Draft for Extra Data / HASH160 Support

bip-0119.2.mediawiki

@@ -0,0 +1,184 @@
+<pre>
+  BIP: 119.2 (Pending Assignment)
+  Layer: Consensus (soft fork)
+  Title: CHECKTEMPLATEVERIFY V2
+  Author: Jeremy Rubin <[email protected]>
+  Comments-URI: https://github.com/bitcoin/bips/wiki/Comments:BIP-0119
+  Status: Draft
+  Type: Standards Track
+  Created: 2024-05-06
+  License: BSD-3-Clause
+</pre>
+
+==Abstract==
+
+This BIP proposes extensions to OP_CHECKTEMPLATEVERIFY BIP-119 as enhancements
+for LN Symmetry based constructions which use CTV and CSFS.
+
+
+==Summary==
+
+Adds a 20-byte CTV hash using HASH160 digest to save 12 bytes per script.  Adds
+a 1-byte flag (with no bits set) that allows for arbitrary data to be committed
+to inside the CTV hash.
+
+==Motivation==
+
+LN Symmetry prefers scripts as small as possible. Allowing the use of HASH160
+can allow users to reduce fees in exchange for minor loss of security.
+
+LN Symmetry also sometimes requires additional committed data for data
+availability purposes. When using BIP-118 APO, this extra data can be
+(although, according to BIP-341/342 should not be) placed in the Annex. As CTV
+does not commit to the annex, additional data can be committed to in an
+OP_RETURN.  However, OP_RETURNs are inefficient as they require 8 bytes of
+value plus a few VarInts to encode sizes, and use non discounted blockspace.
+Instead, committing to with CTV extra values on the stack can avoid these
+overheads.
+
+
+==Detailed Specification==
+
+The below code is the main logic for verifying CHECKTEMPLATEVERIFY, described
+in pythonic pseudocode, with these modifications. The canonical specification
+for the semantics of OP_CHECKTEMPLATEVERIFY as implemented in C++ in the
+context of Bitcoin Core can be seen in the reference implementation (TODO).
+
+The execution of the opcode is as follows:
+<source lang="python">
+def execute_bip_119_v2(self):
+    # Before soft-fork activation / failed activation
+    # continue to treat as NOP4
+    if not self.flags.script_verify_default_check_template_verify_hash:
+        # Potentially set for node-local policy to discourage premature use
+        if self.flags.script_verify_discourage_upgradable_nops:
+            return self.errors_with(errors.script_err_discourage_upgradable_nops)
+        return self.return_as_nop()
+
+    # CTV always requires at least one stack argument
+    if len(self.stack) < 1:
+        return self.errors_with(errors.script_err_invalid_stack_operation)
+
+    # CTV only verifies the hash against a 32 byte argument
+    if len(self.stack[-1]) == 32:
+        # Ensure the precomputed data required for anti-DoS is available,
+        # or cache it on first use
+        if self.context.precomputed_ctv_data == None:
+            self.context.precomputed_ctv_data = self.context.tx.get_default_check_template_precomputed_data()
+
+        # If the hashes do not match, return error
+        if stack[-1] != self.context.tx.get_default_check_template_hash(self.context.nIn, self.context.precomputed_ctv_data):
+            return self.errors_with(errors.script_err_template_mismatch)
+
+        return self.return_as_nop()
+
+    # verifies the hash against a 20 byte argument
+    if len(self.stack[-1]) == 20:
+
+        # Before soft-fork activation / failed activation
+        # continue to treat as NOP4
+        if not self.flags.script_verify_default_check_template_verify_hash_v2:
+            # Potentially set for node-local policy to discourage premature use
+            if self.flags.script_verify_discourage_upgradable_nops:
+                return self.errors_with(errors.script_err_discourage_upgradable_nops)
+            return self.return_as_nop()
+
+
+        # Ensure the precomputed data required for anti-DoS is available,
+        # or cache it on first use
+        if self.context.precomputed_ctv_data == None:
+            self.context.precomputed_ctv_data = self.context.tx.get_default_check_template_precomputed_data()
+
+        # If the hashes do not match, return error
