Karl-Johan Alm [ARCHIVE] / is on Nostr

⚠️ This account is not associated with a real person. It's an archival account for mailing list messages.
🗓️ Active from 2018-04-10 to 2021-09-15
💬 Posted a total of 32 messages
📚 Participated in the following categories: bitcoin-dev
🔇 Please do not DM this user as it's used for archive purposes only.

Last Notes

2023-06-07 18:30:52

- reply

📅 Original date posted:2021-03-15
📝 Original message:On Tue, 16 Mar 2021 at 07:48, Matt Corallo via bitcoin-dev
<bitcoin-dev at lists.linuxfoundation.org> wrote:
>
> Overall, the tradeoffs here seem ludicrous, given that any QC issues in Bitcoin need to be solved in another way, and
> can't practically be solved by just relying on the existing hash indirection.
The important distinction here is that, with hashes, an attacker has
to race against the spending transaction confirming, whereas with
naked pubkeys, the attacker doesn't have to wait for a spend to occur,
drastically increasing the available time to attack.
It may initially take months to break a single key. In such a
scenario, anyone with a hashed pubkey would be completely safe* (even
at spend time), until that speeds up significantly, while Super Secure
Exchange X with an ultra-cold 38-of-38 multisig setup using Taproot
would have a timer ticking, since the attacker need only find a single
privkey like with any old P2PK output.
(* assuming no address reuse)

2023-06-07 18:27:51

- reply

📅 Original date posted:2020-12-21
📝 Original message:Thanks a lot for taking the time to brush up the BIP. For what it's
worth, I am all for these changes, and I see them as clear
improvements all around.
IIRC Pieter was the one who originally suggested the two-checks
approach (invalid, inconclusive, valid) which is being modified here,
so would be good if you chimed in (or not -- which I'll assume means
you don't mind).
On Sat, Dec 19, 2020 at 12:27 AM Andrew Poelstra via bitcoin-dev
<bitcoin-dev at lists.linuxfoundation.org> wrote:
>
> I have gone over BIP-0322 and substantially rewritten the text.
> Everything I did is (I think) simply clarifying the existing
> protocol, which felt like it was written by committee and wasn't
> easy to follow, EXCEPT:
>
> 1. I rewrote the motivation section, which I believe originally
> was a paraphrase of Luke-jr's general objections to having any
> signmessage functionality. I hope Luke in particular can take
> a look at what I wrote under "Motivation" and see if it
> captures his concerns.
>
> 2. I merged the "consensus" and "upgradeable" rules to simply be
> one set of rules, consisting of consensus checks plus additional
> restrictions, all of which must be included. The new "Extensions"
> section allows validators to output the state "consensus-valid"
> if they really don't want to check the additional restrictions.
>
> 3. The "inconclusive" state, which was originally used for what I've
> called "consensus-valid", now indicates that a validator does not
> understand the script that it is checking (also described in the
> new "Extensions" section). The goal is that implementors are able
> to be meaningfully BIP-0322 while only supporting a subset of
> Script, e.g. the templates that their own software supports, or
> Miniscript, or the non-raw non-address set of output descriptors,
> or whatever.
>
> We have seen opposition to supporting BIP-322, e.g. [1] because
> of the requirement that you either have a full script interpreter
> (plus an open-ended list of Core's standardness flags, which is
> not even available through libbitcoinconsensus) or nothing. On
> the other hand, the vast majority of outputs are single-key p2pkh,
> p2pkwh or p2sh-wpkh.
>
> The new text is here (and for posterity I will also include it
> inline below, though unless Github deletes it it will be easier
> to read in rendered form):
>
> https://github.com/apoelstra/bips/blob/2020-12--bip322-overhaul/bip-0322.mediawiki
>
> I'll also PR this to the BIPs repo in the next day or two, and
> comments on Github are then welcome.
>
>
> [1] https://bitcointalk.org/index.php?topic=5261605.0
>
>
>
> * * * * * Full text of the above link * * * * *
>
> <pre>
> BIP: 322
> Layer: Applications
> Title: Generic Signed Message Format
> Author: Karl-Johan Alm <karljohan-alm at garage.co.jp>
> Comments-Summary: No comments yet.
> Comments-URI: https://github.com/bitcoin/bips/wiki/Comments:BIP-0322
> Status: Draft
> Type: Standards Track
> Created: 2018-09-10
> License: CC0-1.0
> </pre>
>
> == Abstract ==
>
> A standard for interoperable signed messages based on the Bitcoin Script format, either for proving fund availability, or committing to a message as the intended recipient of funds sent to the invoice address.
>
> == Motivation ==
>
> The current message signing standard only works for P2PKH (1...) invoice addresses. We propose to extend and generalize the standard by using a Bitcoin Script based approach. This ensures that any coins, no matter what script they are controlled by, can in-principle be signed for. For easy interoperability with existing signing hardware, we also define a signature message format which resembles a Bitcoin transaction (except that it contains an invalid input, so it cannot be spent on any real network).
>
> Additionally, the current message signature format uses ECDSA signatures which do not commit to the public key, meaning that they do not actually prove knowledge of any secret keys. (Indeed, valid signatures can be tweaked by 3rd parties to become valid signatures on certain related keys.)
>
> Ultimately no message signing protocol can actually prove control of funds, both because a signature is obsolete as soon as it is created, and because the possessor of a secret key may be willing to sign messages on others' behalf even if it would not sign actual transactions. No signmessage protocol can fix these limitations.
>
> == Types of Signatures ==
>
> This BIP specifies three formats for signing messages: ''legacy'', ''simple'' and ''full''. Additionally, a variant of the ''full'' format can be used to demonstrate control over a set of UTXOs.
>
> === Legacy ===
>
> New proofs should use the new format for all invoice address formats, including P2PKH.
>
> The legacy format MAY be used, but must be restricted to the legacy P2PKH invoice address format.
>
> === Simple ===
>
> A ''simple'' signature consists of a witness stack, consensus encoded as a vector of vectors of bytes, and base64-encoded. Validators should construct <code>to_spend</code> and <code>to_sign</code> as defined below, with default values for all fields except that
>
> * <code>message_hash</code> is a BIP340-tagged hash of the message, as specified below
> * <code>message_challenge</code> in <code>to_spend</code> is set to the scriptPubKey being signed with
> * <code>message_signature</code> in <code>to_sign</code> is set to the provided simple signature.
>
> and then proceed as they would for a full signature.
>
> === Full ===
>
> Full signatures follow an analogous specification to the BIP-325 challenges and solutions used by Signet.
>
> Let there be two virtual transactions to_spend and to_sign.
>
> The "to_spend" transaction is:
>
> nVersion = 0
> nLockTime = 0
> vin[0].prevout.hash = 0000...000
> vin[0].prevout.n = 0xFFFFFFFF
> vin[0].nSequence = 0
> vin[0].scriptSig = OP_0 PUSH32[ message_hash ]
> vin[0].scriptWitness = []
> vout[0].nValue = 0
> vout[0].scriptPubKey = message_challenge
>
> where <code>message_hash</code> is a BIP340-tagged hash of the message, i.e. sha256_tag(m), where tag = <code>BIP0322-signed-message</code>, and <code>message_challenge</code> is the to be proven (public) key script.
>
> The "to_sign" transaction is:
>
> nVersion = 0 or as appropriate (e.g. 2, for time locks)
> nLockTime = 0 or as appropriate (for time locks)
> vin[0].prevout.hash = to_spend.txid
> vin[0].prevout.n = 0
> vin[0].nSequence = 0 or as appropriate (for time locks)
> vin[0].scriptWitness = message_signature
> vout[0].nValue = 0
> vout[0].scriptPubKey = OP_RETURN
>
> A full signature consists of the base64-encoding of the to_spend and to_sign transactions concatenated in standard network serialisation.
>
> === Full (Proof of Funds) ===
>
> A signer may construct a proof of funds, demonstrating control of a set of UTXOs, by constructing a full signature as above, with the following modifications.
>
> * <code>message_challenge</code> is unused and shall be set to <code>OP_TRUE</code>
> * Similarly, <code>message_signature</code> is then empty.
