Received-SPF: pass (sog-mx-3.v43.ch3.sourceforge.com: domain of gmail.com
	designates 74.125.82.53 as permitted sender)
	client-ip=74.125.82.53; envelope-from=mh.in.england@gmail.com;
	helo=mail-wg0-f53.google.com; 
MIME-Version: 1.0
Sender: mh.in.england@gmail.com
In-Reply-To: <CABHVRKSET18D13+yi4MTPs6+4xwUD5vuJszCOJG9CaTi0+CAvA@mail.gmail.com>
References: <CABHVRKTNFoLm9LEO=ctT_UP9zW7QOMQzVXitKC=PAzj=HG9OHg@mail.gmail.com>
	<CANEZrP12kZ8vRAo=feprJ9_oRXUPKJ=iF6kZdxxbai=TxjzM9g@mail.gmail.com>
	<CABHVRKSET18D13+yi4MTPs6+4xwUD5vuJszCOJG9CaTi0+CAvA@mail.gmail.com>
Date: Thu, 9 Apr 2015 16:45:35 +0200
Message-ID: <CANEZrP3mBibjUK99L=E9jHFAvQ0QLpx0ke112=yQjw-RhjWnyg@mail.gmail.com>
From: Mike Hearn <mike@plan99.net>
To: Stephen Morse <stephencalebmorse@gmail.com>
Content-Type: multipart/alternative; boundary=f46d04138cd552ae0805134bb3d7
Cc: bitcoin-development <bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] Build your own nHashType
Precedence: list

--f46d04138cd552ae0805134bb3d7
Content-Type: text/plain; charset=UTF-8

>
> I don't think it's quite a blank check, but it would enable replay attacks
> in the form of sending the money to the same place it was sent before if an
> address ever receives coins again.
>

Right, good point. I wonder if this sort of auto forwarding could even be a
useful feature. I can't think of one right now.


> It's hard, though, because there is different data needs to be signed for
> each input.
>

Yes but is that fundamental or is there a way to avoid it? That's what I'm
getting at.


> Another possibility would be to put the previous scriptPubKey and previous
> output value at the END of the serialized transaction, so that you could
> make use of some sort of a signature hash midstate.
>

Interesting idea! I don't agree it's messy. If anything it should be
simpler than what we have today - the need to edit a transaction *in the
middle* means that sighash computation involves constantly reserializing a
transaction before it even gets to be hashed.


> Is hashing transaction data once for each input really a huge bottleneck,
> though? Do mobile devices have an issue with this?
>

Consider what happens with very large transactions, like a big assurance
contract that might have thousands of inputs and be multiple megabytes in
size. Obviously such large transactions cannot happen today, but there is
user demand for giant contracts (or at least, users tell me there is,
whether they'd actually do it for real is a bit unclear).

--f46d04138cd552ae0805134bb3d7
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_extra"><div class=3D"gmail_quote"><blo=
ckquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #c=
cc solid;padding-left:1ex"><div dir=3D"ltr"><div class=3D"gmail_extra"><div=
 class=3D"gmail_quote"><div>I don&#39;t think it&#39;s quite a blank check,=
 but it would enable replay attacks in the form of sending the money to the=
 same place it was sent before if an address ever receives coins again. </d=
iv></div></div></div></blockquote><div><br></div><div>Right, good point. I =
wonder if this sort of auto forwarding could even be a useful feature. I ca=
n&#39;t think of one right now.</div><div>=C2=A0</div><blockquote class=3D"=
gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-=
left:1ex"><div dir=3D"ltr"><div class=3D"gmail_extra"><div class=3D"gmail_q=
uote"><div>It&#39;s hard, though, because there is different data needs to =
be signed for each input. </div></div></div></div></blockquote><div><br></d=
iv><div>Yes but is that fundamental or is there a way to avoid it? That&#39=
;s what I&#39;m getting at.</div><div>=C2=A0</div><blockquote class=3D"gmai=
l_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left=
:1ex"><div dir=3D"ltr"><div class=3D"gmail_extra"><div class=3D"gmail_quote=
"><div>Another possibility would be to put the previous scriptPubKey and pr=
evious output value at the END of the serialized transaction, so that you c=
ould make use of some sort of a signature hash midstate. </div></div></div>=
</div></blockquote><div><br></div><div>Interesting idea! I don&#39;t agree =
it&#39;s messy. If anything it should be simpler than what we have today - =
the need to edit a transaction <i>in the middle</i>=C2=A0means that sighash=
 computation involves constantly reserializing a transaction before it even=
 gets to be hashed.</div><div>=C2=A0</div><blockquote class=3D"gmail_quote"=
 style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><d=
iv dir=3D"ltr"><div class=3D"gmail_extra"><div class=3D"gmail_quote"><div>I=
s hashing transaction data once for each input really a huge bottleneck, th=
ough? Do mobile devices have an issue with this?</div></div></div></div></b=
lockquote><div><br></div><div>Consider what happens with very large transac=
tions, like a big assurance contract that might have thousands of inputs an=
d be multiple megabytes in size. Obviously such large transactions cannot h=
appen today, but there is user demand for giant contracts (or at least, use=
rs tell me there is, whether they&#39;d actually do it for real is a bit un=
clear).</div></div></div></div>

--f46d04138cd552ae0805134bb3d7--