Re: [bitcoin-dev] Replay attacks make BIP148 and BIP149 untennable

[Conner Fromknecht via bitcoin-dev]

I don't normally post here, but I'm sorry, if you don't see those two as
equal, then I think you have misunderstood the *entire* value proposition
of cryptocurrencies.

The state of any cryptocurrency should entirely (and only) be defined by
its ledger. If the state of the system can be altered outside of the rules
governing its ledger, then the system isn't secure. It doesn't matter
whether the people making those changes are the ones that are leading the
project or not. An "irregular state change" is a fancy term for a bailout.

I'm sure I speak for more than myself in saying that an "irregular state
change" is equivalent to modifying the underlying ledger. Let's not let
semantics keep us from recognizing what actually took place.

-Conner

On Wed, Jun 7, 2017 at 14:14 Nick Johnson via bitcoin-dev <
bitcoin-dev@lists.linuxfoundation.org> wrote:

> On Wed, Jun 7, 2017 at 5:27 PM Tao Effect  wrote:
>
>> Nick,
>>
>> Please don't spread misinformation. Whatever you think of the DAO hard
>> fork, it's a simple fact that the Ethereum ledger was not edited.
>>
>>
>> This sort of email is unhelpful to this conversation, and it certainly
>> doesn't help with the perception that Ethereum is nothing but a bunch of
>> hypocritical Bankers 2.0.
>>
>
>
>>
>> Everyone knows you didn't edit Ethereum Classic, but the the hard fork,
>> which was re-branded as Ethereum, was edited.
>>
>
> That's not what I was suggesting. My point is that the ledger was never
> edited. An 'irregular state change' was added at a specific block height,
> but the ledger remains inviolate.
>
> I'm sure I don't have to explain the difference between the ledger and the
> state to you, or why it's significant that the ledger wasn't (and can't be,
> practically) modified.
>
> -Nick
>
>
>> - Greg
>>
>> --
>> Please do not email me anything that you are not comfortable also sharing 
>> with
>> the NSA.
>>
>> On Jun 7, 2017, at 6:25 AM, Nick Johnson  wrote:
>>
>> On Wed, Jun 7, 2017 at 12:02 AM Gregory Maxwell via bitcoin-dev <
>> bitcoin-dev@lists.linuxfoundation.org> wrote:
>>
>>> On Tue, Jun 6, 2017 at 10:39 PM, Tao Effect via bitcoin-dev
>>>  wrote:
>>> > I believe the severity of replay attacks is going unvoiced and is not
>>> > understood within the bitcoin community because of their lack of
>>> experience
>>> > with them.
>>>
>>> Please don't insult our community-- the issues with replay were
>>> pointed out by us to Ethereum in advance and were cited specifically
>>> in prior hardfork discussions long before Ethereum started editing
>>> their ledger for the economic benefit of its centralized
>>> administrators.
>>
>>
>> Please don't spread misinformation. Whatever you think of the DAO hard
>> fork, it's a simple fact that the Ethereum ledger was not edited.
>>
>> -Nick Johnson
>>
>>
>> ___
> bitcoin-dev mailing list
> bitcoin-dev@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>
___
bitcoin-dev mailing list
bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev

Re: [bitcoin-dev] Replay attacks make BIP148 and BIP149 untennable

[Nick Johnson via bitcoin-dev]

On Thu, Jun 8, 2017 at 6:44 AM Conner Fromknecht  wrote:

> I don't normally post here, but I'm sorry, if you don't see those two as
> equal, then I think you have misunderstood the *entire* value proposition
> of cryptocurrencies.
>
> The state of any cryptocurrency should entirely (and only) be defined by
> its ledger. If the state of the system can be altered outside of the rules
> governing its ledger, then the system isn't secure.


This is true of any blockchain: you can always change the rules with the
consent of the participants.


> It doesn't matter whether the people making those changes are the ones
> that are leading the project or not. An "irregular state change" is a fancy
> term for a bailout.
>
> I'm sure I speak for more than myself in saying that an "irregular state
> change" is equivalent to modifying the underlying ledger. Let's not let
> semantics keep us from recognizing what actually took place.
>

It's not; modifying the ledger would rewrite history, erasing the record of
the original transactions. That's a fundamentally different operation, both
technically and semantically.


> -Conner
>
> On Wed, Jun 7, 2017 at 14:14 Nick Johnson via bitcoin-dev <
> bitcoin-dev@lists.linuxfoundation.org> wrote:
>
>> On Wed, Jun 7, 2017 at 5:27 PM Tao Effect  wrote:
>>
>>> Nick,
>>>
>>> Please don't spread misinformation. Whatever you think of the DAO hard
>>> fork, it's a simple fact that the Ethereum ledger was not edited.
>>>
>>>
>>> This sort of email is unhelpful to this conversation, and it certainly
>>> doesn't help with the perception that Ethereum is nothing but a bunch of
>>> hypocritical Bankers 2.0.
>>>
>>
>>
>>>
>>> Everyone knows you didn't edit Ethereum Classic, but the the hard fork,
>>> which was re-branded as Ethereum, was edited.
>>>
>>
>> That's not what I was suggesting. My point is that the ledger was never
>> edited. An 'irregular state change' was added at a specific block height,
>> but the ledger remains inviolate.
>>
>> I'm sure I don't have to explain the difference between the ledger and
>> the state to you, or why it's significant that the ledger wasn't (and can't
>> be, practically) modified.
>>
>> -Nick
>>
>>
>>> - Greg
>>>
>>> --
>>> Please do not email me anything that you are not comfortable also sharing 
>>> with
>>> the NSA.
>>>
>>> On Jun 7, 2017, at 6:25 AM, Nick Johnson  wrote:
>>>
>>> On Wed, Jun 7, 2017 at 12:02 AM Gregory Maxwell via bitcoin-dev <
>>> bitcoin-dev@lists.linuxfoundation.org> wrote:
>>>
 On Tue, Jun 6, 2017 at 10:39 PM, Tao Effect via bitcoin-dev
  wrote:
 > I believe the severity of replay attacks is going unvoiced and is not
 > understood within the bitcoin community because of their lack of
 experience
 > with them.

 Please don't insult our community-- the issues with replay were
 pointed out by us to Ethereum in advance and were cited specifically
 in prior hardfork discussions long before Ethereum started editing
 their ledger for the economic benefit of its centralized
 administrators.
>>>
>>>
>>> Please don't spread misinformation. Whatever you think of the DAO hard
>>> fork, it's a simple fact that the Ethereum ledger was not edited.
>>>
>>> -Nick Johnson
>>>
>>>
>>> ___
>> bitcoin-dev mailing list
>> bitcoin-dev@lists.linuxfoundation.org
>> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>>
>
___
bitcoin-dev mailing list
bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev

Re: [bitcoin-dev] Replay attacks make BIP148 and BIP149 untennable

[Nick Johnson via bitcoin-dev]

On Wed, Jun 7, 2017 at 5:27 PM Tao Effect  wrote:

> Nick,
>
> Please don't spread misinformation. Whatever you think of the DAO hard
> fork, it's a simple fact that the Ethereum ledger was not edited.
>
>
> This sort of email is unhelpful to this conversation, and it certainly
> doesn't help with the perception that Ethereum is nothing but a bunch of
> hypocritical Bankers 2.0.
>


>
> Everyone knows you didn't edit Ethereum Classic, but the the hard fork,
> which was re-branded as Ethereum, was edited.
>

That's not what I was suggesting. My point is that the ledger was never
edited. An 'irregular state change' was added at a specific block height,
but the ledger remains inviolate.

I'm sure I don't have to explain the difference between the ledger and the
state to you, or why it's significant that the ledger wasn't (and can't be,
practically) modified.

-Nick


> - Greg
>
> --
> Please do not email me anything that you are not comfortable also sharing with
> the NSA.
>
> On Jun 7, 2017, at 6:25 AM, Nick Johnson  wrote:
>
> On Wed, Jun 7, 2017 at 12:02 AM Gregory Maxwell via bitcoin-dev <
> bitcoin-dev@lists.linuxfoundation.org> wrote:
>
>> On Tue, Jun 6, 2017 at 10:39 PM, Tao Effect via bitcoin-dev
>>  wrote:
>> > I believe the severity of replay attacks is going unvoiced and is not
>> > understood within the bitcoin community because of their lack of
>> experience
>> > with them.
>>
>> Please don't insult our community-- the issues with replay were
>> pointed out by us to Ethereum in advance and were cited specifically
>> in prior hardfork discussions long before Ethereum started editing
>> their ledger for the economic benefit of its centralized
>> administrators.
>
>
> Please don't spread misinformation. Whatever you think of the DAO hard
> fork, it's a simple fact that the Ethereum ledger was not edited.
>
> -Nick Johnson
>
>
>
___
bitcoin-dev mailing list
bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev

Re: [bitcoin-dev] Replay attacks make BIP148 and BIP149 untennable

[Tao Effect via bitcoin-dev]

Nick,

> Please don't spread misinformation. Whatever you think of the DAO hard fork, 
> it's a simple fact that the Ethereum ledger was not edited.

This sort of email is unhelpful to this conversation, and it certainly doesn't 
help with the perception that Ethereum is nothing but a bunch of hypocritical 
Bankers 2.0.

Everyone knows you didn't edit Ethereum Classic, but the the hard fork, which 
was re-branded as Ethereum, was edited.

- Greg

--
Please do not email me anything that you are not comfortable also sharing with 
the NSA.

> On Jun 7, 2017, at 6:25 AM, Nick Johnson  > wrote:
> 
> On Wed, Jun 7, 2017 at 12:02 AM Gregory Maxwell via bitcoin-dev 
>  > wrote:
> On Tue, Jun 6, 2017 at 10:39 PM, Tao Effect via bitcoin-dev
>  > wrote:
> > I believe the severity of replay attacks is going unvoiced and is not
> > understood within the bitcoin community because of their lack of experience
> > with them.
> 
> Please don't insult our community-- the issues with replay were
> pointed out by us to Ethereum in advance and were cited specifically
> in prior hardfork discussions long before Ethereum started editing
> their ledger for the economic benefit of its centralized
> administrators.
> 
> Please don't spread misinformation. Whatever you think of the DAO hard fork, 
> it's a simple fact that the Ethereum ledger was not edited.
> 
> -Nick Johnson



signature.asc
Description: Message signed with OpenPGP
___
bitcoin-dev mailing list
bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev

Re: [bitcoin-dev] Replay attacks make BIP148 and BIP149 untennable

[Nick Johnson via bitcoin-dev]

On Wed, Jun 7, 2017 at 12:02 AM Gregory Maxwell via bitcoin-dev <
bitcoin-dev@lists.linuxfoundation.org> wrote:

> On Tue, Jun 6, 2017 at 10:39 PM, Tao Effect via bitcoin-dev
>  wrote:
> > I believe the severity of replay attacks is going unvoiced and is not
> > understood within the bitcoin community because of their lack of
> experience
> > with them.
>
> Please don't insult our community-- the issues with replay were
> pointed out by us to Ethereum in advance and were cited specifically
> in prior hardfork discussions long before Ethereum started editing
> their ledger for the economic benefit of its centralized
> administrators.


Please don't spread misinformation. Whatever you think of the DAO hard
fork, it's a simple fact that the Ethereum ledger was not edited.

-Nick Johnson
___
bitcoin-dev mailing list
bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev

[bitcoin-dev] Replay attacks make BIP148 and BIP149 untennable

[Tao Effect via bitcoin-dev]

This is just me putting in my formal objection to BIP148 and BIP149 based on my 
experience with the ETH/ETC hard fork and involvement in that drama.

First, it's important to note that ETC/ETH HF is a very different situation 
from BIP148 and all other soft-forks. To those on this mailing list, the 
reasons should be self-evident (one results in two incompatible chains, the 
other doesn't).

However, replay attacks are common to both possibilities (i.e. when BIP148 has 
<51% hash power).

I believe the severity of replay attacks is going unvoiced and is not 
understood within the bitcoin community because of their lack of experience 
with them.

I further believe that replay attacks are the #1 issue with BIP148, BIP149, 
etc., superseding wipeout attacks in severity.

These are not baseless beliefs, they're born out of experience and I think 
anyone will reach the same conclusion upon study.

In a nutshell, replay attacks mean that all talk of there being potentially 
"two coins" as a result of BIP148 is basically nonsense.

Replay attacks effectively eliminate that possibility.

When users go to "sell their legacy coins", they've just sold their 148 coins, 
and vice versa.

Both of the coin-splitting techniques given so far by the proponents BIP148 are 
also untenable:

- Double-spending to self with nLockTime txns is insanely complicated, risky, 
not guaranteed to work, extremely time consuming, and would likely result in a 
massive increase in backlogged transactions and increased fees.

- Mixing with 148 coinbase txns destroys fungibility.

Without a coin, there is no real threat from BIP148. Without that threat, there 
is no point to BIP148, and the miners know this.

These and other concerns are outlined and explained in more detail in this 
conversation I had yesterday with John Light:

https://www.youtube.com/watch?v=33rL3-p8cPw 


Cheers,
Greg Slepak

--
Please do not email me anything that you are not comfortable also sharing with 
the NSA.



signature.asc
Description: Message signed with OpenPGP
___
bitcoin-dev mailing list
bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev

Re: [bitcoin-dev] Replay attacks make BIP148 and BIP149 untennable

[Kekcoin via bitcoin-dev]

I was merely describing that the only failure mode of using "post-split 
coinbases from the legacy chain" as seedcoins for cointainting purposes would 
be a resolution of the coinsplit, thereby rendering the cointainting redundant, 
therefore this would be an entirely safe approach to cointainting, as the only 
way coins could become untainted (and therefore subject to the threat of replay 
attacks) would coincide with a disappearance of the situation that gave rise to 
such replay attacks in the first place. This should sufficiently answer your 
concerns regarding lack of replay protection in case of medium-to-long-term 
chainsplits in general. If you fail to grok, please read again until you don't.

Sent with [ProtonMail](https://protonmail.com) Secure Email.

 Original Message 
Subject: Re: [bitcoin-dev] Replay attacks make BIP148 and BIP149 untennable
Local Time: June 7, 2017 3:38 AM
UTC Time: June 7, 2017 12:38 AM
From: cont...@taoeffect.com
To: Kekcoin <kekc...@protonmail.com>
Anthony Towns <a...@erisian.com.au>, bitcoin-dev@lists.linuxfoundation.org 
<bitcoin-dev@lists.linuxfoundation.org>

Please read my email more carefully; the replay threat would be moot because 
there would be no alternative chain to replay the TX on,

In order to *get to that point*, you need >51%.

Not only that, but, if you started out with <51%, then you need >>51% in order 
to *catch up* and replace the large number of blocks added to the legacy chain 
in the mean time.

So, since >51% is _required_ for BIP148 to succeed (and likely >>51%)... you 
might as well do as SegWit did originally, or lower the threshold to 80% or 
something (as BIP91 does).

