From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id 86369F3F for ; Wed, 13 Nov 2019 06:30:32 +0000 (UTC) X-Greylist: whitelisted by SQLgrey-1.7.6 Received: from mail-ot1-f52.google.com (mail-ot1-f52.google.com [209.85.210.52]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id BEEB9CF for ; Wed, 13 Nov 2019 06:30:31 +0000 (UTC) Received: by mail-ot1-f52.google.com with SMTP id w24so193995otk.6 for ; Tue, 12 Nov 2019 22:30:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ET6G1QSqmB+hR2tsbURvjfCnrZDEFO7w+vSuESwDfAM=; b=cNEUt49VIjEBQNG9LmoYjoYUw7k0KNkz/xNW/zbGE2s4Jxp4N97P4fp5O/HtPpNL+R n5lAr1cGs8LOYfMN78RPSvGZKrZA+4WGQVlOMq8i3spIO19y6EFCAacnviqK0zevwGP/ W93fXfePHU5myN4G54hbT/197ME6GVy/Fi7rtUrmGoDjyksGWr1YT4eMPlVj1U40alpC TnRad1KIyduDjKThU+v3ph0DD1CJs2J5OWFbOhhILmm8ivQ4WyFbIlzNj1k8JcOAaJ7e 05rsE5WtvcnJcgGq49f8ts1qI+vkTbrhIW3jHJy5xZDoXJRzrkyjaGP0SZDBCptRBq1v eISQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ET6G1QSqmB+hR2tsbURvjfCnrZDEFO7w+vSuESwDfAM=; b=Xybw4lurVVOQKUa7qSEyKKhnybSHBaYFtB4zipOMhNRLSTe7BQ/BrtEbU5M/vn2z2K RHhCT/DSMgVgy2SPykNfMJH4TBG4Z1dnLmzeqRawHb4ur474Kl3M/1/Y9coPgpjm/RYs q+YaNPR7wmeTLKobZjn08XXbgiDU4h8x3EHLqm88HV2BvfaOOtAgInkJeEG7q3VENroI RZSbq8uC/W0Aqo9REfohu47LQ2IDDuMCsBUYxi9GWilv5TQ/uUeHT8K8ZfUYJm8uafrd wkaMiDc107fgUdTCw9yHcurShdyjK0LYTVyujcZk3JvNI7EOD16cWKbsJVPQ5fHdgxwi YQeA== X-Gm-Message-State: APjAAAU/YYgVPR4WBiIa1wh97sahxDedVPgUlioe0J5D0artfakzMdRA ZlSnMc9MUzulhGlFMjm8s+9AKLYle4IoUwMtGF+aOWKd X-Google-Smtp-Source: APXvYqwBF8PngqXPFXpUeN4kE43hkY9qcQDUCfb+0OVWRP5vZbe3ZmW/t0MBweYHyJwgtrQ4Ba818Q1a34NXRGIY7J4= X-Received: by 2002:a05:6830:224c:: with SMTP id t12mr1278390otd.299.1573626630552; Tue, 12 Nov 2019 22:30:30 -0800 (PST) MIME-Version: 1.0 References: <20191108021541.n3jk54vucplryrbl@ganymede> <611b4e5b-e7cf-adc7-31e1-b5ff24b6574b@mattcorallo.com> <2sU6YozN9nn30cofkAMhffgjDLZwjG3mvF0nBgOsVQQEY9ROmP72GuHWjnBlF_qa8eeQPU8bxleZqcvRGJgS-uJ2xWYmAm9HjrFWWx_9o8k=@protonmail.com> In-Reply-To: <2sU6YozN9nn30cofkAMhffgjDLZwjG3mvF0nBgOsVQQEY9ROmP72GuHWjnBlF_qa8eeQPU8bxleZqcvRGJgS-uJ2xWYmAm9HjrFWWx_9o8k=@protonmail.com> From: Pieter Wuille Date: Tue, 12 Nov 2019 22:30:18 -0800 Message-ID: To: Bitcoin Dev Content-Type: multipart/alternative; boundary="00000000000052c29805973480f6" X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, HTML_MESSAGE, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org Subject: Re: [bitcoin-dev] Bech32 weakness and impact on bip-taproot addresses X-BeenThere: bitcoin-dev@lists.linuxfoundation.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Bitcoin Protocol Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 13 Nov 2019 06:30:32 -0000 --00000000000052c29805973480f6 Content-Type: text/plain; charset="UTF-8" On Tue, Nov 12, 2019, 21:33 ZmnSCPxj via bitcoin-dev < bitcoin-dev@lists.linuxfoundation.org> wrote: > Good morning all, > > It seems to me that adding the length for checksumming purposes need not > require the length to be *actually* added in the address format. > Indeed! This has the following properties: > > * The bech32 address format is retained, and no explicit length is added. > * There are now two checksum formats: one with just the witness program, > the other which validates with the witness program length. > * Readers that do not understand the new checksum format will simply > reject them without mis-sending to the wrong witness program. > That's very close to what I was suggesting: create an improved bech32 algorithm and use that for future addresses, rather than working around the problem in the address encoding while keeping the existing bech32 checksum. Sorry if that wasn't clear from my previous email. In this case, there is no need to even implicitly include the length in the checksum algorithm. Replacing the "xor 1" at the end of the algorithm to "xor (2^30 - 1)" would reduce the occurrence of this weakness from 1/32 to 1/2^30, and have no downsides otherwise. I'd like to do some analysis to ascertain it actually will catch any other kind of insertion/deletion errors with high probability as well before actually proposing it, though. There are other solutions which do include the length in some fashion directly in the checksum calculation, which may be preferable (I need to analyse things...). It's also possible to do this in such a way that for 33-symbol and 53-symbol data parts (corresponding to P2WPKH and P2WSH lengths) the new algorithm is defined as identical to the old one. That would simplify upstream users of a bech32 library (which would then effectively need no changes at all, apart from updating the checksum/decoder code). That brings me to Matt's point: there is no need to do this right now. We can simply amend BIP173 to only permit length 20 and length 32 (and only length 20 for v0, if you like; but they're so far apart that permitting both shouldn't hurt), for now. Introducing the "new" address format (the one using an improved checksum algorithm) only needs to be there in time for when a non-32-byte-witness-program would come in sight. Of course, I should update BIP173 to indicate the issue, and have a suggested improvement for other users of bech32, if they feel this issue is significant enough. Cheers, -- Pieter --00000000000052c29805973480f6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Tue, Nov 12, 2019, 21:33 ZmnSCPxj via bitcoin-dev <bitcoin-dev@lists.linuxfoundation.org> wrote:
Good morning all,

