Date: Sun, 24 May 2020 00:52:13 +0000
To: Greg Sanders <gsanders87@gmail.com>,
 Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
From: ZmnSCPxj <ZmnSCPxj@protonmail.com>
Reply-To: ZmnSCPxj <ZmnSCPxj@protonmail.com>
Message-ID: <Ptq11JJF3B5h2X94dQdis8lFf7PSm_Hg9F2uITk4MhGcXULr3eiuF3GF71fEVZpcsNZ_s_nrRCXcUmxthQQq4vPQERQpUbCNYErVA9yuNNc=@protonmail.com>
In-Reply-To: <CAB3F3DtCgdWOPpTdr-cMcnRO1RE2isEAavGZSOTvtSi-0_x64w@mail.gmail.com>
References: <aa916637-befa-795a-caa1-e5ad50ce63c8@electrum.org>
 <CAB3F3DuGi_Uc0cf5eGvE9ej2d1RS8CVkf7xGBjR4uRf8jAmQhA@mail.gmail.com>
 <CAB3F3DtCgdWOPpTdr-cMcnRO1RE2isEAavGZSOTvtSi-0_x64w@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [bitcoin-dev] MIN_STANDARD_TX_NONWITNESS_SIZE and OP_RETURN
Precedence: list

Good morning Thomas,

> So I think the question to ask would be "why can't we just make sure it's=
 not 64?"

If we accept a 60-byte tx, then SHA-256 will pad it to 64 bytes, and it may=
 still be possible to mount CVE-2017-12842 attack with 32-bits of work.
Of course some other details will be changed from the standard SHA-256 in m=
ounting this attack, but from my poor understanding it seems safer to just =
avoid the area around length 64.

It *might* be safe to accept 65-byte or larger (but do not believe me, I on=
ly play a cryptographer on the Internet), but that does not help your speci=
fic application, which uses 60 byte tx.

Regards,
ZmnSCPxj

>
> On Sat, May 23, 2020 at 11:24 AM Greg Sanders <gsanders87@gmail.com> wrot=
e:
>
> > AFAIU the number was picked to protect against=C2=A0CVE-2017-12842 cove=
rtly. See:=C2=A0https://github.com/bitcoin/bitcoin/pull/16885=C2=A0which up=
dated the text to explicitly mention this fact.
> >
> > On Sat, May 23, 2020 at 11:20 AM Thomas Voegtlin via bitcoin-dev <bitco=
in-dev@lists.linuxfoundation.org> wrote:
> >
> > > Hello list,
> > >
> > > I have been trying to CPFP a transaction using OP_RETURN, because the
> > > remaining output value would have been lower than the dust threshold.
> > >
> > > The scriptPubkey of the output was OP_RETURN + OP_0, and there was a
> > > single p2wsh input.
> > >
> > > The result is a 60 bytes transaction (without witness), that gets
> > > rejected because it is lower than MIN_STANDARD_TX_NONWITNESS_SIZE, wh=
ich
> > > is equal to 82 bytes.
> > >
> > > Why is that value so high? Would it make sense to lower it to 60?
> > >
> > > Thomas
> > > _______________________________________________
> > > bitcoin-dev mailing list
> > > bitcoin-dev@lists.linuxfoundation.org
> > > https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev