MIME-Version: 1.0
Date: Fri, 20 May 2016 05:57:46 -0500
Message-ID: <CAAEDBiEB_RXBjrLB8kDb52bJOwZK-arVeHA_9LyoDgAraLKHNg@mail.gmail.com>
From: Matthew Roberts <matthew@roberts.pm>
To: bitcoin-dev@lists.linuxfoundation.org
Content-Type: multipart/alternative; boundary=001a1140f6bafc741c053343f5b8
Subject: [bitcoin-dev] BIP: OP_PRANDOM
Precedence: list

--001a1140f6bafc741c053343f5b8
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

=3D=3D Background

OP_PRANDOM is a new op code for Bitcoin that pushes a pseudo-random number
to the top of the stack based on the next N block hashes. The source of the
pseudo-random number is defined as the XOR of the next N block hashes after
confirmation of a transaction containing the OP_PRANDOM encumbered output.
When a transaction containing the op code is redeemed, the transaction
receives a pseudo-random number based on the next N block hashes after
confirmation of the redeeming input. This means that transactions are also
effectively locked until at least N new blocks have been found.


=3D=3D Rational

Making deterministic, verifiable, and trustless pseudo-random numbers
available for use in the Script language makes it possible to support a
number of new smart contracts. OP_PRANDOM would allow for the simplistic
creation of purely decentralized lotteries without the need for complicated
multi-party computation protocols. Gambling is also another possibility as
contracts can be written based on hashed commitments, with the winner
chosen if a given commitment is closest to the pseudo-random number.
OP_PRANDOM could also be used for cryptographically secure virtual asset
management such as rewards in video games and in other applications.


=3D=3D Security

Pay-to-script-hash can be used to protect the details of contracts that use
OP_PRANDOM from the prying eyes of miners. However, since there is also a
non-zero risk that a participant in a contract may attempt to bribe a miner
the inclusion of multiple block hashes as a source of randomness is a must.
Every miner would effectively need to be bribed to ensure control over the
results of the random numbers, which is already very unlikely. The risk
approaches zero as N goes up.

There is however another issue: since the random numbers are based on a
changing blockchain, its problematic to use the next immediate block hashes
before the state is =E2=80=9Cfinal.=E2=80=9D A safe default for accepting t=
he blockchain
state as final would need to be agreed upon beforehand, otherwise you could
have multiple random outputs becoming valid simultaneously on different
forks.

A simple solution is not to reveal any commitments before the chain height
surpasses a certain point but this might not be an issue since only one
version will eventually make it into the final chain anyway -- though it is
something to think about.


=3D=3D Outro

I'm not sure how secure this is or whether its a good idea so posting it
here for feedback

Thoughts?

--001a1140f6bafc741c053343f5b8
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">


=09
=09
=09
=09


<p style=3D"margin-bottom:0in;line-height:100%">=3D=3D Background

</p><p style=3D"margin-bottom:0in;line-height:100%">OP_PRANDOM is a new
op code for Bitcoin that pushes a pseudo-random number to the top of
the stack based on the next N block hashes. The source of the
pseudo-random number is defined as the XOR of the next N block hashes
after confirmation of a transaction containing the OP_PRANDOM
encumbered output. When a transaction containing the op code is
redeemed, the transaction receives a pseudo-random number based on
the next N block hashes after confirmation of the redeeming input.
This means that transactions are also effectively locked until at
least N new blocks have been found.</p>
<p style=3D"margin-bottom:0in;line-height:100%"><br>
</p>
<p style=3D"margin-bottom:0in;line-height:100%">=3D=3D Rational</p>

<p style=3D"margin-bottom:0in;line-height:100%">Making
deterministic, verifiable, and trustless pseudo-random numbers
available for use in the Script language makes it possible to support
a number of new smart contracts. OP_PRANDOM would allow for the
simplistic creation of purely decentralized lotteries without the
need for complicated multi-party computation protocols. Gambling is
also another possibility as contracts can be written based on hashed
commitments, with the winner chosen if a given commitment is closest
to the pseudo-random number. OP_PRANDOM could also be used for
cryptographically secure virtual asset management such as rewards in
video games and in other applications.</p>
<p style=3D"margin-bottom:0in;line-height:100%"><br>
</p>
<p style=3D"margin-bottom:0in;line-height:100%">=3D=3D Security</p>

<p style=3D"margin-bottom:0in;line-height:100%">Pay-to-script-hash
can be used to protect the details of contracts that use OP_PRANDOM
from the prying eyes of miners. However, since there is also a
non-zero risk that a participant in a contract may attempt to bribe a
miner the inclusion of multiple block hashes as a source of
randomness is a must. Every miner would effectively need to be bribed
to ensure control over the results of the random numbers, which is
already very unlikely. The risk approaches zero as N goes up.</p>

<p style=3D"margin-bottom:0in;line-height:100%">There is however
another issue: since the random numbers are based on a changing
blockchain, its problematic to use the next immediate block hashes
before the state is =E2=80=9Cfinal.=E2=80=9D A safe default for accepting t=
he
blockchain state as final would need to be agreed upon beforehand, otherwis=
e you
could have multiple random outputs becoming valid simultaneously on
different forks.</p><p style=3D"margin-bottom:0in;line-height:100%">A simpl=
e solution is not to reveal any commitments before the chain height surpass=
es a certain point but this might not be an issue since only one version
will eventually make it into the final chain anyway -- though it is somethi=
ng to think about.</p>
<p style=3D"margin-bottom:0in;line-height:100%"><br>
</p>
<p style=3D"margin-bottom:0in;line-height:100%">=3D=3D Outro</p>

<p style=3D"margin-bottom:0in;line-height:100%">I&#39;m not sure how
secure this is or whether its a good idea so posting it here for
feedback</p>

<p style=3D"margin-bottom:0in;line-height:100%">Thoughts?</p>

</div>

--001a1140f6bafc741c053343f5b8--