It seems to me that adding the length for checksumming purposes need not re= quire the length to be *actually* added in the address format.

Indeed!
=

This has the following properties:

* The bech32 address format is retained, and no explicit length is added. * There are now two checksum formats: one with just the witness program, th= e other which validates with the witness program length.
=C2=A0 * Readers that do not understand the new checksum format will simply= reject them without mis-sending to the wrong witness program.

That's ve= ry close to what I was suggesting: create an improved bech32 algorithm and = use that for future addresses, rather than working around the problem in th= e address encoding while keeping the existing bech32 checksum. Sorry if tha= t wasn't clear from my previous email.

In this case, there is no need to even implicitly includ= e the length in the checksum algorithm. Replacing the "xor 1" at = the end of the algorithm to "xor (2^30 - 1)" would reduce the occ= urrence of this weakness from 1/32 to 1/2^30, and have no downsides otherwi= se. I'd like to do some analysis to ascertain it actually will catch an= y other kind of insertion/deletion errors with high probability as well bef= ore actually proposing it, though.

There are other solutions which do include the length in som= e fashion directly in the checksum calculation, which may be preferable (I = need to analyse things...). It's also possible to do this in such a way= that for 33-symbol and 53-symbol data parts (corresponding to P2WPKH and P= 2WSH lengths) the new algorithm is defined as identical to the old one. Tha= t would simplify upstream users of a bech32 library (which would then effec= tively need no changes at all, apart from updating the checksum/decoder cod= e).

That brings me to Ma= tt's point: there is no need to do this right now. We can simply amend = BIP173 to only permit length 20 and length 32 (and only length 20 for v0, i= f you like; but they're so far apart that permitting both shouldn't= hurt), for now. Introducing the "new" address format (the one us= ing an improved checksum algorithm) only needs to be there in time for when= a non-32-byte-witness-program would come in sight.
=
Of course, I should update BIP173 to indicate t= he issue, and have a suggested improvement for other users of bech32, if th= ey feel this issue is significant enough.

=
Cheers,

--=C2=A0
Pieter

<= div dir=3D"auto">
--00000000000052c29805973480f6--