From: Rusty Russell <rusty@rustcorp.com.au>
To: Johnson Lau <jl2012@xbt.hk>, Anthony Towns <aj@erisian.com.au>,
	bitcoin-dev <bitcoin-dev@lists.linuxfoundation.org>
In-Reply-To: <F9FE2267-0BCB-4C67-9AE8-3285B7459D51@xbt.hk>
References: <CAPg+sBhuPG-2GXc+Bp0yv5ywry2fk56LPLT4AY0Kcs+YEoz4FA@mail.gmail.com>
	<87ftv3xerx.fsf@rustcorp.com.au>
	<DAAB7568-A004-4897-B5B3-0FBBC6895246@xbt.hk>
	<87pnu6s3v5.fsf@rustcorp.com.au> <87h8fiqn1z.fsf@rustcorp.com.au>
	<20181214093002.p2nvfrlaycqblww3@erisian.com.au>
	<F9FE2267-0BCB-4C67-9AE8-3285B7459D51@xbt.hk>
Date: Mon, 17 Dec 2018 13:40:42 +1030
Message-ID: <87mup4hmq5.fsf@rustcorp.com.au>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [bitcoin-dev] Safer sighashes and more granular SIGHASH_NOINPUT
Precedence: list

Johnson Lau <jl2012@xbt.hk> writes:
> I don=E2=80=99t think this has been mentioned: without signing the script=
 or masked script, OP_CODESEPARATOR becomes unusable or insecure with NOINP=
UT.
>
> In the new sighash proposal, we will sign the hash of the full script (or=
 masked script), without any truncation. To make OP_CODESEPARATOR works lik=
e before, we will commit to the position of the last executed OP_CODESEPARA=
TOR. If NOINPUT doesn=E2=80=99t commit to the masked script, it will just b=
lindly committing to a random OP_CODESEPARATOR position, which a wallet cou=
ldn=E2=80=99t know what codes are actually being executed.

My anti-complexity argument leads me to ask why we'd support
OP_CODESEPARATOR at all?  Though my argument is weaker here: no wallet
need support it.

But I don't see how OP_CODESEPARATOR changes anything here, wrt NOINPUT?
Remember, anyone can create an output which can be spent by any NOINPUT,
whether we go for OP_MASK or simply not commiting to the input script.

Confused,
Rusty.