<div dir="ltr">I hadn't thought of that... There is a solution, I think, but it makes the operation less simple.<div><br></div><div>If a transaction contains at least two OP_TXHASHVERIFY-protected inputs, signed without ANYONECANPAY, their signatures would cover the other input's OP_TXHASHVERIFY hash, right?</div><div><div><br></div><div><br></div><div> /Rune</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Sat, Sep 17, 2016 at 10:56 PM, Matt Corallo <span dir="ltr"><<a href="mailto:lf-lists@mattcorallo.com" target="_blank">lf-lists@mattcorallo.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>(removing the list)<br>
<br>
Because the tx hash in your construction is not signed, someone wishing to maleate a transaction may do so by also updating the hash in the scriptSig.<br>
<br>
Matt<br><br><div class="gmail_quote"><div><div class="h5">On September 17, 2016 4:45:17 PM EDT, "Rune K. Svendsen via bitcoin-dev" <<a href="mailto:bitcoin-dev@lists.linuxfoundation.org" target="_blank">bitcoin-dev@lists.<wbr>linuxfoundation.org</a>> wrote:</div></div><blockquote class="gmail_quote" style="margin:0pt 0pt 0pt 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><div class="h5">
<div dir="ltr">I would really like to be able to create transactions that are immune to transaction ID malleability now, so I have been thinking of the simplest solution possible, in order to get a BIP through without too much trouble.<div><br></div><div>An opcode we could call OP_TXHASHVERIFY could be introduced. It would be defined to work only if added to a scriptSig as the very first operation, and would abort if the hash of the transaction **with all OP_TXHASHVERIFY operations (including stack push) removed** does not match what has been pushed on the stack.</div><div><br></div><div>So, in order to produce a transaction with one or more inputs protected against tx ID malleability, one would:</div><div><br></div><div>1. Calculate tx ID of the tx: TX_HASH</div><div>2. For each input you wish to protect, add "0x32 $TX_HASH OP_TXHASHVERIFY" to the beginning of the scriptSig</div><div><br></div><div>When evaluating OP_TXHASHVERIFY, we make a copy of the tx in
question, and remove the "0x32 <32 bytes> OP_TXHASHVERIFY" sequence from the beginning of all scriptSigs (if present), and abort if the tx copy hash does not match the top stack item.</div><div><br></div><div>This is a very simple solution that only adds 34 bytes per input, and when something better becomes available (eg. Segwit), we will stop using this. But in the meantime it's very valuable to be able to not worry about tx ID malleability.</div><div><br></div><div>Please let me know what you think.</div><div><br></div><div><br></div><div><br></div><div> /Rune</div></div>
<p style="margin-top:2.5em;margin-bottom:1em;border-bottom:1px solid #000"></p></div></div><pre><hr><br>bitcoin-dev mailing list<br><a href="mailto:bitcoin-dev@lists.linuxfoundation.org" target="_blank">bitcoin-dev@lists.<wbr>linuxfoundation.org</a><br><a href="https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev" target="_blank">https://lists.linuxfoundation.<wbr>org/mailman/listinfo/bitcoin-<wbr>dev</a><br></pre></blockquote></div></div></blockquote></div><br></div></div>