From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Sat, 04 Jul 2026 05:47:46 -0700 Received: from mail-oo1-f64.google.com ([209.85.161.64]) by mail.fairlystable.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.94.2) (envelope-from ) id 1wfzmb-0002cY-JW for bitcoindev@gnusha.org; Sat, 04 Jul 2026 05:47:45 -0700 Received: by mail-oo1-f64.google.com with SMTP id 006d021491bc7-6a177de7766sf697203eaf.1 for ; Sat, 04 Jul 2026 05:47:45 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1783169259; cv=pass; d=google.com; s=arc-20260327; b=FnGOrxL4cvI4yDY0jJUxCwOlsPFHa77lndRC7ila3nN6Q5vyuOuWll3TNrEvJA9P2J 2g7LYfbIXi2Gj9I4kj6SYFmzbO0gOxDTfpfFfHAB1F/y3lffvIOJsbll3ieolJ4Bu9Dc E10z/+3t0V8if7vQpPBDj4bwzX/9NDY0hX5tGrJObYr/4R72xkVAkQee/54tMGZhNS1X LDn7cuweut8s0y/xtkXYFd/LuzczXx9uvso5uAL2sMiPC0fUWJRm/6I8t8Qamo4ETUnX VulE4O41PjvjkPu/xUgd0rV4c49Wl+GnVpP86CDXaU31AsAh0/9pbh5IsRz0M6yBbaX5 wayQ== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:content-transfer-encoding:subject :references:in-reply-to:message-id:cc:to:from:date:mime-version :feedback-id:sender:dkim-signature; bh=M1qleWca+G8kbBaudjCw/sdSj9+tHX4tGKvtPxWucd8=; fh=/n4F1kqLlM4V9F6HTrc78qt64VaRzkL7w3GUzefHBDQ=; b=Q50ZgBKC20MgKZRVbYZS4dj8xGGGbVLKka/y9FLwUddZ/rOSqWYIbLuQXv6KIbB6lt 3jvbt3mqVaD7n6oP2MzrLlU0uAa3dwNyDELfmmzlu/AH5EU1kPzj1/b5+ikAmyrFWavv 1Nekq1Dlt6jeqikVbpaFYn5u6xsGRfi90m8CKu8Is0NWxBmA9MMYdVGbKJVeed5JW7Bz mjJOu0XStuUsgEs+4ITeb03twtc6qWmJhiDUsDN5OVvpnCaQzGs5pOqCsisrFEPnqsUN a3Ne2Pm7BYQ2esJE0vpNM3m4GI0F9mJJa3Na/Ov0nw3HIZ7H6R37fb7n5gRnXzgzW9Ur PgVQ==; darn=gnusha.org ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@sprovoost.nl header.s=fm3 header.b=Rh2VbH6K; dkim=pass header.i=@messagingengine.com header.s=fm2 header.b="hVBbGf/D"; spf=pass (google.com: domain of sjors@sprovoost.nl designates 202.12.124.156 as permitted sender) smtp.mailfrom=sjors@sprovoost.nl; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=sprovoost.nl DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1783169259; x=1783774059; darn=gnusha.org; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-authentication-results :x-original-sender:content-transfer-encoding:content-type:subject :references:in-reply-to:message-id:cc:to:from:date:mime-version :feedback-id:sender:from:to:cc:subject:date:message-id:reply-to :content-type; bh=M1qleWca+G8kbBaudjCw/sdSj9+tHX4tGKvtPxWucd8=; b=iHDAbtt1zEq9NVN6IymY3vSR9qi/XAxLTkT6OfG6Rkr0kqh1jyCcehf4BKh+OOp7w7 kBi4qKewpSzEgimU3bbGID8RCd1jB09nAzuEhlzU9g3mClVF9Ph6NdzPbITcynX5nFsf f/ugvvk6Cb05gKohxSuIH9w2NG/UvawGJ2P9WXL1hAHNwGttQEikTaxGlKthkA80vU8J xyzRES7Rotuy5GZ1gb1c+AFX+WZsbzOg6ytKwUH5TyoEpIFiolA6mlNPyRSsitfUvC1k K29cOJvLyRGRAhHDvOzSKsyUKXFbXhZMoSswHrqp1jyw8Bp1migs8RC3SrUSpLIST/wS E0FQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783169259; x=1783774059; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-authentication-results :x-original-sender:content-transfer-encoding:content-type:subject :references:in-reply-to:message-id:cc:to:from:date:mime-version :feedback-id:x-beenthere:x-gm-message-state:sender:from:to:cc :subject:date:message-id:reply-to:content-type; bh=M1qleWca+G8kbBaudjCw/sdSj9+tHX4tGKvtPxWucd8=; b=qmo1RfeVhg8sBY6W2rQ7asx4JW51yyJgwgjNlfn0DhrumQG1LMc3rLoCcqz0srJrXc CiCve+ABmXesnaF9f/0vbZTFzGGP0lgfvDYwR59L0bCpZeTFr8w9xbGpHiOmNgiQZWDC WFYgbZEIdYs6hbpGip6D9NsSClWUgD3i5ntMnFdLc3+ReATps48I0CtPoeD4a3y6diRm VrSwfcCt68p+xBpXFFJlQEsoOIqAnGSO8l6uTBtNuMFpTRZHn9cwM+xec2u8fpmKfHyk 8crGCOE/fjALdQwuFOf+6oCoSxoNTR+V/mSZVFZsUC7+4K8UjEyqLRBogslEHrlhYFgt z+Pg== Sender: bitcoindev@googlegroups.com X-Forwarded-Encrypted: i=2; AFNElJ8PgDfrCeUTgL6t9Honhsy1e3Cpasfu6cc+IeAW/Rb0bEfLgOhxfNacwY8XufRx8N+31hxn8j7MYdaX@gnusha.org X-Gm-Message-State: AOJu0Yy+QWZL2Pv9GSYqRLtegUkBxOS1QPqlYGu2dtK0umwpBl2c24Ro IL0y/OQf5Gohx2SXnuJEdfKmLp9SxYvni+/r2QctLrCc87Z4748gJZf1 X-Received: by 2002:a05:6820:3084:b0:6a3:1556:7a5f with SMTP id 006d021491bc7-6a32f5ab3damr1564333eaf.58.1783169259341; Sat, 04 Jul 2026 05:47:39 -0700 (PDT) X-BeenThere: bitcoindev@googlegroups.com; h="AX0PUUc9JlX+426Nf3+jkVutYZW9EJ5BpPUpwcAUhORMHnsQBA==" Received: by 2002:a05:6871:2b17:b0:42f:eb75:2e78 with SMTP id 586e51a60fabf-44c3c538391ls1774435fac.2.-pod-prod-06-us; Sat, 04 Jul 2026 05:47:33 -0700 (PDT) X-Forwarded-Encrypted: i=2; AFNElJ9IPsvXCvdct3gtVyhEz7Mcv7p2xTU7ks+oruopj364nai/E0qOqnIzCEumk49zjpXLciwU1n+XOTrz@googlegroups.com X-Received: by 2002:a05:6809:386:20b0:49b:33c8:4b75 with SMTP id 5614622812f47-49b33c84c13mr372818b6e.5.1783169253664; Sat, 04 Jul 2026 05:47:33 -0700 (PDT) Received: by 2002:a05:620a:224c:10b0:92e:8185:68ce with SMTP id af79cd13be357-92e81857208ms85a; Sat, 4 Jul 2026 04:58:14 -0700 (PDT) X-Forwarded-Encrypted: i=2; AHgh+RoczUWdsHsP47KGfuMdTWkEnGFGS6e2+k551daZRN8KJGpP6PkZL0KEXk3kB+0nf8+YBMyP/kHX46WP@googlegroups.com X-Received: by 2002:a05:6122:2906:b0:5bc:3dde:3364 with SMTP id 71dfb90a1353d-5be101c8313mr815626e0c.7.1783166293676; Sat, 04 Jul 2026 04:58:13 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1783166293; cv=none; d=google.com; s=arc-20260327; b=gLECIN8TqbBQbyzFp7zEI7JrWA5WeV0GD7tNeXXDeyew2XqjjFhJ+z7RYgjvQidwmQ aPe9/HNYXw6fDLhdPMyxqeC68xB0x+wz3baawjybx1sU/8QK4Y9z39NZytK7vF0A++UA edDPFjbUjWfbCqnbcSQWxRIr+sXqc/VtzjdHrbUkdWPmoxWoAxsCByEoT2UqCs0Yi7Iv KdHFZz7TgqD3a0pzxXalAZHcCKqUHq7IsoJ/T4/8qEB2dBurbKkac4iurChzw1Hwq+z+ SMbx44/8JgsjoIL/xGZuAuwjSCqpyk5eOuNhTGmS+F0V05+zreZ6cKV3wak681lnQiVk FzTQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:subject:references:in-reply-to:message-id :cc:to:from:date:mime-version:feedback-id:dkim-signature :dkim-signature; bh=rmRfmBoGC/sBzHQaKGtuw2heccjHrW8ZZVlmmYaKnrw=; fh=wZ6YntnHNqN9ifhDRjdHB9MUhFiNXIfvzJACPatG+Ig=; b=NXH4mVjID3ew3m6SQXZqWJo9aX+esjFGGj3bztpKqfqnL1JsAIZ6eX+36X69aRPvch SwqzhU0Lp1hY0aNladE78ifkDOg3MNWIDG2is5rKocXo0HH6LBxgP92oPE5zMZXLps5Q 3WRSWZ9Ryl+ypdQRELcuLnQxYMaD3OUZGR4axrRw8m0Jt9ejqB5cN86kJPne4mQ9v5+K WiBG7E1Mc/GK3iXDlhPXAapZ70wTQJMghYOeREyOMOXv5CSuWDWSUinRAZbBY6HqS1uJ 5JMip01T0mnHrBoD0JSy+dclLnQ6sb3rPpIK955xgEOyTByC50LfSfgE1f3uNlLQvT9O V3lw==; dara=google.com ARC-Authentication-Results: i=1; gmr-mx.google.com; dkim=pass header.i=@sprovoost.nl header.s=fm3 header.b=Rh2VbH6K; dkim=pass header.i=@messagingengine.com header.s=fm2 header.b="hVBbGf/D"; spf=pass (google.com: domain of sjors@sprovoost.nl designates 202.12.124.156 as permitted