Content-Type: text/plain;
	charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 12.0 \(3445.100.39\))
From: Johnson Lau <jl2012@xbt.hk>
In-Reply-To: <CAMZUoKkJdU0P_dVRvHn5zY6xUHYUptdK221ioQMp3FXZAerp3Q@mail.gmail.com>
Date: Mon, 10 Dec 2018 03:13:34 +0800
Content-Transfer-Encoding: quoted-printable
Message-Id: <702FE74C-119C-4D14-BCD3-85C4355356A2@xbt.hk>
References: <CAPg+sBhuPG-2GXc+Bp0yv5ywry2fk56LPLT4AY0Kcs+YEoz4FA@mail.gmail.com>
	<CAPg+sBiu0BjZEtz-t7m3M+TnAEDG_k1GKtxwkOKh6qrSezUO7g@mail.gmail.com>
	<CAMZUoKkJdU0P_dVRvHn5zY6xUHYUptdK221ioQMp3FXZAerp3Q@mail.gmail.com>
To: Russell O'Connor <roconnor@blockstream.io>,
	bitcoin-dev <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Safer sighashes and more granular SIGHASH_NOINPUT
Precedence: list

The current proposal is that a 64-byte signature will be used for the =
default =E2=80=9Csigning all=E2=80=9D sighash, and 65-byte for other =
sighash types. The space saved will allow a few more txs in a block, so =
I think it worths doing. However, this also makes witness weight =
estimation more difficult in multisig cases.

This idea of signing witness weight has been brought up before. I think =
the concern is the difficulty to estimate the witness weight for complex =
scripts, which need this feature most. So it will work when it is not =
needed, and will not work when it is needed.

Is there any script example that witness size malleability is =
unavoidable?

> On 7 Dec 2018, at 12:57 AM, Russell O'Connor via bitcoin-dev =
<bitcoin-dev@lists.linuxfoundation.org> wrote:
>=20
> One more item to consider is "signature covers witness weight".
>=20
> While signing the witness weight doesn't completely eliminate witness =
malleability (of the kind that can cause grief for compact blocks), it =
does eliminate the worst kind of witness malleability from the user's =
perspective, the kind where malicious relay nodes increase the amount of =
witness data and therefore reduce the overall fee-rate of the =
transaction.  Generally users should strive to construct their Bitcoin =
Scripts in such a way that witness malleability isn't possible, but as =
you are probably aware, this can be quite difficult to achieve as =
Scripts become more complex and maybe isn't even possible for some =
complex Scripts.
>=20
> Given the new fixed-sized signature of the Schnorr BIP, it becomes =
much easier to compute the final witness weight prior to signing.  In =
complex multi-party signing protocol, the final witness weight might not =
be known at signing time for everyone involved, so the "signature covers =
witness weight" ought to be optional.
>=20
>=20