Without replay protection at the outset, BIP148, as far as I can tell, isn't a 
threat to miners.

--
Please do not email me anything that you are not comfortable also sharing with 
the NSA.

On Jun 6, 2017, at 5:29 PM, Kekcoin <kekc...@protonmail.com> wrote:

Please read my email more carefully; the replay threat would be moot because 
there would be no alternative chain to replay the TX on, as the non-148 chain 
would have been reorganized into oblivion.

Sent with [ProtonMail](https://protonmail.com/) Secure Email.

-------- Original Message ----
Subject: Re: [bitcoin-dev] Replay attacks make BIP148 and BIP149 untennable
Local Time: June 7, 2017 3:26 AM
UTC Time: June 7, 2017 12:26 AM
From: cont...@taoeffect.com
To: Kekcoin <kekc...@protonmail.com>
Anthony Towns <a...@erisian.com.au>, bitcoin-dev@lists.linuxfoundation.org 
<bitcoin-dev@lists.linuxfoundation.org>

I don't know what you mean by "render the replay threat moot."

If you don't have replay protection, replay is always a threat. A very serious 
one.

--
Please do not email me anything that you are not comfortable also sharing with 
the NSA.

On Jun 6, 2017, at 5:19 PM, Kekcoin <kekc...@protonmail.com> wrote:

Hmm, that's not the difference I was talking about. I was referring to the fact 
that using "post-chainsplit coinbases from the non-148 chain" to unilaterally 
(ie. can be done without action on the 148-chain) taint coins is more secure in 
extreme-adverserial cases such as secret-mining reorg attacks (as unfeasibly 
expensive they may be); the only large-scale (>100 block) reorganization the 
non-148 chain faces should be a resolution of the chainsplit and therefore 
render the replay threat moot.___
bitcoin-dev mailing list
bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev

Re: [bitcoin-dev] Replay attacks make BIP148 and BIP149 untennable

[Tao Effect via bitcoin-dev]

> Please read my email more carefully; the replay threat would be moot because 
> there would be no alternative chain to replay the TX on,

In order to *get to that point*, you need >51%.

Not only that, but, if you started out with <51%, then you need >>51% in order 
to *catch up* and replace the large number of blocks added to the legacy chain 
in the mean time.

So, since >51% is _required_ for BIP148 to succeed (and likely >>51%)... you 
might as well do as SegWit did originally, or lower the threshold to 80% or 
something (as BIP91 does).

Without replay protection at the outset, BIP148, as far as I can tell, isn't a 
threat to miners.

--
Please do not email me anything that you are not comfortable also sharing with 
the NSA.

> On Jun 6, 2017, at 5:29 PM, Kekcoin <kekc...@protonmail.com 
> <mailto:kekc...@protonmail.com>> wrote:
> 
> Please read my email more carefully; the replay threat would be moot because 
> there would be no alternative chain to replay the TX on, as the non-148 chain 
> would have been reorganized into oblivion.
> 
> 
> Sent with ProtonMail <https://protonmail.com/> Secure Email.
> 
>> ---- Original Message ----
>> Subject: Re: [bitcoin-dev] Replay attacks make BIP148 and BIP149 untennable
>> Local Time: June 7, 2017 3:26 AM
>> UTC Time: June 7, 2017 12:26 AM
>> From: cont...@taoeffect.com <mailto:cont...@taoeffect.com>
>> To: Kekcoin <kekc...@protonmail.com <mailto:kekc...@protonmail.com>>
>> Anthony Towns <a...@erisian.com.au <mailto:a...@erisian.com.au>>, 
>> bitcoin-dev@lists.linuxfoundation.org 
>> <mailto:bitcoin-dev@lists.linuxfoundation.org> 
>> <bitcoin-dev@lists.linuxfoundation.org 
>> <mailto:bitcoin-dev@lists.linuxfoundation.org>>
>> 
>> I don't know what you mean by "render the replay threat moot."
>> 
>> If you don't have replay protection, replay is always a threat. A very 
>> serious one.
>> 
>> --
>> Please do not email me anything that you are not comfortable also sharing 
>> with the NSA.
>> 
>>> On Jun 6, 2017, at 5:19 PM, Kekcoin <kekc...@protonmail.com 
>>> <mailto:kekc...@protonmail.com>> wrote:
>>> 
>>> Hmm, that's not the difference I was talking about. I was referring to the 
>>> fact that using "post-chainsplit coinbases from the non-148 chain" to 
>>> unilaterally (ie. can be done without action on the 148-chain) taint coins 
>>> is more secure in extreme-adverserial cases such as secret-mining reorg 
>>> attacks (as unfeasibly expensive they may be); the only large-scale (>100 
>>> block) reorganization the non-148 chain faces should be a resolution of the 
>>> chainsplit and therefore render the replay threat moot.
>>> 
> 



signature.asc
Description: Message signed with OpenPGP
___
bitcoin-dev mailing list
bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev

Re: [bitcoin-dev] Replay attacks make BIP148 and BIP149 untennable

[Kekcoin via bitcoin-dev]

Please read my email more carefully; the replay threat would be moot because 
there would be no alternative chain to replay the TX on, as the non-148 chain 
would have been reorganized into oblivion.

Sent with [ProtonMail](https://protonmail.com) Secure Email.

 Original Message 
Subject: Re: [bitcoin-dev] Replay attacks make BIP148 and BIP149 untennable
Local Time: June 7, 2017 3:26 AM
UTC Time: June 7, 2017 12:26 AM
From: cont...@taoeffect.com
To: Kekcoin <kekc...@protonmail.com>
Anthony Towns <a...@erisian.com.au>, bitcoin-dev@lists.linuxfoundation.org 
<bitcoin-dev@lists.linuxfoundation.org>

I don't know what you mean by "render the replay threat moot."

If you don't have replay protection, replay is always a threat. A very serious 
one.

--
Please do not email me anything that you are not comfortable also sharing with 
the NSA.

On Jun 6, 2017, at 5:19 PM, Kekcoin <kekc...@protonmail.com> wrote:

Hmm, that's not the difference I was talking about. I was referring to the fact 
that using "post-chainsplit coinbases from the non-148 chain" to unilaterally 
(ie. can be done without action on the 148-chain) taint coins is more secure in 
extreme-adverserial cases such as secret-mining reorg attacks (as unfeasibly 
expensive they may be); the only large-scale (>100 block) reorganization the 
non-148 chain faces should be a resolution of the chainsplit and therefore 
render the replay threat moot.___
bitcoin-dev mailing list
bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev

Re: [bitcoin-dev] Replay attacks make BIP148 and BIP149 untennable

[Tao Effect via bitcoin-dev]

I don't know what you mean by "render the replay threat moot."

If you don't have replay protection, replay is always a threat. A very serious 
one.

--
Please do not email me anything that you are not comfortable also sharing with 
the NSA.

> On Jun 6, 2017, at 5:19 PM, Kekcoin  > wrote:
> 
> Hmm, that's not the difference I was talking about. I was referring to the 
> fact that using "post-chainsplit coinbases from the non-148 chain" to 
> unilaterally (ie. can be done without action on the 148-chain) taint coins is 
> more secure in extreme-adverserial cases such as secret-mining reorg attacks 
> (as unfeasibly expensive they may be); the only large-scale (>100 block) 
> reorganization the non-148 chain faces should be a resolution of the 
> chainsplit and therefore render the replay threat moot.
> 



signature.asc
Description: Message signed with OpenPGP
___
bitcoin-dev mailing list
bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev

Re: [bitcoin-dev] Replay attacks make BIP148 and BIP149 untennable

[Kekcoin via bitcoin-dev]

Hmm, that's not the difference I was talking about. I was referring to the fact 
that using "post-chainsplit coinbases from the non-148 chain" to unilaterally 
(ie. can be done without action on the 148-chain) taint coins is more secure in 
extreme-adverserial cases such as secret-mining reorg attacks (as unfeasibly 
expensive they may be); the only large-scale (>100 block) reorganization the 
non-148 chain faces should be a resolution of the chainsplit and therefore 
render the replay threat moot.

Sent with [ProtonMail](https://protonmail.com) Secure Email.

 Original Message 
Subject: Re: [bitcoin-dev] Replay attacks make BIP148 and BIP149 untennable
Local Time: June 7, 2017 3:04 AM
UTC Time: June 7, 2017 12:04 AM
From: cont...@taoeffect.com
To: Kekcoin <kekc...@protonmail.com>
Anthony Towns <a...@erisian.com.au>, bitcoin-dev@lists.linuxfoundation.org 
<bitcoin-dev@lists.linuxfoundation.org>

You keep referring to 148 coinbase coins, what is the rationale behind this? 
Why would you prefer using 148 coinbases over legacy coinbases for this purpose?

OK, maybe "post-UASF coinbase coins" is a better term? I just wanted to make it 
clear that this refers to coins that come from blocks generated after the UASF 
is activated.

--
Please do not email me anything that you are not comfortable also sharing with 
the NSA.

On Jun 6, 2017, at 4:59 PM, Kekcoin <kekc...@protonmail.com> wrote:

You keep referring to 148 coinbase coins, what is the rationale behind this? 
Why would you prefer using 148 coinbases over legacy coinbases for this purpose?

Sent with [ProtonMail](https://protonmail.com/) Secure Email.___
bitcoin-dev mailing list
bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev

Re: [bitcoin-dev] Replay attacks make BIP148 and BIP149 untennable

[Tao Effect via bitcoin-dev]

> You keep referring to 148 coinbase coins, what is the rationale behind this? 
> Why would you prefer using 148 coinbases over legacy coinbases for this 
> purpose?

OK, maybe "post-UASF coinbase coins" is a better term? I just wanted to make it 
clear that this refers to coins that come from blocks generated after the UASF 
is activated.

--
Please do not email me anything that you are not comfortable also sharing with 
the NSA.

> On Jun 6, 2017, at 4:59 PM, Kekcoin  > wrote:
> 
> You keep referring to 148 coinbase coins, what is the rationale behind this? 
> Why would you prefer using 148 coinbases over legacy coinbases for this 
> purpose?
> 
> 
> Sent with ProtonMail  Secure Email.



signature.asc
Description: Message signed with OpenPGP
___
bitcoin-dev mailing list
bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev

Re: [bitcoin-dev] Replay attacks make BIP148 and BIP149 untennable

[Kekcoin via bitcoin-dev]

You keep referring to 148 coinbase coins, what is the rationale behind this? 
Why would you prefer using 148 coinbases over legacy coinbases for this purpose?

Sent with [ProtonMail](https://protonmail.com) Secure Email.

 Original Message 
Subject: Re: [bitcoin-dev] Replay attacks make BIP148 and BIP149 untennable
Local Time: June 7, 2017 2:27 AM
UTC Time: June 6, 2017 11:27 PM
From: bitcoin-dev@lists.linuxfoundation.org
To: Anthony Towns <a...@erisian.com.au>
bitcoin-dev@lists.linuxfoundation.org

CoinJoin works as a method of both improving fungibility and mixing with
coinbase transactions.

My understanding is that the two situations are quite different.

Unlike mixing to coin-split, CoinJoin doesn't create a high demand exclusively 
for coinbase transactions.

However, of the proposed methods, coin-mixing seems the better option, because 
it might be reasonably easy (I don't know) for exchanges to obtain 148 coinbase 
coins, and mix their coins with them, extending the coin-splitting capability 
beyond just miner coins and then using that to split incoming coins.

That seems like the most reasonable approach I've heard so far. Whether 
exchanges would be willing to do that is a separate question.

When it's confirmed on one chain, but not on the other, you
can then "double-spend" on the lower hashrate chain with a higher fee,
to end up with different coins on both chains.

This method is time consuming and not guaranteed to work. CPFP can be used by 
an attacker to get your original txn into the 148 chain.

(also, no double-n in untenable)

Why thank you aj, you're so good at spelling. :-)

Cheers,
Greg

--
Please do not email me anything that you are not comfortable also sharing with 
the NSA.

On Jun 6, 2017, at 4:20 PM, Anthony Towns via bitcoin-dev 
<bitcoin-dev@lists.linuxfoundation.org> wrote:

On Tue, Jun 06, 2017 at 03:39:28PM -0700, Tao Effect via bitcoin-dev wrote:- 
Mixing with 148 coinbase txns destroys fungibility.

CoinJoin works as a method of both improving fungibility and mixing with
coinbase transactions.

You probably don't need to do anything clever to split a coin though:
if you send a transaction with a standard fee it will get confirmed
in a normal time on the higher hashrate chain, but won't confirm as
quickly on the lower hashrate chain (precisely because transactions are
valid on both chains, but blocks are found more slowly with the lower
hashrate). When it's confirmed on one chain, but not on the other, you
can then "double-spend" on the lower hashrate chain with a higher fee,
to end up with different coins on both chains.

(also, no double-n in untenable)

Cheers,
aj

___
bitcoin-dev mailing list
bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev___
bitcoin-dev mailing list
bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev

Re: [bitcoin-dev] Replay attacks make BIP148 and BIP149 untennable

[Tao Effect via bitcoin-dev]

> CPFP can be used by an attacker to get your original txn into the 148 chain.

*err, my bad that's unlikely to happen, if I remember correctly CPFP can only 
be done by the person you're sending the coins to. Coin-mixing seems the better 
option of the two, but shouldn't the BIP148 folks wait until it's clear that 
will be supported by exchanges?

--
Please do not email me anything that you are not comfortable also sharing with 
the NSA.

> On Jun 6, 2017, at 4:27 PM, Tao Effect  > wrote:
> 
>> CoinJoin works as a method of both improving fungibility and mixing with
>> coinbase transactions.
> 
> My understanding is that the two situations are quite different.
> 
> Unlike mixing to coin-split, CoinJoin doesn't create a high demand 
> exclusively for coinbase transactions.
> 
> However, of the proposed methods, coin-mixing seems the better option, 
> because it might be reasonably easy (I don't know) for exchanges to obtain 
> 148 coinbase coins, and mix their coins with them, extending the 
> coin-splitting capability beyond just miner coins and then using that to 
> split incoming coins.
> 
> That seems like the most reasonable approach I've heard so far. Whether 
> exchanges would be willing to do that is a separate question.
> 
>> When it's confirmed on one chain, but not on the other, you
>> can then "double-spend" on the lower hashrate chain with a higher fee,
>> to end up with different coins on both chains.
> 
> This method is time consuming and not guaranteed to work. CPFP can be used by 
> an attacker to get your original txn into the 148 chain.
> 
>> (also, no double-n in untenable)
> 
> Why thank you aj, you're so good at spelling. :-)
> 
> Cheers,
> Greg
> 



signature.asc
Description: Message signed with OpenPGP
___
bitcoin-dev mailing list
bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev

Re: [bitcoin-dev] Replay attacks make BIP148 and BIP149 untennable

[Tao Effect via bitcoin-dev]

> CoinJoin works as a method of both improving fungibility and mixing with
> coinbase transactions.

My understanding is that the two situations are quite different.

