Date: Tue, 5 Jun 2018 20:49:01 -0400
From: Peter Todd <pete@petertodd.org>
To: Johnson Lau <jl2012@xbt.hk>,
	Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Message-ID: <20180606004901.zqkpro2by7xj4jpc@petertodd.org>
References: <9FC9FA73-9572-48AF-9590-68F0D298D6A0@xbt.hk>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="vg2ioecb5bvrkrzd"
Content-Disposition: inline
In-Reply-To: <9FC9FA73-9572-48AF-9590-68F0D298D6A0@xbt.hk>
User-Agent: NeoMutt/20170113 (1.7.2)
Subject: Re: [bitcoin-dev] Disallow insecure use of SIGHASH_SINGLE
Precedence: list


--vg2ioecb5bvrkrzd
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Fri, Jun 01, 2018 at 02:53:01AM +0800, Johnson Lau via bitcoin-dev wrote:
> I=E2=80=99ve made a PR to add a new policy to disallow using SIGHASH_SING=
LE without matched output:
>=20
> https://github.com/bitcoin/bitcoin/pull/13360
>=20
> Signature of this form is insecure, as it commits to no output while user=
s might think it commits to one. It is even worse in non-segwit scripts, wh=
ich is effectively SIGHASH_NOINPUT|SIGHASH_NONE, so any UTXO of the same ke=
y could be stolen. (It=E2=80=99s restricted to only one UTXO in segwit, but=
 it=E2=80=99s still like a SIGHASH_NONE.)
>=20
> This is one of the earliest unintended consensus behavior. Since these si=
gnatures are inherently unsafe, I think it does no harm to disable this uni=
ntended =E2=80=9Cfeature=E2=80=9D with a softfork. But since these signatur=
es are currently allowed, the first step is to make them non-standard.

I don't see why we should bother to soft fork this out on the basis of
security, given that there are many other ways to insecurely use private ke=
ys
(e.g. reused nonces). Maybe soft-fork it out on the basis of code complexit=
y,
but this sounds like a lot of work.

Also, I have to wonder if it's just as likely the devs might think the
non-standardness means it is secure.

--=20
https://petertodd.org 'peter'[:-1]@petertodd.org

--vg2ioecb5bvrkrzd
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEFcyURjhyM68BBPYTJIFAPaXwkfsFAlsXL3gACgkQJIFAPaXw
kfsq8wf/eQgqEW2kyiOPj6qtMatonFsY8ob1uCaS7cJNIed4xW79nuHR88qWj6wr
unCxTFtCWrafSi595VHBqBss8ow19IplNAkcIPDAjmDA2uj2TNupYWtbakMJttWj
uNdPdOiPAjFnsYNwt0/3CR07bQeG6HKAyc/MP9/rqsdGNcxHxxBsq+cOamtwdAu6
dgrfFb1IgmViBtVD8xUXpFMjaNLMigZZWJ+GzKXcDTMcmb7SdDd+1PpLAKv/Pg6K
tcS40pCQEg6e+2Cf3Lu+Yf4XT/nriiRMCtsZDBWEvauhH4H7FDhfiUeXyu5dy1cn
QxeAXtS5dWOwcpvekNnBYclTJwk4hw==
=0gft
-----END PGP SIGNATURE-----

--vg2ioecb5bvrkrzd--