MIME-Version: 1.0
References: <161946014-482cdec305e2bd7a2c3fc4774c70239d@pmq1v.m5r2.onet>
 <M80pb4TxcE1yCMCW4IboyTtx8MSvp8m9tphXe2EYvIvcrcf2Wzsn4ManJw8EP_ri-ohqtIOPrEaw7XkUcTO3lfVSLN4WMUwpromwzLm15Kc=@protonmail.com>
In-Reply-To: <M80pb4TxcE1yCMCW4IboyTtx8MSvp8m9tphXe2EYvIvcrcf2Wzsn4ManJw8EP_ri-ohqtIOPrEaw7XkUcTO3lfVSLN4WMUwpromwzLm15Kc=@protonmail.com>
From: "Russell O'Connor" <roconnor@blockstream.com>
Date: Wed, 11 May 2022 15:41:16 -0400
Message-ID: <CAMZUoKnzjcYDM-mOhT00P7YO18YmjxRkYsfO6QFtYFn0mEtLQw@mail.gmail.com>
To: ZmnSCPxj <ZmnSCPxj@protonmail.com>, 
 Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: multipart/alternative; boundary="00000000000094100a05dec1a09d"
Subject: Re: [bitcoin-dev] Speedy covenants (OP_CAT2)
Precedence: list

--00000000000094100a05dec1a09d
Content-Type: text/plain; charset="UTF-8"

On Wed, May 11, 2022 at 7:42 AM ZmnSCPxj via bitcoin-dev <
bitcoin-dev@lists.linuxfoundation.org> wrote:

> REMEMBER: `OP_CAT` BY ITSELF DOES NOT ENABLE COVENANTS, WHETHER RECURSIVE
> OR NOT.
>

I think the state of the art has advanced to the point where we can say
"OP_CAT in tapscript enables non recursive covenants and it is unknown
whether OP_CAT can enable recursive covenants or not".

A. Poelstra in
https://www.wpsoftware.net/andrew/blog/cat-and-schnorr-tricks-i.html show
how to use CAT to use the schnorr verification opcode to get the sighash
value + 1 onto the stack, and then through some grinding and some more CAT,
get the actual sighash value on the stack.  From there we can use SHA256 to
get the signed transaction data onto the stack and apply introspect (using
CAT) to build functionality similar to OP_CTV.

The missing bits for enabling recursive covenants comes down to needing to
transform a scriptpubkey into an taproot address, which involves some
tweaking.  Poelstra has suggested that it might be possible to hijack the
ECDSA checksig operation from a parallel, legacy input, in order to perform
the calculations for this tweaking.  But as far as I know no one has yet
been able to achieve this feat.

--00000000000094100a05dec1a09d
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_quote"><div>On Wed, May 11, 2022 at 7:=
42 AM ZmnSCPxj via bitcoin-dev &lt;<a href=3D"mailto:bitcoin-dev@lists.linu=
xfoundation.org">bitcoin-dev@lists.linuxfoundation.org</a>&gt; wrote: <br><=
/div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;bo=
rder-left:1px solid rgb(204,204,204);padding-left:1ex">
REMEMBER: `OP_CAT` BY ITSELF DOES NOT ENABLE COVENANTS, WHETHER RECURSIVE O=
R NOT.<br></blockquote><div><br></div><div>I think the state of the art has=
 advanced to the point where we can say &quot;OP_CAT in tapscript enables n=
on recursive covenants and it is unknown whether OP_CAT can enable recursiv=
e covenants or not&quot;.<br></div><div><br></div><div>A. Poelstra in <a hr=
ef=3D"https://www.wpsoftware.net/andrew/blog/cat-and-schnorr-tricks-i.html"=
>https://www.wpsoftware.net/andrew/blog/cat-and-schnorr-tricks-i.html</a> s=
how how to use CAT to use the schnorr verification opcode to get the sighas=
h value + 1 onto the stack, and then through some grinding and some more CA=
T, get the actual sighash value on the stack.=C2=A0 From there we can use S=
HA256 to get the signed transaction data onto the stack and apply introspec=
t (using CAT) to build functionality similar to OP_CTV.<br></div><div><br><=
/div><div>The missing bits for enabling recursive covenants comes down to n=
eeding to transform a scriptpubkey into an taproot address, which involves =
some tweaking.=C2=A0 Poelstra has suggested that it might be possible to hi=
jack the ECDSA checksig operation from a parallel, legacy input, in order t=
o perform the calculations for this tweaking.=C2=A0 But as far as I know no=
 one has yet been able to achieve this feat.</div><div><br></div><div><br><=
/div></div></div>

--00000000000094100a05dec1a09d--