Re: [bitcoin-dev] RFC: BIP 322: Generic Signed Message Format
Greetings,
(The quoted proposal is already outdated, and I recommend you check
out the up to date formatted version here:
https://github.com/kallewoof/bips/blob/bip-generic-signmessage/bip-0322.mediawiki
The PR with comments is here: https://github.com/bitcoin/bips/pull/725)
A big part of the feedback boils down to conflicts of opinion related
to whether or not proofs should be given as transactions or not.
I am attempting to write down the pros and cons below, some of which
are contradictory/complementary based on multiple people's opinions.
Pros of using transaction format:
1. works out of the box with existing HSM:s, some of which may be
purposefully built to not be upgradable for security reasons (unless
sighash modified; see below)
2. easier to incorporate into existing software
3. forward compatible with bitcoin extensions (e.g. mimblewimble,
confidential transactions, etc)
4. HSM:s *should* be blind to whether or not a transaction or a
message or proof of funds is being signed (see Con #3)
Cons:
1. dangerous if challenger is able to convince prover to sign a
message that corresponds to an actual transaction; modifying sighash
is suggested, but defeats pro #1 above; can define in tx to have txin
as sighash to guarantee invalid on chain
2. unupgraded software are unable to make distinction between message
sign and transaction sign
3. if HSM:s do not support it and do not support upgrading, this is by
design, and message signing should be explicitly supported or not be
possible (see Pro #4)
4. severely cripples UX for hardware wallets that actually show the
contents of the transaction during the signing
If anyone has comments on this, it would be tremendously appreciated.
There is also a divided opinion on whether an "OP_MESSAGEONLY" opcode
should be introduced, but I'd like to address the above first, if
possible.
On Tue, Sep 11, 2018 at 1:41 PM Karl-Johan Alm
wrote:
>
> Hi.
>
> [note: BIP number was assigned to PR before this email was sent; I did
> not self-assign the BIP number]
>
> Below is a proposal to extend the existing sign/verifymessage format
> to a more generalized variant relying on the script verification
> mechanism in Bitcoin itself for message signing/verification, based on
> the original discussion
> (https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2018-March/015818.html)
> .
>
> PR is here: https://github.com/bitcoin/bips/pull/725
>
> A formatted version of this text can be seen here:
> https://github.com/kallewoof/bips/blob/bip-generic-signmessage/bip-generic-signmessage.mediawiki
>
> Note: I am not sure how to best deal with CLTV/CSV stuff here, ultimately.
>
> Note 2: I have received suggestions from several people to use a
> Bitcoin transaction instead. If someone could explain why this is
> beneficial, it would be very helpful. I'm not against it, just feels
> like the whole transaction part is unnecessary complexity/overhead.
>
> ---
>
> BIP: 322
> Layer: Applications
> Title: Generic Signed Message Format
> Author: Karl-Johan Alm
> Comments-Summary: No comments yet.
> Comments-URI: https://github.com/bitcoin/bips/wiki/Comments:BIP-0322
> Status: Draft
> Type: Standards Track
> Created: 2018-09-10
> License: CC0-1.0
>
>
> == Abstract ==
>
> A standard for interoperable generic signed messages based on the
> Bitcoin Script format.
>
> == Motivation ==
>
> The current message signing standard only works for P2PKH (1...)
> addresses. By extending it to use a Bitcoin Script based approach, it
> could be made more generic without causing a too big burden on
> implementers, who most likely have access to Bitcoin Script
> interpreters already.
>
> == Specification ==
>
> A new structure SignatureProof is added, which is a
> simple serializable scriptSig & witnessProgram container.
>
> Two actions "Sign" and "Verify" are defined.
>
> === SignatureProof container ===
>
> {|class="wikitable" style="text-align: center;"
> |-
> !Type
> !Length
> !Name
> !Comment
> |-
> |Uint32||4||flags||standard flags (1-to-1 with standard flags in Bitcoin Core)
> |-
> |VarInt||1-8||msglen||Number of bytes in message string, excluding NUL
> termination
> |-
> |Char*||[msglen]||msg||The message being signed for all subjects,
> excluding NUL termination
> |-
> |Uint8||1||entries||Number of proof entriesWhy support
> multiple proofs? In particular with proof of funds, it is
> non-trivial to check a large number of individual proofs (one per
> UTXO) for duplicates. Software could be written to do so, but it seems
> more efficient to build this check into the specification
> itself.
> |}
>
> The above is followed by [entries] number of signature entries:
>
> {|class="wikitable" style="text-align: center;"
> |-
> !Type
> !Length
> !Name
> !Comment
> |-
> |VarInt||1-8||scriptsiglen||Number of bytes in scriptSig data
> |-
> |Uint8*||[scriptsiglen]||scriptsig||ScriptSig data
> |-
> |VarInt||1-8||witlen||Number of bytes in witness program data
> |-
>
[bitcoin-dev] RFC: BIP 322: Generic Signed Message Format
Hi.