Unlike mixing to coin-split, CoinJoin doesn't create a high demand exclusively 
for coinbase transactions.

However, of the proposed methods, coin-mixing seems the better option, because 
it might be reasonably easy (I don't know) for exchanges to obtain 148 coinbase 
coins, and mix their coins with them, extending the coin-splitting capability 
beyond just miner coins and then using that to split incoming coins.

That seems like the most reasonable approach I've heard so far. Whether 
exchanges would be willing to do that is a separate question.

> When it's confirmed on one chain, but not on the other, you
> can then "double-spend" on the lower hashrate chain with a higher fee,
> to end up with different coins on both chains.

This method is time consuming and not guaranteed to work. CPFP can be used by 
an attacker to get your original txn into the 148 chain.

> (also, no double-n in untenable)

Why thank you aj, you're so good at spelling. :-)

Cheers,
Greg

--
Please do not email me anything that you are not comfortable also sharing with 
the NSA.

> On Jun 6, 2017, at 4:20 PM, Anthony Towns via bitcoin-dev 
>  > wrote:
> 
> On Tue, Jun 06, 2017 at 03:39:28PM -0700, Tao Effect via bitcoin-dev wrote:
>> - Mixing with 148 coinbase txns destroys fungibility.
> 
> CoinJoin works as a method of both improving fungibility and mixing with
> coinbase transactions.
> 
> You probably don't need to do anything clever to split a coin though:
> if you send a transaction with a standard fee it will get confirmed
> in a normal time on the higher hashrate chain, but won't confirm as
> quickly on the lower hashrate chain (precisely because transactions are
> valid on both chains, but blocks are found more slowly with the lower
> hashrate). When it's confirmed on one chain, but not on the other, you
> can then "double-spend" on the lower hashrate chain with a higher fee,
> to end up with different coins on both chains.
> 
> (also, no double-n in untenable)
> 
> Cheers,
> aj
> 
> ___
> bitcoin-dev mailing list
> bitcoin-dev@lists.linuxfoundation.org 
> 
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev



signature.asc
Description: Message signed with OpenPGP
___
bitcoin-dev mailing list
bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev

Re: [bitcoin-dev] Replay attacks make BIP148 and BIP149 untennable

[Tao Effect via bitcoin-dev]

> Replay is a solved problem.

Point to this solved problem?

Your "solution" here is not a solution:

https://www.reddit.com/r/Bitcoin/comments/6f1urd/i_think_its_time_we_have_an_educated_discussion/diey21t/?context=3
 


> This is nothing but unfounded FUD. It is very simple to implement and
> guaranteed to work eventually. It may be time consuming, but that is the only
> truth here. The only risk is that of a long reorg, the same as double spend
> attacks.

Let's assume you invented a simple way to double-spend txns to self (which you 
haven't, fyi), then that is an issue in of itself as the point of bitcoin is to 
*prevent* double-spending to self.

There would need to be much more time for the community to discuss the 
implications of wallets have a "double-spend to self" button in them.

> What kind of "fungibility" does this FUD claim it destroys? Destroying cross-
> chain fungibility is the very *intent* of replay protection. And it does not
> destroy same-chain fungibility any more than any other miner spending.

Yes it does destroy same-chain fungibility, as discussed on twitter [1], you're 
making miner coins special on both chains.

> Lack of replay protection does not mean there is no coin.

It effectively does. If people want to proceed blindly, ignoring replay, 
they're welcome to read about the consequences [2].

[1] https://twitter.com/taoeffect/status/872226556571131905 

[2] http://gist.github.com/taoeffect/c910ebb16d9f6d248e9f1f3c6e10b1b8 


--
Please do not email me anything that you are not comfortable also sharing with 
the NSA.

> On Jun 6, 2017, at 4:08 PM, Luke Dashjr  > wrote:
> 
> On Tuesday 06 June 2017 10:39:28 PM Tao Effect via bitcoin-dev wrote:
>> I believe the severity of replay attacks is going unvoiced and is not
>> understood within the bitcoin community because of their lack of
>> experience with them.
> 
> Replay is a solved problem. It can be improved on and made simpler, but at
> this point, replay only occurs when the sender is either negligent or
> intending it.
> 
>> Both of the coin-splitting techniques given so far by the proponents BIP148
>> are also untenable:
>> 
>> - Double-spending to self with nLockTime txns is insanely complicated,
>> risky, not guaranteed to work, extremely time consuming, and would likely
>> result in a massive increase in backlogged transactions and increased
>> fees.
> 
> This is nothing but unfounded FUD. It is very simple to implement and
> guaranteed to work eventually. It may be time consuming, but that is the only
> truth here. The only risk is that of a long reorg, the same as double spend
> attacks.
> 
>> - Mixing with 148 coinbase txns destroys fungibility.
> 
> What kind of "fungibility" does this FUD claim it destroys? Destroying cross-
> chain fungibility is the very *intent* of replay protection. And it does not
> destroy same-chain fungibility any more than any other miner spending.
> 
>> Without a coin, there is no real threat from BIP148.
> 
> Lack of replay protection does not mean there is no coin. Replay protection is
> equally a concern for the main (BIP148) chain and any legacy chains malicious
> miners might choose to split off. And none of this changes the fact that such
> miners will be unable to sell their legacycoins at Bitcoin market prices,
> because whether other transactions are replayed or not, *their* coins won't be
> valid on the main chain.
> 
> Luke



signature.asc
Description: Message signed with OpenPGP
___
bitcoin-dev mailing list
bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev

Re: [bitcoin-dev] Replay attacks make BIP148 and BIP149 untennable

[Tao Effect via bitcoin-dev]

Hey Greg,

It wasn't my intention to insult anyone (a bit defensive?).

