bip-341: Commit to all scriptPubKeys in SigMsg

[jonasnick]

As discussed on the mailing list.

CC @sipa @ajtowns

[gmaxwell]

Is there a discussion as to why amounts and scriptpubkey are separately hashed instead of just being one hash interleaved with the amounts? (more similar to the anyonecan pay case)

[jonasnick]

Yes, the current design was suggested by @roconnor on the mailing list (https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2020-May/017808.html) because it saves signers from receiving and hashing the scriptPubKeys if they're just interested in the amounts.

[gmaxwell]

I can't figure out what use a signer would have for the scriptpubkeys without the values. Values without scriptpubkeys would be useful if the signer is always going to assume all inputs are its own.

[jonasnick]

Yeah, scriptPubKeys but not values seems useless. But since values without scriptPubKeys are useful, hashing them separately is better than having a single hash for all TxOuts. Or am I misunderstanding your suggestion?

[gmaxwell]

Hm. On the basis that scripts without amounts are likely not useful the commitment to scriptpubkeys could be inside the commitment to the amounts, which I think would save some hashing in verifiers and reduce data needing to be sent to signers that don't care about either, but I suppose it doesn't matter much.

[sipa]

ACK, also included in bitcoin/bitcoin#17977 now.

[ajtowns]

ACK

[gmaxwell]

ACK

[prusnak]

ACK