[Bitcoin-development] Discussion related to pull 349 and pull 319 (escrow transactions)

[Bitcoin-development] Discussion related to pull 349 and pull 319 (escrow transactions)

[Gregory Maxwell]

Pull 349 (https://github.com/bitcoin/bitcoin/pull/349)
implements a pretty nice implementation of multiple signature escrowed
transactions. Especially with clearcoin gone I think that this is
something we ought to have sooner rather than later.

I've tested it on a private network and it appears to work pretty well.

It probably needs more testing and discussion before it is actually
added to the client, but one challenge is that because it requires a
new transaction type it won't be deployable until _after_ an updated
isStandard is widely used in the network.

So I think that makes a good argument for separating out the
IsStandard part of the patch and getting it out in 0.4.

Unfortunately, the patch exposes an issue with multisig validation: If
I understand it correctly, the problem is that due to redundancy in
 the script length coding opcodes it's possible to code a script
multiple ways. The signature validation code creates new template
scripts in order to evaluate signatures for one output, and the code
in bitcoin is not careful to code the new script the same way the
original one was coded, causing the signature validation to fail when
something used OP_PUSHDATA when a direct length could have been used.

Pull 349 (https://github.com/bitcoin/bitcoin/pull/349) contains one
candidate fix for this: Excluding the length opcodes from the
comparison.

This fix carries a risk of creating differences in how nodes validate
transactions leading to lasting forks. (e.g. Old clients will reject a
block which new clients would have accepted).  I do also wonder about
strange effects arising from multiple valid TXN which are identical in
meaning but have different hashes, but I guess thats already possible
in a number of different ways.

Another way of fixing this would be to just define that OP_PUSHDATA*
_cannot_ be used to push the smaller lengths which could be more
efficiently encoded with the direct length opcodes.  I think this
would have the benefit of being consistent with the current behavior
and carry no severe split risk.

Yet way of fixing it would be to change out the templating code works
to make sure it codes the template the same way the original was
coded. This seems tricky to implement to me, tricky to validate, but
it would potentially be beneficial if this same class of problem
exists for things other than the length coding.

Re: [Bitcoin-development] Discussion related to pull 349 and pull 319 (escrow transactions)

[bgroff]

Gregory Maxwell wrote:

> Pull 349 (https://github.com/bitcoin/bitcoin/pull/349)
> implements a pretty nice implementation of multiple signature escrowed
> transactions. Especially with clearcoin gone I think that this is
> something we ought to have sooner rather than later.
>
> I've tested it on a private network and it appears to work pretty well.

Thank you!  (I think you mean 319 here)

> It probably needs more testing and discussion before it is actually
> added to the client, but one challenge is that because it requires a
> new transaction type it won't be deployable until _after_ an updated
> isStandard is widely used in the network.

With Eligius mining !IsStandard transactions and probably other pools open
to the idea, I am hopeful that we can quickly get 30%+ of mining power to
upgrade, which means that we could still mine these in a reasonable time
frame (under 1 hour).

...

> Unfortunately, the patch exposes an issue with multisig validation: If
> I understand it correctly, the problem is that due to redundancy in
>  the script length coding opcodes it's possible to code a script
> multiple ways. The signature validation code creates new template
> scripts in order to evaluate signatures for one output, and the code
> in bitcoin is not careful to code the new script the same way the
> original one was coded, causing the signature validation to fail when
> something used OP_PUSHDATA when a direct length could have been used.
>

I'm not sure I see the problem here.  CScript.operator<< currently inserts
values into scripts using the shortest possible sequence.  As long as code
continues to conform to this convention, scripts generated by it will
verify correctly.

If new code is written that generates one of the longer sequences, it will
generate transactions that will not pass block validation since the
signature won't verify.  So such code will be useless and we can refrain
from writing it?

--
Bobby Groff

Re: [Bitcoin-development] Discussion related to pull 349 and pull 319 (escrow transactions)

[Gregory Maxwell]

On Wed, Aug 3, 2011 at 2:10 AM,  <bgroff@lavabit.com> wrote:
> Thank you!  (I think you mean 319 here)

Correct.

> With Eligius mining !IsStandard transactions and probably other pools open
> to the idea, I am hopeful that we can quickly get 30%+ of mining power to
> upgrade, which means that we could still mine these in a reasonable time
> frame (under 1 hour).

It's not just a matter of mining power, it's also a question of
propagation.  Matt and I tried to perform a non-standard transaction
weeks ago and weren't able to get in mined after many hours. (we
eventually double spent the input with a normal transaction in order
to make it go away, interestingly one point about non-propagating txn
is that they're extra vulnerable to double spending by a standard txn,
as the non-standard one won't preclude the propagation of the standard
one)

From discussion on IRC it seemed clear enough that the current focus
on maturity/bugfixes is probably going to delay your full patch, but
the IsStandard part is uncontroversial and could go in quickly.

Based on that I think it would be very useful to split 319 into two
pull requests: one which does the IsStandard change, and one which
adds the full escrow feature set.  This way when the escrow patch does
enter the mainline client it will be meet up with a network which is
happy to handle its transactions.

(and people who are eager to use escrow can use modified clients on
the main network before that point in time)

> I'm not sure I see the problem here.  CScript.operator<< currently inserts
> values into scripts using the shortest possible sequence.

Ah for some reason I thought your current code did not always produce
the shortest sequence.

If so, I see no reason to block on the other pull.

Re: [Bitcoin-development] Discussion related to pull 349 and pull 319 (escrow transactions)

[bgroff]

> On Wed, Aug 3, 2011 at 2:10 AM,  <bgroff@lavabit.com> wrote:
>> Thank you!  (I think you mean 319 here)
>
> Correct.
>
>> With Eligius mining !IsStandard transactions and probably other pools
>> open
>> to the idea, I am hopeful that we can quickly get 30%+ of mining power
>> to
>> upgrade, which means that we could still mine these in a reasonable time
>> frame (under 1 hour).
>
> It's not just a matter of mining power, it's also a question of
> propagation.  Matt and I tried to perform a non-standard transaction
> weeks ago and weren't able to get in mined after many hours. (we
> eventually double spent the input with a normal transaction in order
> to make it go away, interestingly one point about non-propagating txn
> is that they're extra vulnerable to double spending by a standard txn,
> as the non-standard one won't preclude the propagation of the standard
> one)

Right, the user would have to connect directly to miners accepting
non-standard transactions.

> From discussion on IRC it seemed clear enough that the current focus
> on maturity/bugfixes is probably going to delay your full patch, but
> the IsStandard part is uncontroversial and could go in quickly.

With the latest high profile security breaches, I am hoping that the whole
things can be pulled relatively soon.  Building secure deposit systems
will improve trust in the ecosystem.

I've included a significant amount of unit tests to "pay" for the
additional feature, and I can add more if needed.

--
Bobby Groff