OP_CODESEPARATOR in non-segwit scripts (even in an unexecuted branch), and makes a positive FindAndDelete result invalid. This ensures that the scriptCode serialized in SignatureHash is always the same as the script passing to the EvalScript.
I’d prefer we be consistent. Especially if OP_CODESEPARATOR has no meaning in SegWit transactions we should just make it nonstandard everywhere.
On September 29, 2017 6:18:36 PM EDT, Pieter Wuille notifications@github.com wrote:
Any reason to support OP_CODESEPARATOR inside P2WSH?
– You are receiving this because you were mentioned. Reply to this email directly or view it on GitHub: https://github.com/bitcoin/bitcoin/pull/11423#issuecomment-333252262
@sipa I think @NicolasDorier has something that use CODESEPARATOR. I think it could make the size of some contracts smaller.
This is actually part of the attempt to fix the pre-segwit quadratic sighash problem. A variable scriptCode makes sighash caching more difficult. That’s why I proposed to do it for pre-segwit only
0Any reason to support OP_CODESEPARATOR inside P2WSH?
YES, I am using it for tumblebit, it saves 33 bytes per outputs. It allows you to sign a specific branch with one key instead of having separate public key per branch. Please do not do that until we have at least MAST. (only if signing in MAST requires the scriptCode to depends on the executed branch)
OP_CODESEPARATOR is very useful, I am coupling it with SIGHASH_NONE. (The only case where SIGHASH_NONE is not similar to giving your private key)
Just to explain my case here: Imagine the following: Alice, expect Bob to publish a transaction satisfying the PAYMENT condition to get the preimage of <BOB_HASH>.
0OP_DEPTH 3 EQUAL
1OP_IF
2 2 <ALICE_KEY_PAYMENT> <BOB_KEY_PAYMENT> MULTICHECKSIGVERIFY HASH160 <BOB_HASH> EQUAL
3OP_ELSE
4 <ALICE_KEY_REDEEM> CHECKSIG CLTV DROP
5OP_END
If ALICE_KEY_PAYMENT == ALICE_KEY_REDEEM, this would be no good, as BOB could use Alice signature to satisfy the REDEEM condition, and get the money without revealing the pre image.
Now you can save 33 bytes this way. (untested, but it get the idea of what I do for TB)
0<ALICE_KEY>
1OP_DEPTH 3 EQUAL
2OP_IF
3 OP_SWAP <BOB_KEY_PAYMENT> CHECKSIGVERIFY HASH160 <BOB_HASH> EQUAL OP_CODESEP
4OP_ELSE
5 CLTV DROP
6OP_END
7CHECKSIG
Notice that Alice can just pass a SIGHASH_NONE signature for the first branch to Bob, so she does not have to know how bob will spend the txout, while still being sure she can get the preimage as soon as Bob try to cashout.
Concept ACK for removing on non-segwit scripts, but it should be kept for segwit. Using this trick, you can save quite a lot of data if there is lots of branches. (and also have more branches, since the scripts are limited to 512 bytes)
105@@ -106,6 +106,10 @@ enum
106 // Public keys in segregated witness scripts must be compressed
107 //
108 SCRIPT_VERIFY_WITNESS_PUBKEYTYPE = (1U << 15),
109+
110+ // Making OP_CODESEPARATOR and FindAndDelete non-standard in non-segwit scripts
FindAndDelete is not used anywhere in segwit
300@@ -301,6 +301,10 @@ bool EvalScript(std::vector<std::vector<unsigned char> >& stack, const CScript&
301 opcode == OP_RSHIFT)
302 return set_error(serror, SCRIPT_ERR_DISABLED_OPCODE); // Disabled opcodes.
303
304+ // OP_CODESEPARATOR in non-segwit transaction is invalid even in an unexecuted branch
utACK 0575b1831cd52987c76320d304674a27a140fe1f
300@@ -301,6 +301,10 @@ bool EvalScript(std::vector<std::vector<unsigned char> >& stack, const CScript&
301 opcode == OP_RSHIFT)
302 return set_error(serror, SCRIPT_ERR_DISABLED_OPCODE); // Disabled opcodes.
303
304+ // With SCRIPT_VERIFY_CONST_SCRIPTCODE, OP_CODESEPARATOR in non-segwit script is invalid even in an unexecuted branch
STANDARD_SCRIPT_VERIFY_FLAGS. A future soft fork could make it actually invalid depending on e.g. block height. Perhaps we should use a different word like “reject”?
This disables OP_CODESEPARATOR in non-segwit scripts (even in an unexecuted branch), and makes a positive FindAndDelete result invalid. This ensures that the scriptCode serialized in SignatureHash() is always the same as the script passing to the EvalScript.
Tests showing that CONST_SCRIPTCODE is applied only to non-segwit transactions
A transaction with 1 segwit input and 1 P2WPHK output has non-witness size of 82 bytes. Anything smaller than this have unnecessary malloc overhead and are not relayed/mined.
Labels
TX fees and policy
Validation
Milestone
0.16.1