[Bitcoin-development] CLTV opcode allocation; long-term plans?

[Bitcoin-development] CLTV opcode allocation; long-term plans?

[Peter Todd]

[-- Attachment #1: Type: text/plain, Size: 2173 bytes --]

Matt Corallo brought up¹ the issue of OP_NOP scarcity on the mempool
only CLTV pull-req²:

    "I like merging this, but doing both CLTV things in one swoop would be
    really nice. Certainly if we're gonna use one of the precious few
    OP_NOPs we have we might as well make it more flexible."

I have two lines of thought on this:

1) We're going to end up with a Script v2.0 reasonably soon, probably
   based on Russel O'Connor and Pieter Wuille's Merkelized Abstract Syntax
   Tree³ idea. This needs at most a single OP_NOPx to implement and mostly
   removes the scarcity of upgradable NOP's.

2) Similarly in script v1.0 even if we do use up all ten OP_NOPx's, the
   logical thing to do is implement an <actual opcode #> OP_EXTENDED.

3) It's not clear what form a relative CLTV will actually take; the BIP
   itself proposes a OP_PREVOUT_HEIGHT_VERIFY/OP_PREVOUT_DATA along with
   OP_ADD, with any opcode accessing non-reorg-safe prevout info being made
   unavailable until the coinbase maturity period has passed for
   soft-fork safeness.

That said, if people have strong feelings about this, I would be willing
to make OP_CLTV work as follows:

    <nLockTime> 1 OP_CLTV

Where the 1 selects absolute mode, and all others act as OP_NOP's. A
future relative CLTV could then be a future soft-fork implemented as
follows:

    <relative nLockTime> 2 OP_CLTV

On the bad side it'd be two or three days of work to rewrite all the
existing tests and example code and update the BIP, and (slightly) gets
us away from the well-tested existing implementation. It also may
complicate the codebase compared to sticking with just doing a Script
v2.0, with the additional execution environment data required for v2.0
scripts cleanly separated out. But all in all, the above isn't too big
of a deal.

Interested in your thoughts.

1) https://github.com/bitcoin/bitcoin/pull/5496#issuecomment-98568239
2) https://github.com/bitcoin/bitcoin/pull/5496
3) http://css.csail.mit.edu/6.858/2014/projects/jlrubin-mnaik-nityas.pdf

-- 
'peter'[:-1]@petertodd.org
00000000000000000908b2eb1cb0660069547abdddad7fa6ad4e743cebe549de

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 650 bytes --]

Re: [Bitcoin-development] CLTV opcode allocation; long-term plans?

[Btc Drak]

[-- Attachment #1: Type: text/plain, Size: 1437 bytes --]

On Mon, May 4, 2015 at 6:07 AM, Peter Todd <pete@petertodd.org> wrote:

> Matt Corallo brought up¹ the issue of OP_NOP scarcity on the mempool
> only CLTV pull-req²:
>
>     "I like merging this, but doing both CLTV things in one swoop would be
>     really nice. Certainly if we're gonna use one of the precious few
>     OP_NOPs we have we might as well make it more flexible."
>
> [snip]

> That said, if people have strong feelings about this, I would be willing
> to make OP_CLTV work as follows:
>
>     <nLockTime> 1 OP_CLTV
>
> Where the 1 selects absolute mode, and all others act as OP_NOP's. A
> future relative CLTV could then be a future soft-fork implemented as
> follows:
>
>     <relative nLockTime> 2 OP_CLTV
>
> On the bad side it'd be two or three days of work to rewrite all the
> existing tests and example code and update the BIP, and (slightly) gets
> us away from the well-tested existing implementation. It also may
> complicate the codebase compared to sticking with just doing a Script
> v2.0, with the additional execution environment data required for v2.0
> scripts cleanly separated out. But all in all, the above isn't too big
> of a deal.


Adding a parameter to OP_CLTV makes it much more flexible and is the most
economic use of precious NOPs.
The extra time required is ok and it would be good to make this change to
the PR in time for the feature freeze.

Drak

[-- Attachment #2: Type: text/html, Size: 2273 bytes --]

Re: [Bitcoin-development] CLTV opcode allocation; long-term plans?

[Peter Todd]

[-- Attachment #1: Type: text/plain, Size: 1312 bytes --]

On Tue, May 05, 2015 at 01:54:33AM +0100, Btc Drak wrote:
> > That said, if people have strong feelings about this, I would be willing
> > to make OP_CLTV work as follows:
> >
> >     <nLockTime> 1 OP_CLTV
> >
> > Where the 1 selects absolute mode, and all others act as OP_NOP's. A
> > future relative CLTV could then be a future soft-fork implemented as
> > follows:
> >
> >     <relative nLockTime> 2 OP_CLTV
> >
> > On the bad side it'd be two or three days of work to rewrite all the
> > existing tests and example code and update the BIP, and (slightly) gets
> > us away from the well-tested existing implementation. It also may
> > complicate the codebase compared to sticking with just doing a Script
> > v2.0, with the additional execution environment data required for v2.0
> > scripts cleanly separated out. But all in all, the above isn't too big
> > of a deal.
> 
> 
> Adding a parameter to OP_CLTV makes it much more flexible and is the most
> economic use of precious NOPs.
> The extra time required is ok and it would be good to make this change to
> the PR in time for the feature freeze.

Done!

https://github.com/bitcoin/bitcoin/pull/5496#issuecomment-100454263

-- 
'peter'[:-1]@petertodd.org
000000000000000012c438a597ad15df697888be579f4f818a30517cd60fbdc8

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 650 bytes --]

Re: [Bitcoin-development] CLTV opcode allocation; long-term plans?

[Jorge Timón]

This saves us ocodes for later but it's uglier and produces slightly
bigger scripts.
If we're convinced it's worth it, seems like the right way to do it,
and certainly cltv and rclv/op_maturity are related.
But let's not forget that we can always use this same trick with the
last opcode to get 2^64 brand new opcodes.
So I'm not convinced at all on whether we want  #5496 or #6124.
But it would be nice to decide and stop blocking  this.

On Sat, May 9, 2015 at 11:12 AM, Peter Todd <pete@petertodd.org> wrote:
> On Tue, May 05, 2015 at 01:54:33AM +0100, Btc Drak wrote:
>> > That said, if people have strong feelings about this, I would be willing
>> > to make OP_CLTV work as follows:
>> >
>> >     <nLockTime> 1 OP_CLTV
>> >
>> > Where the 1 selects absolute mode, and all others act as OP_NOP's. A
>> > future relative CLTV could then be a future soft-fork implemented as
>> > follows:
>> >
>> >     <relative nLockTime> 2 OP_CLTV
>> >
>> > On the bad side it'd be two or three days of work to rewrite all the
>> > existing tests and example code and update the BIP, and (slightly) gets
>> > us away from the well-tested existing implementation. It also may
>> > complicate the codebase compared to sticking with just doing a Script
>> > v2.0, with the additional execution environment data required for v2.0
>> > scripts cleanly separated out. But all in all, the above isn't too big
>> > of a deal.
>>
>>
>> Adding a parameter to OP_CLTV makes it much more flexible and is the most
>> economic use of precious NOPs.
>> The extra time required is ok and it would be good to make this change to
>> the PR in time for the feature freeze.
>
> Done!
>
> https://github.com/bitcoin/bitcoin/pull/5496#issuecomment-100454263
>
> --
> 'peter'[:-1]@petertodd.org
> 000000000000000012c438a597ad15df697888be579f4f818a30517cd60fbdc8
>
> ------------------------------------------------------------------------------
> One dashboard for servers and applications across Physical-Virtual-Cloud
> Widest out-of-the-box monitoring support with 50+ applications
> Performance metrics, stats and reports that give you Actionable Insights
> Deep dive visibility with transaction tracing using APM Insight.
> http://ad.doubleclick.net/ddm/clk/290420510;117567292;y
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>

Re: [Bitcoin-development] CLTV opcode allocation; long-term plans?

[Pieter Wuille]

[-- Attachment #1: Type: text/plain, Size: 248 bytes --]

I have no strong opinion, but a slight preference for separate opcodes.

Reason: given the current progress, they'll likely be deployed
independently, and maybe the end result is not something that cleanly fits
the current CLTV argument structure.

[-- Attachment #2: Type: text/html, Size: 285 bytes --]

Re: [Bitcoin-development] CLTV opcode allocation; long-term plans?

