Eric Lombrozo [ARCHIVE] on Nostr: 📅 Original date posted:2015-10-07 📝 Original message:That's why it's important ...
📅 Original date posted:2015-10-07
📝 Original message:That's why it's important to measure miner adoptance. Note that this isn't a vote - it's an adoption metric for what is presumably a fairly uncontroversial upgrade. If there's contentious controversy amongst miner all bets are off.
Our current mechanisms are imperfect in this regard...as we've seen in the past, miners have deliberately disabled checks despite signaling adoption in their blocks. But a real hashpower supermajority would make such attacks hard to pull off in practice.
- Eric
On October 7, 2015 8:46:08 AM PDT, "Jonathan Toomim (Toomim Bros) via bitcoin-dev" <bitcoin-dev at lists.linuxfoundation.org> wrote:
>
>On Oct 7, 2015, at 8:00 AM, Anthony Towns via bitcoin-dev
><bitcoin-dev at lists.linuxfoundation.org> wrote:
>
>> *But* a soft fork that only forbids transactions that would
>previously
>> not have been mined anyway should be the best of both worlds, as it
>> automatically reduces the liklihood of old miners building newly
>invalid
>> blocks to a vanishingly small probability; which means that upgraded
>> bitcoin nodes, non-upgraded bitcoin nodes, /and/ SPV clients *all*
>> continuing to work fine during the upgrade.
>
>I agree with pretty much everything you wrote except the above
>paragraph.
>
>An attacker can create a transaction that would be valid if it were an
>OP_NOP, but not valid if it were any more restrictive transaction. For
>example, an attacker might send 1 BTC to an address with . An old node
>would consider that OP_CLTV to be OP_NOP, so no signature is necessary
>for old nodes. Then the attacker buys something from a merchant running
>old node code or an SPV client, and spends the 1 BTC in that address in
>a way that is invalid according to OP_CLTV but valid according to
>OP_NOP, and includes a hefty fee. A miner on the old version includes
>this transaction into a block, thereby making the block invalid
>according to the new rules, and rejected by new-client miners. The
>merchant sees the 1-conf, and maybe even 2-conf, rejoices, and ships.
>The attacker then has until the OP_CLTV matures to double-spend the
>coin with new nodes using a valid signature.
>
>Basically, it's trivial to create transactions that exploit the
>difference in validation rules as long as miners are still on the old
>version to mine them. Transactions can be created that are guaranteed
>to be orphaned and trivially double-spendable. Attackers never have to
>risk actual losses. This can be done as long as miners continue to mine
>old-version blocks, regardless of their frequency.
>
>Those of you who know Script better than me: would this be an example
>of a transaction that would be spendable with a valid sig XOR with (far
>future date OR old code)?
>
>OP_DUP OP_HASH160 <pubkeyhash> OP_EQUALVERIFY OP_CHECKSIGVERIFY
>OP_PUSHDATA <locktime far in the future> OP_CLTV
>
>
>------------------------------------------------------------------------
>
>_______________________________________________
>bitcoin-dev mailing list
>bitcoin-dev at lists.linuxfoundation.org
>https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
--
Sent from my Android device with K-9 Mail. Please excuse my brevity.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20151007/cbd40201/attachment-0001.html>;
📝 Original message:That's why it's important to measure miner adoptance. Note that this isn't a vote - it's an adoption metric for what is presumably a fairly uncontroversial upgrade. If there's contentious controversy amongst miner all bets are off.
Our current mechanisms are imperfect in this regard...as we've seen in the past, miners have deliberately disabled checks despite signaling adoption in their blocks. But a real hashpower supermajority would make such attacks hard to pull off in practice.
- Eric
On October 7, 2015 8:46:08 AM PDT, "Jonathan Toomim (Toomim Bros) via bitcoin-dev" <bitcoin-dev at lists.linuxfoundation.org> wrote:
>
>On Oct 7, 2015, at 8:00 AM, Anthony Towns via bitcoin-dev
><bitcoin-dev at lists.linuxfoundation.org> wrote:
>
>> *But* a soft fork that only forbids transactions that would
>previously
>> not have been mined anyway should be the best of both worlds, as it
>> automatically reduces the liklihood of old miners building newly
>invalid
>> blocks to a vanishingly small probability; which means that upgraded
>> bitcoin nodes, non-upgraded bitcoin nodes, /and/ SPV clients *all*
>> continuing to work fine during the upgrade.
>
>I agree with pretty much everything you wrote except the above
>paragraph.
>
>An attacker can create a transaction that would be valid if it were an
>OP_NOP, but not valid if it were any more restrictive transaction. For
>example, an attacker might send 1 BTC to an address with . An old node
>would consider that OP_CLTV to be OP_NOP, so no signature is necessary
>for old nodes. Then the attacker buys something from a merchant running
>old node code or an SPV client, and spends the 1 BTC in that address in
>a way that is invalid according to OP_CLTV but valid according to
>OP_NOP, and includes a hefty fee. A miner on the old version includes
>this transaction into a block, thereby making the block invalid
>according to the new rules, and rejected by new-client miners. The
>merchant sees the 1-conf, and maybe even 2-conf, rejoices, and ships.
>The attacker then has until the OP_CLTV matures to double-spend the
>coin with new nodes using a valid signature.
>
>Basically, it's trivial to create transactions that exploit the
>difference in validation rules as long as miners are still on the old
>version to mine them. Transactions can be created that are guaranteed
>to be orphaned and trivially double-spendable. Attackers never have to
>risk actual losses. This can be done as long as miners continue to mine
>old-version blocks, regardless of their frequency.
>
>Those of you who know Script better than me: would this be an example
>of a transaction that would be spendable with a valid sig XOR with (far
>future date OR old code)?
>
>OP_DUP OP_HASH160 <pubkeyhash> OP_EQUALVERIFY OP_CHECKSIGVERIFY
>OP_PUSHDATA <locktime far in the future> OP_CLTV
>
>
>------------------------------------------------------------------------
>
>_______________________________________________
>bitcoin-dev mailing list
>bitcoin-dev at lists.linuxfoundation.org
>https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
--
Sent from my Android device with K-9 Mail. Please excuse my brevity.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20151007/cbd40201/attachment-0001.html>;