+        if stack[-1] != ripemd(self.context.tx.get_default_check_template_hash(self.context.nIn, self.context.precomputed_ctv_data)):
+            return self.errors_with(errors.script_err_template_mismatch)
+
+        return self.return_as_nop()
+
+    # verifies the hash against a 21 byte argument and extra data
+    if len(self.stack[-1]) == 21:
+        # CTV+data always requires at least two stack argument
+        if len(self.stack) < 2:
+            return self.errors_with(errors.script_err_invalid_stack_operation)
+
+        # Before soft-fork activation / failed activation
+        # continue to treat as NOP4
+        if not self.flags.script_verify_default_check_template_verify_hash_v2 or self.stack[-1][-1] != 0:
+            # Potentially set for node-local policy to discourage premature use
+            if self.flags.script_verify_discourage_upgradable_nops:
+                return self.errors_with(errors.script_err_discourage_upgradable_nops)
+            return self.return_as_nop()
+
+
+        # Ensure the precomputed data required for anti-DoS is available,
+        # or cache it on first use
+        if self.context.precomputed_ctv_data == None:
+            self.context.precomputed_ctv_data = self.context.tx.get_default_check_template_precomputed_data()
+
+        # If the hashes do not match, return error
+        if stack[-1][:-1] != ripemd(sha256(self.context.tx.get_default_check_template_hash(self.context.nIn, self.context.precomputed_ctv_data) + sha256(stack[-2]))):
+            return self.errors_with(errors.script_err_template_mismatch)
+
+        return self.return_as_nop()
+
+    # verifies the hash against a 33 byte argument and extra data
+    if len(self.stack[-1]) == 33:
+        # CTV+data always requires at least two stack argument
+        if len(self.stack) < 2:
+            return self.errors_with(errors.script_err_invalid_stack_operation)
+
+        # Before soft-fork activation / failed activation
+        # continue to treat as NOP4
+        if not self.flags.script_verify_default_check_template_verify_hash_v2 or self.stack[-1][-1] != 0:
+            # Potentially set for node-local policy to discourage premature use
+            if self.flags.script_verify_discourage_upgradable_nops:
+                return self.errors_with(errors.script_err_discourage_upgradable_nops)
+            return self.return_as_nop()
+
+
+        # Ensure the precomputed data required for anti-DoS is available,
+        # or cache it on first use
+        if self.context.precomputed_ctv_data == None:
+            self.context.precomputed_ctv_data = self.context.tx.get_default_check_template_precomputed_data()
+
+        # If the hashes do not match, return error
+        if stack[-1][:-1] != sha256(self.context.tx.get_default_check_template_hash(self.context.nIn, self.context.precomputed_ctv_data) + sha256(stack[-2])):
+            return self.errors_with(errors.script_err_template_mismatch)
+
+        return self.return_as_nop()
+
+    # future upgrade can add semantics for this opcode with different length args
+    # so discourage use when applicable
+    if self.flags.script_verify_discourage_upgradable_nops:
+        return self.errors_with(errors.script_err_discourage_upgradable_nops)
+    else:
+        return self.return_as_nop()
+</source>
+
+
+No additional DoS protection or caching is required, as the hashing overhead of
+the new opcode is similar to that of a regular OP_SHA256 or OP_HASH160.
+
+==Deployment==
+
+N/A
+==Reference Implementation==
+
+A reference implementation and tests are pending after conceptual agreement.
+
+
+===Alternatives===
+
+Should `OP_CAT` be added to Bitcoin, one would be able to use script fragments
+that sign the CTV hash concatenated with the extra data, which would be
+equivalent to this.
+
+Should `CSFS` sign an arbitrary number of stack elements as a vector
+commitment, this would also be equivalent.
+
+This BIP could be pared down to just provide the 20-byte version for
+efficiency.
+
+==Copyright==
+
+This document is licensed under the 3-clause BSD license.