[Btc Drak]

[-- Attachment #1: Type: text/plain, Size: 3061 bytes --]

Gavin and @NicolasDorier have a point: If there isn't actually scarcity of
NOPs because OP_NOP10 could become <type> OP_EX (if we run out), it makes
sense to chose the original unparameterised CLTV version #6124 which also
has been better tested. It's cleaner, more readable and results in a
slightly smaller script which has also got to be a plus.

On Tue, May 12, 2015 at 8:16 PM, Jorge Timón <jtimon@jtimon.cc> wrote:

> This saves us ocodes for later but it's uglier and produces slightly
> bigger scripts.
> If we're convinced it's worth it, seems like the right way to do it,
> and certainly cltv and rclv/op_maturity are related.
> But let's not forget that we can always use this same trick with the
> last opcode to get 2^64 brand new opcodes.
> So I'm not convinced at all on whether we want  #5496 or #6124.
> But it would be nice to decide and stop blocking  this.
>
> On Sat, May 9, 2015 at 11:12 AM, Peter Todd <pete@petertodd.org> wrote:
> > On Tue, May 05, 2015 at 01:54:33AM +0100, Btc Drak wrote:
> >> > That said, if people have strong feelings about this, I would be
> willing
> >> > to make OP_CLTV work as follows:
> >> >
> >> >     <nLockTime> 1 OP_CLTV
> >> >
> >> > Where the 1 selects absolute mode, and all others act as OP_NOP's. A
> >> > future relative CLTV could then be a future soft-fork implemented as
> >> > follows:
> >> >
> >> >     <relative nLockTime> 2 OP_CLTV
> >> >
> >> > On the bad side it'd be two or three days of work to rewrite all the
> >> > existing tests and example code and update the BIP, and (slightly)
> gets
> >> > us away from the well-tested existing implementation. It also may
> >> > complicate the codebase compared to sticking with just doing a Script
> >> > v2.0, with the additional execution environment data required for v2.0
> >> > scripts cleanly separated out. But all in all, the above isn't too big
> >> > of a deal.
> >>
> >>
> >> Adding a parameter to OP_CLTV makes it much more flexible and is the
> most
> >> economic use of precious NOPs.
> >> The extra time required is ok and it would be good to make this change
> to
> >> the PR in time for the feature freeze.
> >
> > Done!
> >
> > https://github.com/bitcoin/bitcoin/pull/5496#issuecomment-100454263
> >
> > --
> > 'peter'[:-1]@petertodd.org
> > 000000000000000012c438a597ad15df697888be579f4f818a30517cd60fbdc8
> >
> >
> ------------------------------------------------------------------------------
> > One dashboard for servers and applications across Physical-Virtual-Cloud
> > Widest out-of-the-box monitoring support with 50+ applications
> > Performance metrics, stats and reports that give you Actionable Insights
> > Deep dive visibility with transaction tracing using APM Insight.
> > http://ad.doubleclick.net/ddm/clk/290420510;117567292;y
> > _______________________________________________
> > Bitcoin-development mailing list
> > Bitcoin-development@lists.sourceforge.net
> > https://lists.sourceforge.net/lists/listinfo/bitcoin-development
> >
>

[-- Attachment #2: Type: text/html, Size: 4307 bytes --]

Re: [Bitcoin-development] CLTV opcode allocation; long-term plans?

[Luke Dashjr]

It should actually be straightforward to softfork RCLTV in as a negative CLTV.
All nLockTime are >= any negative number, so a negative number makes CLTV a 
no-op always. Therefore, it is clean to define negative numbers as relative 
later. It's also somewhat obvious to developers, since negative numbers often 
imply an offset (eg, negative list indices in Python).

Luke

Re: [Bitcoin-development] CLTV opcode allocation; long-term plans?

[Peter Todd]

[-- Attachment #1: Type: text/plain, Size: 745 bytes --]

On Tue, May 12, 2015 at 08:38:27PM +0000, Luke Dashjr wrote:
> It should actually be straightforward to softfork RCLTV in as a negative CLTV.
> All nLockTime are >= any negative number, so a negative number makes CLTV a 
> no-op always. Therefore, it is clean to define negative numbers as relative 
> later. It's also somewhat obvious to developers, since negative numbers often 
> imply an offset (eg, negative list indices in Python).

Doing this makes handling the year 2038 problem a good deal more
complex.

