Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

spec: add ASICBOOST mitigation #7

Merged

Conversation

indutny
Copy link
Contributor

@indutny indutny commented Apr 6, 2017

Our current commitment scheme is vulnerable to the collision scheme exploited in ASICBOOST devices. It is an open question how this should be handled, but it does sound right to me that we should at least match SEGWIT's behavior to compete with it on fair grounds.

Calculating merkle-root over extension block transactions is not enough, since it still allows "shaking" the TX list in the canonical block without changing the commitment.

@chjj chjj merged commit abefb6c into tothemoon-org:master Apr 6, 2017
@indutny indutny deleted the feature/asicboost-secure-commitment branch April 6, 2017 23:31
@indutny
Copy link
Contributor Author

indutny commented Apr 6, 2017

Thank you!

@chjj
Copy link
Member

chjj commented Apr 6, 2017

Thanks Fedor. Not sure why nobody mentioned this to us on the bitcoin-dev mailing list when I asked for suggestions on how to construct the commitment, but oh well.

@chjj
Copy link
Member

chjj commented Apr 6, 2017

We also might want to start requiring the commitment on every block after activation. Mining ext. blocks would still be opt-in, but now all miners would need to upgrade. Shouldn't be an issue assuming 95% activation threshold.

@josephpoon
Copy link
Collaborator

josephpoon commented Apr 7, 2017

While it is not entirely up to us to decide on this aspect of the specification, we believe that this is what the specification could look like with a specific mitigation.

A change to the specification which adds features such as a malleability fix on the canonical block or committed bloom filter SPV validation of both canonical blockchain (main-chain) and extension block may conflict (but incidentally fulfill) this pull request and we may improve the extension block specification as a result of that design conflict. Doing so would result in removing and superseding this pull request as those features are more important.

We had previously discussed with various miners, at a meeting that we are interested in committed bloom filters and they sounded interested in the idea of decentralized proofs as a better SPV mode. Part of the SPV mode may require an additional specific commitment to the hash of a compact mapping of all input TXOs and outputs of transaction position to avoid full-block download in the event of a hit as an optional speed-privacy tradeoff (but required for block creation) for users doing partial observation of the blockchain.

Note that we do not have any personal opinions on this pull request's particular aspect of implementation and it is up to Developers, Miners, Industry, and Users to support whether this is a good idea. Ultimately, activation of the end result of this specification is an indication of miner approval.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants