Re: [bitcoin-dev] Trusted merkle tree depth for safe tx inclusion proofs without a soft fork

[Peter Todd <pete@petertodd.org>]

[-- Attachment #1: Type: text/plain, Size: 1060 bytes --]

On Sat, Jun 09, 2018 at 02:51:55PM +0200, Sergio Demian Lerner wrote:
> Yo can fool a SPV wallet even if it requires a thousands confirmations
> using this attack, and you don't need a Sybil attack, so yes, it impacts
> SPV wallets also. The protections a SPV node should have to prevent this
> attack are  different, so it must be considered separately.

There's hardly any cases where "thousands of confirmations" change anything.

Anyway, SPV is a discredited concept and we shouldn't be concerning ourselves
with it.

> It should be said that a SPV node can avoid accepting payments if any
> Merkle node is at the same time a valid transaction, and that basically
> almost eliminates the problem.

Indeed it does: between the number of txouts, scriptSig length, scriptPubKey
length, and the upper bits of nValue we have ~32 known bits that we can use to
distinguish between inner nodes and transactions. That's a false positive rate
of under one in a billion, so no issues there.

-- 
https://petertodd.org 'peter'[:-1]@petertodd.org

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]