The CLTV codebase specifically fails on negative arguments to avoid any
ambiguity or implementation differences here.

-- 
'peter'[:-1]@petertodd.org
00000000000000000e7980aab9c096c46e7f34c43a661c5cb2ea71525ebb8af7

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 650 bytes --]

Re: [Bitcoin-development] CLTV opcode allocation; long-term plans?

[Jorge Timón]

I like the reuse with negative numbers more than the current proposal
because it doesn't imply bigger scripts. If all problems that may
arise can be solved, that is.
If we went that route, we would start with the initial CLTV too.
But I don't see many strong arguments in favor of using the current
trick later when we're actually running out of opcodes, just that
"CLTV and RCLTV/op_maturity are semantically related". How
semantically related depends on the final form of RCLTV/op_maturity,
but I don't think anybody wants to block CLTV until RCLTV is ready.

So we could just deploy the initial CLTV (#6124) now and then decide
whether we want to reuse it with negatives for RCLTV or if we use an
independent op.
Can the people that don't like that plan give stronger arguments in
favor of the parametrized version?

I've missed IRC conversations, so I may be missing something...


On Tue, May 12, 2015 at 11:01 PM, Peter Todd <pete@petertodd.org> wrote:
> On Tue, May 12, 2015 at 08:38:27PM +0000, Luke Dashjr wrote:
>> It should actually be straightforward to softfork RCLTV in as a negative CLTV.
>> All nLockTime are >= any negative number, so a negative number makes CLTV a
>> no-op always. Therefore, it is clean to define negative numbers as relative
>> later. It's also somewhat obvious to developers, since negative numbers often
>> imply an offset (eg, negative list indices in Python).
>
> Doing this makes handling the year 2038 problem a good deal more
> complex.
>
> The CLTV codebase specifically fails on negative arguments to avoid any
> ambiguity or implementation differences here.
>
> --
> 'peter'[:-1]@petertodd.org
> 00000000000000000e7980aab9c096c46e7f34c43a661c5cb2ea71525ebb8af7
>
> ------------------------------------------------------------------------------
> One dashboard for servers and applications across Physical-Virtual-Cloud
> Widest out-of-the-box monitoring support with 50+ applications
> Performance metrics, stats and reports that give you Actionable Insights
> Deep dive visibility with transaction tracing using APM Insight.
> http://ad.doubleclick.net/ddm/clk/290420510;117567292;y
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>

Re: [Bitcoin-development] CLTV opcode allocation; long-term plans?

[Rusty Russell]

Peter Todd <pete@petertodd.org> writes:
> That said, if people have strong feelings about this, I would be willing
> to make OP_CLTV work as follows:
>
>     <nLockTime> 1 OP_CLTV
>
> Where the 1 selects absolute mode, and all others act as OP_NOP's. A
> future relative CLTV could then be a future soft-fork implemented as
> follows:
>
>     <relative nLockTime> 2 OP_CLTV

Mildly prefer to put that the other way around.

ie. the OP_NOP1 becomes OP_EXTENSION_PREFIX, the next op defines which
extended opcode it is (must be a push).

Cheers,
Rusty.

Re: [Bitcoin-development] CLTV opcode allocation; long-term plans?

[Peter Todd]

[-- Attachment #1: Type: text/plain, Size: 983 bytes --]

On Thu, May 07, 2015 at 11:05:47AM +0930, Rusty Russell wrote:
> Peter Todd <pete@petertodd.org> writes:
> > That said, if people have strong feelings about this, I would be willing
> > to make OP_CLTV work as follows:
> >
> >     <nLockTime> 1 OP_CLTV
> >
> > Where the 1 selects absolute mode, and all others act as OP_NOP's. A
> > future relative CLTV could then be a future soft-fork implemented as
> > follows:
> >
> >     <relative nLockTime> 2 OP_CLTV
> 
> Mildly prefer to put that the other way around.
> 
> ie. the OP_NOP1 becomes OP_EXTENSION_PREFIX, the next op defines which
> extended opcode it is (must be a push).

There's no good way to implement that option - when the OP_NOPx is
executed all that's available to it without a lot of complex work is
what's already been pushed to the stack, not what will be pushed to the
stack in the future.

-- 
'peter'[:-1]@petertodd.org
000000000000000002761482983864328320badf24d137101fab9a5861a59d30

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 650 bytes --]