[note: BIP number was assigned to PR before this email was sent; I did
not self-assign the BIP number]
Below is a proposal to extend the existing sign/verifymessage format
to a more generalized variant relying on the script verification
mechanism in Bitcoin itself for message signing/verification, based on
the original discussion
(https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2018-March/015818.html)
.
PR is here: https://github.com/bitcoin/bips/pull/725
A formatted version of this text can be seen here:
https://github.com/kallewoof/bips/blob/bip-generic-signmessage/bip-generic-signmessage.mediawiki
Note: I am not sure how to best deal with CLTV/CSV stuff here, ultimately.
Note 2: I have received suggestions from several people to use a
Bitcoin transaction instead. If someone could explain why this is
beneficial, it would be very helpful. I'm not against it, just feels
like the whole transaction part is unnecessary complexity/overhead.
---
BIP: 322
Layer: Applications
Title: Generic Signed Message Format
Author: Karl-Johan Alm
Comments-Summary: No comments yet.
Comments-URI: https://github.com/bitcoin/bips/wiki/Comments:BIP-0322
Status: Draft
Type: Standards Track
Created: 2018-09-10
License: CC0-1.0
== Abstract ==
A standard for interoperable generic signed messages based on the
Bitcoin Script format.
== Motivation ==
The current message signing standard only works for P2PKH (1...)
addresses. By extending it to use a Bitcoin Script based approach, it
could be made more generic without causing a too big burden on
implementers, who most likely have access to Bitcoin Script
interpreters already.
== Specification ==
A new structure SignatureProof is added, which is a
simple serializable scriptSig & witnessProgram container.
Two actions "Sign" and "Verify" are defined.
=== SignatureProof container ===
{|class="wikitable" style="text-align: center;"
|-
!Type
!Length
!Name
!Comment
|-
|Uint32||4||flags||standard flags (1-to-1 with standard flags in Bitcoin Core)
|-
|VarInt||1-8||msglen||Number of bytes in message string, excluding NUL
termination
|-
|Char*||[msglen]||msg||The message being signed for all subjects,
excluding NUL termination
|-
|Uint8||1||entries||Number of proof entriesWhy support
multiple proofs? In particular with proof of funds, it is
non-trivial to check a large number of individual proofs (one per
UTXO) for duplicates. Software could be written to do so, but it seems
more efficient to build this check into the specification
itself.
|}
The above is followed by [entries] number of signature entries:
{|class="wikitable" style="text-align: center;"
|-
!Type
!Length
!Name
!Comment
|-
|VarInt||1-8||scriptsiglen||Number of bytes in scriptSig data
|-
|Uint8*||[scriptsiglen]||scriptsig||ScriptSig data
|-
|VarInt||1-8||witlen||Number of bytes in witness program data
|-
|Uint8*||[witlen]||wit||Witness program
|}
In some cases, the scriptsig may be empty (scriptsiglen=0).
=== Signing ===
The "Sign" action takes as input a scriptPubKey and a message (e.g.
"hello world"). It succeeds or fails.
# FAIL if scriptPubKey already exists in scriptPubKeys set, otherwise
insert itWhy track duplicates? Because a 3-entry
proof is not proving 3 scriptPubKeys unless they are all distinct, or
unless they are proving different UTXO:s (see Future Extensions)
# Derive the private key privkey for the scriptPubKey, or FAIL
# Define the message pre-image as the sequence "Bitcoin Message:"
concatenated with the message, encoded in UTF-8 using Normalization
Form Compatibility Decomposition (NFKD)
# Let sighash = sha256(sha256(scriptPubKey || pre-image))
# Generate a signature sig with privkey=privkey, sighash=sighash
Repeat the above operation for each scriptPubKey, retaining the
scriptPubKeys set. As noted, if the same scriptPubKey appears more
than once, the sign operation must fail.
=== Verifying ===
The "Verify" action takes as input a standard flags value, a
scriptPubKey, a message, a script sig, and a witness program.
It emits one of INCONCLUSIVE, VALID, INVALID, or ERROR.
# Return ERROR if scriptPubKey already exists in scriptPubKeys set,
otherwise insert it
# If one or more of the standard flags are unknown, return INCONCLUSIVE
# Define the message pre-image as the sequence "Bitcoin Message:"
concatenated with the message, encoded in UTF-8 using Normalization
Form Compatibility Decomposition (NFKD).
# Let sighash = sha256(sha256(scriptPubKey || pre-image))
# Verify Script with flags=standard flags, scriptSig=script sig,
scriptPubKey=scriptPubKey, witness=witness program, and
sighash=sighash
# Return VALID if verify succeeds, otherwise return INVALID
Repeat the above operation for each scriptPubKey, retaining the
scriptPubKeys set. As noted, if the same scriptPubKey appears more
than once, the verify operation must fail with an ERROR.
* If a verification call returns ERROR or INVALID, return ERROR or
INVALID immediately, ignoring as yet unverified entries.