sender) smtp.mailfrom=sjors@sprovoost.nl; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=sprovoost.nl Received: from fhigh-b5-smtp.messagingengine.com (fhigh-b5-smtp.messagingengine.com. [202.12.124.156]) by gmr-mx.google.com with ESMTPS id 71dfb90a1353d-5be02b9fbf5si149196e0c.6.2026.07.04.04.58.13 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 04 Jul 2026 04:58:13 -0700 (PDT) Received-SPF: pass (google.com: domain of sjors@sprovoost.nl designates 202.12.124.156 as permitted sender) client-ip=202.12.124.156; Received: from phl-compute-05.internal (phl-compute-05.internal [10.202.2.45]) by mailfhigh.stl.internal (Postfix) with ESMTP id AB9A07A0075; Sat, 4 Jul 2026 07:58:12 -0400 (EDT) Received: from phl-imap-04 ([10.202.2.82]) by phl-compute-05.internal (MEProxy); Sat, 04 Jul 2026 07:58:12 -0400 X-ME-Sender: X-ME-Proxy-Cause: dmFkZTF9vmjcIhFlDlmm2Lc1pz9W8Zi+x07+CzDetjk/QSkYtNScspc4qeY30Gc/n7oTtk RHkmiS0qNcvlmcGj/QC6VzddF9jhmxQcJMEmTlLD76S1S3ApirYF8AOWJK+tYS61wGGBSG qhWq4vkrmg1qqIeuQ24sINbZvhz6mw0DvlEjkrub8MAP1PIqChS51L8lSi0Yzm+NaD5Y60 fwfirXUfYMDWEwQtMrW1VYegaCaDnb8trUWtmDvhqY6ZToj2kHJa5DsSt9K0wmApwYJRRH EzE5L4Sm35sJhGQhO8UABSqffxH9dZ6WxD/RPe97a9apgPv45M2wFbllmNAYesmjbwMvVY Uno+/8/aS2MG9W/dpoXdQgYXT3O9aCuOX0lGne9Y2pGuwkJ/RbyWQyh4I+6JoUYZ6aasZV JVVnu/WfckqNsQV/zeNOAudKaNmI7plqg06VlAe8LBwfOZvFSb/yA7OAT+i4UTyxg+1Mdv IWY02tiL/9EOfBBv9Q+ZOw06tfxapG+9Flz7Dxl3SI8+KJbbMdlBnkDskQvZC7rfy7yRZD 1BANlKPX8tqnMnPjWcq7hw0paq+zzy/RIx+9VBmmVUSmBAVo/tV2NwGMlffK09ULADQ3+F TKNq6fgKHmtVzcrUlfx5oHnDX4afhhhGj+OFQTyWVng73xR+lU7z4/55Km4A X-ME-Proxy: Feedback-ID: ie5e042df:Fastmail Received: by mailuser.phl.internal (Postfix, from userid 501) id 0C273B6006E; Sat, 4 Jul 2026 07:58:12 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface MIME-Version: 1.0 X-ThreadId: A6L8VyvomJzo Date: Sat, 04 Jul 2026 13:57:51 +0200 From: "Sjors Provoost" To: "Pieter Wuille" , conduition Cc: "Nagaev Boris" , "'Bitcoin Development Mailing List'" Message-Id: <002f2395-7d5d-4cb6-852c-e991aa1f0eb3@app.fastmail.com> In-Reply-To: References: Subject: Re: [bitcoindev] Giving teeth to expected EC disabling: P2XX(-T)(-ML) Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Original-Sender: sjors@sprovoost.nl X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@sprovoost.nl header.s=fm3 header.b=Rh2VbH6K; dkim=pass header.i=@messagingengine.com header.s=fm2 header.b="hVBbGf/D"; spf=pass (google.com: domain of sjors@sprovoost.nl designates 202.12.124.156 as permitted sender) smtp.mailfrom=sjors@sprovoost.nl; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=sprovoost.nl Precedence: list Mailing-list: list bitcoindev@googlegroups.com; contact bitcoindev+owners@googlegroups.com List-ID: X-Google-Group-Id: 786775582512 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Score: 2.3 (++) On Fri, Jul 3, 2026, at 23:23, Pieter Wuille wrote: [...] > * Just publishing the DLP in a transaction (e.g. OP_RETURN with a=20 > specific marker). This is smaller than a full transaction input +=20 > signature. > > * Similarly, but publishing in the coinbase, and requiring relay using=20 > a separate message. Less places a node needs to check, but I'm=20 > concerned about the difficulty of testing infrastructure