MIME-Version: 1.0
References: <CAMpN3mLtKXoFerZnpM_qs-CS6fjJFzmPS5+Ri0j27YwRmqam-A@mail.gmail.com>
	<cimBiAqniTMJ06jVVlflC_H15_eDo7hDkdcwrxK84-4IBKJIFaKr2c6NJCev85v633R-xcGQ9w0csmQMF0Zzq6Zr83uj2gDB2oWS531MKaM=@achow101.com>
In-Reply-To: <cimBiAqniTMJ06jVVlflC_H15_eDo7hDkdcwrxK84-4IBKJIFaKr2c6NJCev85v633R-xcGQ9w0csmQMF0Zzq6Zr83uj2gDB2oWS531MKaM=@achow101.com>
From: Jonathan Underwood <junderwood@bitcoinbank.co.jp>
Date: Wed, 10 Jul 2019 07:21:25 +0900
Message-ID: <CAMpN3mJ1qz0XZjHqBzEYNVe0d+YXV18VtMsxqn4D5gt45diZdg@mail.gmail.com>
To: Andrew Chow <achow101-lists@achow101.com>
Content-Type: multipart/alternative; boundary="000000000000ef94e9058d46fbbf"
Cc: Bitcoin development mailing list <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] BIP174 amendment proposal (Important Signer Check
 should be mentioned)
Precedence: list

--000000000000ef94e9058d46fbbf
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Andrew,

Ok, I will go ahead and write the amendment and make a PR.

Thanks!
Jon

2019=E5=B9=B47=E6=9C=8810=E6=97=A5(=E6=B0=B4) 5:26 Andrew Chow <achow101-li=
sts@achow101.com>:

> This was the original intent of the sighash field. Either the sighash is
> acceptable to the signer and the signer signs with it, or they do not sig=
n
> at all.
>
> On 7/9/19 11:58 AM, Jonathan Underwood via bitcoin-dev wrote:
>
> Hi all,
>
> Just to be brief, I'll kick off with an attack scenario.
>
> 1. I am a signer, I get a PSBT that is ready to sign. I parse. I sign
> according to the PSBT as-is.
> 2. I notice my UTXO was stolen by a hacker because they changed my PSBT
> input's sighashtype to SIGHASH_ANYONECANPAY | SIGHASH_NONE and after the
> fact they changed the outputs to send to themselves, and added an input
> they signed with SIGHASH_ALL.
> 3. I lose the BTC in my UTXO.
>
> So we should definitely add to the signer checks "ensure the sighash type
> given is the type of sighash you want to sign." etc.
>
> My proposal for a wording change would be addition to the bullet list:
>
> - If a sighash type is provided, the signer MUST check that the sighash
> type is acceptable to them, and fail signing if unacceptable.
> - If a sighash type is not provided, the signer SHOULD sign using
> SIGHASH_ALL, but may sign with any sighash type they wish.
>
> Any thoughts?
>
> Thanks,
> Jon
>
> --
> -----------------
> Jonathan Underwood
> =E3=83=93=E3=83=83=E3=83=88=E3=83=90=E3=83=B3=E3=82=AF=E7=A4=BE =E3=83=81=
=E3=83=BC=E3=83=95=E3=83=93=E3=83=83=E3=83=88=E3=82=B3=E3=82=A4=E3=83=B3=E3=
=82=AA=E3=83=95=E3=82=A3=E3=82=B5=E3=83=BC
> -----------------
>
> =E6=9A=97=E5=8F=B7=E5=8C=96=E3=81=97=E3=81=9F=E3=83=A1=E3=83=83=E3=82=BB=
=E3=83=BC=E3=82=B8=E3=82=92=E3=81=8A=E9=80=81=E3=82=8A=E3=81=AE=E6=96=B9=E3=
=81=AF=E4=B8=8B=E8=A8=98=E3=81=AE=E5=85=AC=E9=96=8B=E9=8D=B5=E3=82=92=E3=81=
=94=E5=88=A9=E7=94=A8=E4=B8=8B=E3=81=95=E3=81=84=E3=80=82
>
> =E6=8C=87=E7=B4=8B: 0xCE5EA9476DE7D3E45EBC3FDAD998682F3590FEA3
>
>
>

