands:\n\nsign \u003caddress\u003e \u003cmessage\u003e [\u003cprehashed\u003e=false]\n\nGenerates a signature proof for \u003cmessage\u003e using the same method that\nwould be used to spend coins sent to \u003caddress\u003e.**\n\nverify \u003caddress\u003e \u003cmessage\u003e \u003cproof\u003e [\u003cprehashed\u003e=false]\n\nDeserializes and executes the proof using a custom signature checker\nwhose sighash is derived from \u003cmessage\u003e. Returns true if the check\nsucceeds, and false otherwise. The scriptPubKey is derived directly\nfrom \u003caddress\u003e.**\n\nFeedback welcome.\n\n-Kalle.\n\n(*) Looks like you can simply use VerifyScript with a new signature\nchecker class. (h/t Nicolas Dorier)\n(**) If \u003cprehashed\u003e is true, \u003cmessage\u003e is the sighash, otherwise\nsighash=sha256d(message).\n_______________________________________________\nbitcoin-dev mailing list\nbitcoin-dev at lists.linuxfoundation.org\nhttps://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20180314/a857358a/attachment.html\u003e",
"sig": "8489d61accc333765b47e6a46a318f599bf6920e0d4f5119db34a659871f549e3f3561d080b9ecaf87badc74910fb4959cc41dde7371c37763a4c3bb8976f5bf"
}