MIME-Version: 1.0
In-Reply-To: <20160816194332.GA5888@fedora-21-dvm>
References: <1736097121.90204.1471369988809@privateemail.com>
	<201608161937.20748.luke@dashjr.org>
	<20160816194332.GA5888@fedora-21-dvm>
From: "Russell O'Connor" <roconnor@blockstream.io>
Date: Tue, 16 Aug 2016 18:23:00 -0400
Message-ID: <CAMZUoKkAkGRFxpyGMxQMz76L7uW6fsQAYVxkrxi5MQCiBtNnqw@mail.gmail.com>
To: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: multipart/alternative; boundary=94eb2c1227d0d8890a053a37cb55
Subject: Re: [bitcoin-dev] New BIP: Dealing with OP_IF and OP_NOTIF
 malleability in P2WSH
Precedence: list

--94eb2c1227d0d8890a053a37cb55
Content-Type: text/plain; charset=UTF-8

On Tue, Aug 16, 2016 at 3:43 PM, Peter Todd via bitcoin-dev <
bitcoin-dev@lists.linuxfoundation.org> wrote:

> On Tue, Aug 16, 2016 at 07:37:19PM +0000, Luke Dashjr via bitcoin-dev
> wrote:
> > On Tuesday, August 16, 2016 5:53:08 PM Johnson Lau via bitcoin-dev wrote:
> > > A new BIP is prepared to deal with OP_IF and OP_NOTIF malleability in
> > > P2WSH:
> > > https://github.com/jl2012/bips/blob/minimalif/bip-minimalif.mediawiki
> > > https://github.com/bitcoin/bitcoin/pull/8526
> >
> > I am not sure this makes sense. SegWit transactions are already
> non-malleable
> > due to skipping the witness data in calculating the transaction id. What
> is
> > the benefit to this?
>
> SegWit txids aren't malleable, but segwit transactions as a whole still
> are.
> For instance, I could mess with a segwit transaction by replacing part of
> the
> witness that is used as an argument to an OP_IF with a much larger push,
> potentially making the transaction larger, thus making it not get mined
> due to
> the higher fee. There are also potential legal issues if someone replaces a
> push with data where posession in your jurisdiction is illegal.
>

If one's goal is to mess with an transaction to prevent it from being
mined, it is more effective to just not relay the transaction rather than
to mess with the witness.  Given two transactions with the same txid and
different witness data, miners and good nodes ought to mine/relay the
version with the lower cost (smaller?) witness data.

Worries about "illegal data" appearing in the blockchain is not an issue
worth writing a soft-fork over.

There may be good reasons for this BIP, but I don't think the reasons give
above are good.

--94eb2c1227d0d8890a053a37cb55
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><br><div class=3D"gmail_extra"><br><div class=3D"gmail_quo=
te">On Tue, Aug 16, 2016 at 3:43 PM, Peter Todd via bitcoin-dev <span dir=
=3D"ltr">&lt;<a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.org" targe=
t=3D"_blank">bitcoin-dev@lists.linuxfoundation.org</a>&gt;</span> wrote:<br=
><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1=
px #ccc solid;padding-left:1ex"><span class=3D"">On Tue, Aug 16, 2016 at 07=
:37:19PM +0000, Luke Dashjr via bitcoin-dev wrote:<br>
&gt; On Tuesday, August 16, 2016 5:53:08 PM Johnson Lau via bitcoin-dev wro=
te:<br>
&gt; &gt; A new BIP is prepared to deal with OP_IF and OP_NOTIF malleabilit=
y in<br>
&gt; &gt; P2WSH:<br>
&gt; &gt; <a href=3D"https://github.com/jl2012/bips/blob/minimalif/bip-mini=
malif.mediawiki" rel=3D"noreferrer" target=3D"_blank">https://github.com/jl=
2012/<wbr>bips/blob/minimalif/bip-<wbr>minimalif.mediawiki</a><br>
&gt; &gt; <a href=3D"https://github.com/bitcoin/bitcoin/pull/8526" rel=3D"n=
oreferrer" target=3D"_blank">https://github.com/bitcoin/<wbr>bitcoin/pull/8=
526</a><br>
&gt;<br>
&gt; I am not sure this makes sense. SegWit transactions are already non-ma=
lleable<br>
&gt; due to skipping the witness data in calculating the transaction id. Wh=
at is<br>
&gt; the benefit to this?<br>
<br>
</span>SegWit txids aren&#39;t malleable, but segwit transactions as a whol=
e still are.<br>
For instance, I could mess with a segwit transaction by replacing part of t=
he<br>
witness that is used as an argument to an OP_IF with a much larger push,<br=
>
potentially making the transaction larger, thus making it not get mined due=
 to<br>
the higher fee. There are also potential legal issues if someone replaces a=
<br>
push with data where posession in your jurisdiction is illegal.<br></blockq=
uote><div><br></div><div>If one&#39;s goal is to mess with an transaction t=
o prevent it from being mined, it is more effective to just not relay the t=
ransaction rather than to mess with the witness.=C2=A0 Given two transactio=
ns with the same txid and different witness data, miners and good nodes oug=
ht to mine/relay the version with the lower cost (smaller?) witness data.<b=
r><br></div><div>Worries about &quot;illegal data&quot; appearing in the bl=
ockchain is not an issue worth writing a soft-fork over.<br><br></div><div>=
There may be good reasons for this BIP, but I don&#39;t think the reasons g=
ive above are good.</div></div><br></div></div>

--94eb2c1227d0d8890a053a37cb55--