--000000000000ef94e9058d46fbbf
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto">Hi Andrew,<div dir=3D"auto"><br></div><div dir=3D"auto">O=
k, I will go ahead and write the amendment and make a PR.</div><div dir=3D"=
auto"><br></div><div dir=3D"auto">Thanks!</div><div dir=3D"auto">Jon</div><=
/div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">2=
019=E5=B9=B47=E6=9C=8810=E6=97=A5(=E6=B0=B4) 5:26 Andrew Chow &lt;<a href=
=3D"mailto:achow101-lists@achow101.com">achow101-lists@achow101.com</a>&gt;=
:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;bor=
der-left:1px #ccc solid;padding-left:1ex"><div>
    <font size=3D"-1">This was the original intent of the sighash field.
      Either the sighash is acceptable to the signer and the signer
      signs with it, or they do not sign at all.</font><br>
    <br>
    <div class=3D"m_-427630123853646621moz-cite-prefix">On 7/9/19 11:58 AM,=
 Jonathan Underwood
      via bitcoin-dev wrote:<br>
    </div>
    <blockquote type=3D"cite">
     =20
      <div dir=3D"ltr">Hi all,
        <div><br>
        </div>
        <div>Just to be brief, I&#39;ll kick off with an attack scenario.</=
div>
        <div><br>
        </div>
        <div>1. I am a signer, I get a PSBT that is ready to sign. I
          parse. I sign according to the PSBT as-is.<br>
          2. I notice my UTXO was stolen by a hacker because they
          changed my PSBT input&#39;s sighashtype to SIGHASH_ANYONECANPAY |
          SIGHASH_NONE and after the fact they changed the outputs to
          send to themselves, and added an input they signed with
          SIGHASH_ALL.</div>
        <div>3. I lose the BTC in my UTXO.</div>
        <div><br>
        </div>
        <div>So we should definitely add to the signer checks &quot;ensure
          the sighash type given is the type of sighash you want to
          sign.&quot; etc.</div>
        <div><br>
        </div>
        <div>My proposal for a wording change would be addition to the
          bullet list:</div>
        <div><br>
        </div>
        <div>- If a sighash type is provided, the signer MUST check that
          the sighash type is acceptable to them, and fail signing if
          unacceptable.</div>
        <div>- If a sighash type is not provided, the signer SHOULD sign
          using SIGHASH_ALL, but may sign with any sighash type they
          wish.</div>
        <div><br>
        </div>
        <div>Any thoughts?</div>
        <div><br>
        </div>
        <div>Thanks,</div>
        <div>Jon<br clear=3D"all">
          <div><br>
          </div>
          -- <br>
          <div dir=3D"ltr" class=3D"m_-427630123853646621gmail_signature" d=
ata-smartmail=3D"gmail_signature">
            <div dir=3D"ltr">
              <div>
                <div dir=3D"ltr">
                  <div dir=3D"ltr">
                    <div>-----------------<br>
                    </div>
                    <div>Jonathan Underwood</div>
                    <div>=E3=83=93=E3=83=83=E3=83=88=E3=83=90=E3=83=B3=E3=
=82=AF=E7=A4=BE=E3=80=80=E3=83=81=E3=83=BC=E3=83=95=E3=83=93=E3=83=83=E3=83=
=88=E3=82=B3=E3=82=A4=E3=83=B3=E3=82=AA=E3=83=95=E3=82=A3=E3=82=B5=E3=83=BC=
</div>
                    <div>-----------------</div>
                    <div><br>
                    </div>
                    <div>=E6=9A=97=E5=8F=B7=E5=8C=96=E3=81=97=E3=81=9F=E3=
=83=A1=E3=83=83=E3=82=BB=E3=83=BC=E3=82=B8=E3=82=92=E3=81=8A=E9=80=81=E3=82=
=8A=E3=81=AE=E6=96=B9=E3=81=AF=E4=B8=8B=E8=A8=98=E3=81=AE=E5=85=AC=E9=96=8B=
=E9=8D=B5=E3=82=92=E3=81=94=E5=88=A9=E7=94=A8=E4=B8=8B=E3=81=95=E3=81=84=E3=
=80=82</div>
                    <div><br>
                    </div>
                    <div>=E6=8C=87=E7=B4=8B: 0xCE5EA9476DE7D3E45EBC3FDAD998=
682F3590FEA3</div>
                  </div>
                </div>
              </div>
            </div>
          </div>
        </div>
      </div>
    </blockquote>
    <br>
 =20

</div></blockquote></div>

--000000000000ef94e9058d46fbbf--