public inbox for bitcoindev@googlegroups.com
 help / color / mirror / Atom feed
From: Adam Back <adam.back@gmail.com>
To: Anthony Towns <aj@erisian.com.au>,
	 Bitcoin Protocol Discussion
	<bitcoin-dev@lists.linuxfoundation.org>
Cc: "アルム カールヨハン" <karl@dglab.com>
Subject: Re: [bitcoin-dev] Simple lock/unlock mechanism
Date: Thu, 1 Mar 2018 00:36:05 +0100	[thread overview]
Message-ID: <CALqxMTHHnMdbjovZh70bODj2RzEB53SY8MGMa_i1ty1H-1EXMg@mail.gmail.com> (raw)
In-Reply-To: <20180228223044.GA31415@erisian.com.au>

Coincidentally I had thought of something similar to what Kalle posted
about a kind of software only time-lock vault, and described the idea
to a few people off-list.  Re. Root incompatibility, if the key is
deleted (as it must be) then a delegated signature can not be made
that bypasses the CSV timeout restriction, so Root should not be
incompatible with this.  I think it would be disadvantageous to mark
keys as Rootable vs not in a sighash sense, because then that is
another privacy/fungibility loss eroding  the uniformity advantage of
Root when the delegate is not used.

One drawback is deleting keys may itself be a bit difficult to assure
with HD wallet seeds setup-time backup model.

As Anthony described I think, a simpler though less robust model would
be to have a third party refuse to co-sign until a pre-arranged time,
and this would have the advantage of not requiring two on-chain
transactions.

With bulletproofs and CT rangeproofs / general ECDL ZKPS there is the
possibility to prove things about the private key, or hidden
attributes of a public key in zero-knowledge.  Kind of what we want is
to place private key covenants, where we have to prove that they are
met without disclosing them.  For example there is a hidden CSV and it
is met OR there is no hidden CSV so it is not applicable.

Adam

On 28 February 2018 at 23:30, Anthony Towns via bitcoin-dev
<bitcoin-dev@lists.linuxfoundation.org> wrote:
> On Wed, Feb 28, 2018 at 04:34:18AM +0000, アルム カールヨハン via bitcoin-dev wrote:
>> 1. Graftroot probably breaks this (someone could just sign the
>> time-locked output with a script that has no time-lock).
>
> Making the graftroot key be a 2-of-2 muSig with an independent third party
> that commits to only signing CLTV scripts could avoid this. Making it
> 3-of-3 or 5-of-5 could be even better if you can find multiple independent
> services that will do it.
>
> Cheers,
> aj
>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev


  reply	other threads:[~2018-02-28 23:36 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-02-28  3:47 [bitcoin-dev] Simple lock/unlock mechanism アルム カールヨハン
2018-02-28  4:34 ` アルム カールヨハン
2018-02-28 22:30   ` Anthony Towns
2018-02-28 23:36     ` Adam Back [this message]
2018-03-01  5:11     ` アルム カールヨハン
2018-03-05 14:53       ` アルム カールヨハン

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CALqxMTHHnMdbjovZh70bODj2RzEB53SY8MGMa_i1ty1H-1EXMg@mail.gmail.com \
    --to=adam.back@gmail.com \
    --cc=adam@cypherspace.org \
    --cc=aj@erisian.com.au \
    --cc=bitcoin-dev@lists.linuxfoundation.org \
    --cc=karl@dglab.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox