<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">I find another proposed use of CODESEPARATOR here: <a href="https://lists.linuxfoundation.org/pipermail/lightning-dev/2016-March/000455.html" class="">https://lists.linuxfoundation.org/pipermail/lightning-dev/2016-March/000455.html</a><div class=""><br class=""></div><div class=""><pre style="white-space: pre-wrap; font-variant-ligatures: normal; orphans: 2; widows: 2;" class=""><KeyA> OP_CHECKSIG
OP_IF
<KeyB>
OP_ELSE
<Delay> OP_CSV OP_DROP
OP_CODESEPARATOR <KeyA>
OP_ENDIF
OP_CHECKSIG</pre><div class="">It is actually 2 scripts:</div><div class=""><br class=""></div><div class="">S1: <span style="orphans: 2; white-space: pre-wrap; widows: 2;" class=""><KeyA> OP_CHECKSIGVERIFY </span><span style="orphans: 2; white-space: pre-wrap; widows: 2;" class=""><KeyB> OP_CHECKSIG</span></div><div class=""><span style="orphans: 2; white-space: pre-wrap; widows: 2;" class="">S2: </span><span style="orphans: 2; white-space: pre-wrap; widows: 2;" class=""><Delay> OP_CSV OP_DROP <KeyA> </span><span style="orphans: 2; white-space: pre-wrap; widows: 2;" class="">OP_CHECKSIG</span></div><div class=""><br class=""></div><div class="">Under taproot, we could make Q = P + H(P||S2)G, where P = MuSig(KeyA, KeyB)</div><div class=""><br class=""></div><div class="">S1 becomes a direct spending with Q, and there is no need to use OP_IF or CODESEPARATOR in S2 at all.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">==================</div><div class=""><br class=""></div><div class="">If it is only to force R reuse, there is no need to use CODESEPARATOR:</div><div class=""><br class=""></div><div class="">Input: <R> <S2> <S1> Script: 2DUP EQUAL NOT VERIFY 2 PICK SWAP CAT <key> DUP TOALTSTACK CHECKSIGVERIFY CAT FROMALTSTACK CHECKSIG</div><div class=""><br class=""></div><div class="">But using CODESEPARATOR will save 3 bytes</div><div class="">Input: <S2> <R> <S1> Script: OVER SWAP CAT <key> DUP TOALTSTACK CHECKSIGVERIFY CODESEPARATOR SWAP CAT FROMALTSTACK CHECKSIG</div><div class=""><br class=""></div><div class=""><div>However, a much better way would be:</div><div><br class=""></div><div>Input: <S> Script: <known R> SWAP CAT <key> CHECKSIG</div><div><br class=""></div><div>The discrete log of R could be a shared secret between A and B. If the purpose is to publish the private key to the whole world, R = G could be used.</div><div><br class=""><blockquote type="cite" class=""><div class="">On 24 Dec 2018, at 8:01 PM, ZmnSCPxj <<a href="mailto:ZmnSCPxj@protonmail.com" class="">ZmnSCPxj@protonmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Good morning,<br class=""><br class=""><blockquote type="cite" class="">Could anyone propose a better use case of CODESEPARATOR?<br class=""></blockquote><br class="">Long ago, aj sent an email on Lightning-dev about use of CODESEPARATOR to impose Scriptless Script even without Schnorr. It involved 3 signatures with different CODESEPARATOR places, and forced R reuse so that the signatures to claim the funds revealed the privkey.<br class=""><br class="">The script shown had all CODESEPARATOR in a single branch.<br class=""><br class="">I cannot claim to understand the script, and am having difficulty digging through the mailinglist<br class=""><br class="">Regards,<br class="">ZmnSCPxj<br class=""></div></div></blockquote></div><br class=""></div></div></body></html>