> * All outputs that the signer wishes to demonstrate control of are included as additional outputs to <code>to_sign</code>, and their witness and scriptSig data should be set as though these outputs were actually being spent.
>
> Unlike an ordinary signature, validators of a proof of funds need access to the current UTXO set, to learn that the claimed inputs exist on the blockchain, and to learn their scriptPubKeys.
>
> == Detailed Specification ==
>
> For all signature types, except legacy, the <code>to_spend</code> and <code>to_sign</code> transactions must be valid transactions which pass all consensus checks, except of course that the output with prevout <code>000...000:FFFFFFFF</code> does not exist.
>
> We additionally require the following restrictions be met.
>
> * All signatures must use the SIGHASH_ALL flag.
> * The use of <code>CODESEPARATOR</code> or <code>FindAndDelete</code> is forbidden.
> * The use of NOPs reserved for upgrades is forbidden.
> * The use of segwit versions greater than 1 are forbidden.
> * <code>LOW_S</code>, <code>STRICTENC</code> and <code>NULLFAIL</code>: valid ECDSA signatures must be strictly DER-encoded and have a low-S value; invalid ECDSA signature must be the empty push
> * <code>MINIMALDATA</code>: all pushes must be minimally encoded
> * <code>CLEANSTACK</code>: require that only a single stack element remains after evaluation
> * <code>MINIMALIF</code>: the argument of <code>IF</code>/<code>NOTIF</code> must be exactly 0x01 or empty push
>
> Future versions of this BIP may relax these rules, in particular those around NOPs and future Segwit versions, as they are deployed on Bitcoin.
>
> === Verification ===
>
> Validation consists of the following steps. A validator is given as input an address ''A'' (which may be omitted in a proof-of-funds), signature ''s'' and message ''m'', and outputs one of four states (although validators are only required to be able to output the first and last):
> * ''valid'' indicates that the signature passed all checks described below
> * ''valid at time t and age s'' indicates that the signature has set timelocks but is otherwise valid (see "Extensions" below)
> * ''consensus-valid'' indicates that the signature passed validation except for the additonal restrictions in the above section (see "Extensions" below)
> * ''inconclusive'' means the validator was unable to check the scripts (see "Extensions" below)
> * ''invalid'' means none of the other states
>
> # Decode ''s'' as the transactions <code>to_sign</code> and <code>to_spend</code>
> # Confirm that <code>message_hash</code> is the correct hash of ''m''
> # Confirm that <code>message_challenge</code> is the scriptPubKey corresponding to ''A'' if ''A'' is present, and otherwise must be <code>OP_TRUE</code>
> # Confirm that all other fields are set as specified above; in particular that
> ** <code>to_spend</code> has exactly one input and one output
> ** <code>to_sign</code> has at least one input and its first input spends the output of </code>to_spend</code>
> ** <code>to_sign</code> has exactly one output, as specified above
> # Confirm that the two transactions together satisfy all consensus rules, except for <code>to_spend</code>'s missing input, and except that ''nSequence'' of <code>to_sign</code>'s first input and ''nLockTime'' of <code>to_sign</code> are not checked.
> # Confirm that all of the above restrictions are met.
>
> If the above conditions are met, the signature is considered ''valid''. Otherwise the signature is ''invalid''.
>
> === Signing ===
>
> Signers who control an address ''A'' who wish to sign a message ''m'' act as follows:
>
> # They construct <code>to_spend</code> and <code>to_sign</code> as specified above, using the scriptPubKey of ''A'' for <code>message_challenge</code> and tagged hash of ''m'' as <code>message_hash</code>.
> # Optionally, they may set nLockTime of <code>to_sign</code> or nSequence of its first input.
> # Optionally, they may add any additional outputs to <code>to_sign</code> that they wish to prove control of.
> # They satisfy <code>to_sign</code> as they would any other transaction.
>
> They then encode their signature, choosing either ''simple'' or ''full'' as follows:
>
> * If they added no inputs to <code>to_sign</code>, left nSequence and nLockTime at 0, and ''A'' is a Segwit address (either pure or P2SH-wrapped), then they may base64-encode <code>message_signature</code>
> * Otherwise they must base64-encode the concatenation of <code>to_spend</code> followed by <code>to_sign</code>.
>
> == Extensions ==
>
> To ease implementation, we allow some additional states to be output rather than ''valid'' or ''invalid''. Users who do not understand or who do not wish to deal with these states may treat them as ''invalid''.
>
> === Timelocks ===
>
> If the nLockTime of <code>to_sign</code> is set to ''t'', and the nSequence of the first input of <code>to_sign</code> is set to ''s'', the validator may output the state ''valid at time t and age s''.
>
> If both ''t'' and ''s'' are 0, the validator must instead output ''valid''.
>
> Users may then wish to interpret this state as ''valid'' or ''invalid'' relative to the state of the current blockchain, but the rules for doing so are out of scope of this BIP.
>
> === Incomplete Validation ===
>
> Some validators may not wish to implement a full script interpreter, choosing instead to support only specific script templates, or only Miniscript, for example. In this case, if they are unable to execute the scripts used by <code>to_sign</code>, they should output the state ''inconclusive''.
>
> Users should interpret this state as the same thing as ''invalid'', although take it as a sign that they should find more capable software.
>
> === Consensus-Only Validation ===
>
> Validators which are only able to check consensus-correctness of witnesses, but not the additional restrictions imposed by this BIP, may output the state ''consensus-valid'' to indicate that a signature has passed all consensus and structural checks.
>
> Users should interpret this state as the same thing as ''valid'' but be aware that other software may fail to validate the same signature.
>
> == Compatibility ==
>
> This specification is backwards compatible with the legacy signmessage/verifymessage specification through the special case as described above.
>
> == Reference implementation ==
>
> TODO
>
> == Acknowledgements ==
>
> Thanks to David Harding, Jim Posen, Kalle Rosenbaum, Pieter Wuille, Andrew Poelstra, and many others for their feedback on the specification.
>
> == References ==
>
> # Original mailing list thread: https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2018-March/015818.html
>
> == Copyright ==
>
> This document is licensed under the Creative Commons CC0 1.0 Universal license.
>
> == Test vectors ==
>
> TODO
>
> * * * * * End full text * * * * *
>
> --
> Andrew Poelstra
> Director of Research, Blockstream
> Email: apoelstra at wpsoftware.net
> Web: https://www.wpsoftware.net/andrew
>
> The sun is always shining in space
> -Justin Lewis-Webster
>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev at lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev

2023-06-07 18:19:40

- reply

📅 Original date posted:2019-07-23
📝 Original message:Hello,
People come in as Bitcoin developers all the time, but sometimes
people also leave permanently. In the case of BIP authors, when a user
leaves and does not respond to (reasonable) requests to change their
BIPs, we are sort of stuck right now.
BIP-2 states that anyone is allowed to request a change of a
draft/proposed BIP to "rejected" status after 3 years of inactivity,
but sometimes BIPs are accepted, after which the author leaves.
See e.g. https://github.com/bitcoin/bips/pull/339
There are a couple of ways to address this:
1. We allow anyone to request a change of a draft/proposed BIP to
"accepted", at any time. It is upon the requester to prove within
reason that the BIP does fulfill the criteria as given in BIP-2. Such
a request does not need the approval of the BIP author.
2. We allow BIPs to expire after 3 years, and allow the BIP repository
maintainer to assign a new champion, once/if such a champion appeared.
3. We do neither, and when such is warranted, we make new BIPs with
new assignations which supercede the old BIP, sort of like how BIP 2
supercedes BIP 1. Without the author to sign off on the change though,
it may not be obvious enough since we can't modify the original BIP.
4. Other approach / fine as it is.

2023-06-07 18:16:57

- reply

📅 Original date posted:2019-03-09
📝 Original message:Hi Lautaro,
Using regtest is not ideal for public networks, as anyone anywhere can
just rewrite the blockchain at their whim by mining a ton of blocks.
On Sun, Mar 10, 2019 at 4:52 AM Lautaro Dragan <lautarodragan at gmail.com> wrote:
>
> Hi Karl-Johan, my two cents:
>
> At Po.et we use regtest to simulate reorgs in integration tests in Travis / CircleCI. It has proved quite useful.
>
> In general regtest for automated testing has given us all we needed so far, but I admit we have a rather simple use of Bitcoin right now (colored coins).
>
> For local development, we sometimes use a script that "mines" blocks in regtest periodically. It was my goal to also use this method in QA, although we wound up using testnet and didn't encounter any problems so far.
>
> Out of curiosity: what limitations did you find in using, for example, a private network of bitcoin core nodes running regtest? (this gives you the same power as centralization without any changes or extra functionality required)
>
> El vie., 8 de mar. de 2019 a la(s) 16:02, Karl-Johan Alm via bitcoin-dev <bitcoin-dev at lists.linuxfoundation.org> escribió:
>>
>> Hello,
>>
>> As some of you already know, I've been working on a network called "signet", which is bascially a complement to the already existing testnet, except it is completely centralized, and blocks are signed by a specific key rather than using proof of work.
>>
>> Benefits of this:
>>
>> 1. It is more predictable than testnet. Miners appear and disappear regularly, causing irregular block generation.
>>
>> 2. Since it is centrally controlled, it is easy to perform global testing, such as reorgs (e.g. the network performs a 4 block reorg by request, or as scheduled).
>>
>> 3. It is more stable than testnet, which occasionally sees several thousand block reorgs.
>>
>> 4. It is trivial to spin up (and shut down) new signets to make public tests where anyone can participate.
>>
>> Anyone can create a signet at any time, simply by creating a key pair and creating a challenge (scriptPubKey). The network can then be used globally by anyone, assuming the creator sends some coins to the other participants.
>>
>> Having a persistent signet would be beneficial in particular to services which need a stable place to test features over an extended period of time. My own company implements protocols on top of Bitcoin with sidechains. We need multi-node test frameworks to behave in a predictable manner (unlike testnet) and with the same standardness relay policy as mainnet.
>>
>> Signets consist of 2 parameters: the challenge script (scriptPubKey) and the solution length. (The latter is needed to retain fixed length block headers, despite having an additional payload.)
>>
>> I propose that a default persistent "signet1" is created, which can be replaced in future versions e.g. if the coins are unwisely used as real money, similarly to what happened to previous testnets. This signet is picked by default if a user includes -signet without providing any of the parameters mentioned above. The key holder would be someone sufficiently trusted in the community, who would be willing to run the system (block generation code, faucet, etc). It could be made a little more sturdy by using 1-of-N multisig as the challenge, in case 1 <= x < N of the signers disappear. If people oppose this, it can be skipped, but will mean people can't just jump onto signet without first tracking down parameters from somewhere.
>>
>> Implementation-wise, the code adds an std::map with block hash to block signature. This is serialized/deserialized as appropriate (Segwit witness style), which means block headers in p2p messages are (80 + solution_length) bytes. Block header non-contextual check goes from checking if block header hash < target to checking if the payload is a valid signature for the block header hash instead.
>>
>> Single commit with code (will split into commits and make PR later, but just to give an idea what it looks like): https://github.com/kallewoof/bitcoin/pull/4
>>
>> I don't think this PR is overly intrusive, and I'm hoping to be able to get signet code into Bitcoin Core eventually, and am equally hopeful that devs of other (wallet etc) implementations will consider supporting it.
>>
>> Feedback requested on this.
>>
>> Attribution: parts of the signet code (in particular signblock and getnewblockhex) were adapted from the ElementsProject/elements repository. When PR is split into atomic commits, I will put appropriate attribution there.
>>
>> _______________________________________________
>> bitcoin-dev mailing list
>> bitcoin-dev at lists.linuxfoundation.org
>> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev

2023-06-07 18:16:56

- reply

📅 Original date posted:2019-03-09
📝 Original message:Hi Matt,
On Sat, Mar 9, 2019 at 5:20 AM Matt Corallo <lf-lists at mattcorallo.com> wrote:
>
> To make testing easier, it may make sense to keep the existing block header format (and PoW) and instead apply the signature rules to some field in the coinbase transaction. This means SPV clients (assuming they only connect to honest/trusted nodes) work as-is.
Keeping the PoW rule and moving the signature would mean DoS attacks
would be trivial as anyone could mine blocks without a signature in
them, unless you ramped up the difficulty, which would mean it's just
another testnet. It's a test network, admittedly, but I think it would
kind of defeat the purpose.
> A previous idea regarding reorgs (that I believe Greg came up with) is to allow multiple keys to sign blocks, with one signing no reorgs and one signing a reorg every few blocks, allowing users to choose the behavior they want.
Not sure how this would work in practice. The idea with signet is to
have an actual network that is occasionally reorged, i.e. it's a
global network (for those participating) that everyone agrees on. Not
sure how you would have choices there.

2023-06-07 18:14:43

- reply

📅 Original date posted:2018-09-12
📝 Original message:A potential problem is that it would be a new attack vector to simply
color something to appear as e.g. 10x more than it really is, if
everyone started using this system.
On Sun, Aug 19, 2018 at 5:27 AM Martin Damgaard via bitcoin-dev
<bitcoin-dev at lists.linuxfoundation.org> wrote:
>
> Hi bitcoin-dev at lists.linuxfoundation.org
>
> Here is my humble attempt to make a contribution to the impressive work that you all are doing.
>
> I am unfamiliar with the normal BIP procedures. I have therefore just tried to follow the example of BIP 176 by Jimmy Song, in order make something similar. I suggest a universal bitcoin value color scale, for tackling the same decimal problem, as identified by the BIP 176 proposal.
>
> I have attached the document in three different formats (*.rtf, *.pdf and *.docx) as I do not know your preferred format. I hope you will find my suggestion useful.
>
>
>
> Thank you and all the best
>
> Martin Damgaard
>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev at lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev

2023-06-07 18:12:44

- reply

📅 Original date posted:2018-06-05
📝 Original message:On Tue, Jun 5, 2018 at 10:08 AM, Jim Posen <jim.posen at gmail.com> wrote:
> It also derives all bandwidth gains from address reuse. So I'm
> hesitant to make the complexity tradeoff for bandwidth savings due to a
> behavior that is actively discouraged.
I don't understand this comment. The bandwidth gains are not from
address reuse, they are from the observed property that false
positives are independent between two filters. I.e. clients that
connect once a day will probably download 2-3 filters at most, if they
had nothing relevant in the last ~144 blocks.
-Kalle.