that relay of=20 > such a message works [...] > > On Saturday, June 27th, 2026 at 12:33 AM, Anthony Towns=20 > wrote: > >> A slight variant of this approach would be to have a 128 byte value "aRs= m", such that P =3D N+a*G, N is the BIP-341 NUMS point, and Rs is a BIP340 = signature of m by P. That would allow the victim of post-quantum theft via = a key-path spend of a BIP341 NUMS IPK to trigger the tripwire, in addition = to someone who has direct access to a CRQC. > > Indeed, I had considered something similar, but see above for why I'm=20 > not convinced supporting non-cooperative CRQCs is that useful. > > Also, in my view the tripwire isn't really a security feature on itself= =20 > (it's not expected to trigger...), but more something that sets=20 > expectations around the output type for prospective users. > > In that sense, the question is really whether supporting=20 > non-cooperative CRQCs helps set that expectation more than only=20 > cooperative ones, which are definitely easier to support. > >> I think it could make sense to have the tripwire be included in the bloc= k via the coinbase witness commitment output, rather than having it be lock= ed to a transaction, so you only having to check the coinbase for the magic= rather than every transaction. That would require a separate P2P message t= o relay the necessary ECDL-break proof to miners, and would probably need s= tratumv2 or a getblocktemplate update in order for the node to be able to t= ell pools to actually include that info in the coinbase. > > I worry this is untestable, really. You'd need things like=20 > fake-tripwires to be supported through the same message which don't=20 > require an ECDLP break, and still propagate. And then that needs DoS=20 > protection measures,=20 I whipped something up last weekend: https://github.com/Sjors/bitcoin/pull/121 It seems straightforward, but maybe I missed something: - for test code we use a fake NUMS point, so we can generate "proof" withou= t a quantum computer - a p2p message floods the proof - nodes ignore the message if they already have *any* valid proof - verifying p2p proof candidates might need some rate limiting, but it's as= cheap as verifying a transaction signature - mining code includes the proof in a coinbase op_return, until the freeze = activates - with stratum v2 (and ipc mining clients in general this works out of th= e box, a small change is needed for getblocktemplate clients) - since the proof is not in the header, we can't use the normal bip9 style = header scan to see if the rule activated. Instead the prototype stores it i= n a file along with a merkle inclusion proof, which is read when the node r= estarts. With this mechanism it doesn't really need to be in the coinbase transactio= n, but that does seem more convenient and miners can censor it anyway. - Sjors --=20 You received this message because you are subscribed to the Google Groups "= Bitcoin Development Mailing List" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to bitcoindev+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/bitcoindev/= 002f2395-7d5d-4cb6-852c-e991aa1f0eb3%40app.fastmail.com.