Maybe this is yet another example of a recurring criticism of Core: that core 
doesn't community these issues very well to journalists / reports / media / 
community outside of this list.

Because outside of this list it's been all about those 148 coins, and almost 
zero mention of replay attacks.

> BIP149 is arguably something of another matter in particular because
> it has a time-frame that allows dealing with replay and other issues--
> and particularly because it has a time-frame that can allow for the
> avoidance of a meaningful fork at all.

Are there other, more reasonable / feasible ways of addressing replay attacks 
in Bitcoin / BIP149 scenario?

Cheers,
Greg

--
Please do not email me anything that you are not comfortable also sharing with 
the NSA.

> On Jun 6, 2017, at 4:02 PM, Gregory Maxwell  > wrote:
> 
> On Tue, Jun 6, 2017 at 10:39 PM, Tao Effect via bitcoin-dev
>  > wrote:
>> I believe the severity of replay attacks is going unvoiced and is not
>> understood within the bitcoin community because of their lack of experience
>> with them.
> 
> Please don't insult our community-- the issues with replay were
> pointed out by us to Ethereum in advance and were cited specifically
> in prior hardfork discussions long before Ethereum started editing
> their ledger for the economic benefit of its centralized
> administrators.
> 
> The lack of extensive discussion on these issues you're seeing is
> rather symptomatic of engineers that take stability seriously not
> taking BIP148 seriously; not symptomatic of people not knowing about
> them. The same concerns also applies to all these HF proposals (which
> for some reason you don't mention), arguably even stronger.  The same
> basic pattern exists: There are people that just don't care about the
> technical issues who have made up their minds, and so you don't see
> technical discussion.  Those people who do see the issues already
> called out the proposals as being ill-advised.   Replay isn't even the
> largest of the technical issues (network partitioning, for example, is
> a much larger one).
> 
> BIP149 is arguably something of another matter in particular because
> it has a time-frame that allows dealing with replay and other issues--
> and particularly because it has a time-frame that can allow for the
> avoidance of a meaningful fork at all.



signature.asc
Description: Message signed with OpenPGP
___
bitcoin-dev mailing list
bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev

Re: [bitcoin-dev] Replay attacks make BIP148 and BIP149 untennable

[Anthony Towns via bitcoin-dev]

On Tue, Jun 06, 2017 at 03:39:28PM -0700, Tao Effect via bitcoin-dev wrote:
> - Mixing with 148 coinbase txns destroys fungibility.

CoinJoin works as a method of both improving fungibility and mixing with
coinbase transactions.

You probably don't need to do anything clever to split a coin though:
if you send a transaction with a standard fee it will get confirmed
in a normal time on the higher hashrate chain, but won't confirm as
quickly on the lower hashrate chain (precisely because transactions are
valid on both chains, but blocks are found more slowly with the lower
hashrate). When it's confirmed on one chain, but not on the other, you
can then "double-spend" on the lower hashrate chain with a higher fee,
to end up with different coins on both chains.

(also, no double-n in untenable)

Cheers,
aj

___
bitcoin-dev mailing list
bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev

Re: [bitcoin-dev] Replay attacks make BIP148 and BIP149 untennable

[Luke Dashjr via bitcoin-dev]

On Tuesday 06 June 2017 10:39:28 PM Tao Effect via bitcoin-dev wrote:
> I believe the severity of replay attacks is going unvoiced and is not
> understood within the bitcoin community because of their lack of
> experience with them.

Replay is a solved problem. It can be improved on and made simpler, but at 
this point, replay only occurs when the sender is either negligent or 
intending it.

> Both of the coin-splitting techniques given so far by the proponents BIP148
> are also untenable:
> 
> - Double-spending to self with nLockTime txns is insanely complicated,
> risky, not guaranteed to work, extremely time consuming, and would likely
> result in a massive increase in backlogged transactions and increased
> fees.

This is nothing but unfounded FUD. It is very simple to implement and 
guaranteed to work eventually. It may be time consuming, but that is the only 
truth here. The only risk is that of a long reorg, the same as double spend 
attacks.

> - Mixing with 148 coinbase txns destroys fungibility.

What kind of "fungibility" does this FUD claim it destroys? Destroying cross-
chain fungibility is the very *intent* of replay protection. And it does not 
destroy same-chain fungibility any more than any other miner spending.

> Without a coin, there is no real threat from BIP148.

Lack of replay protection does not mean there is no coin. Replay protection is 
equally a concern for the main (BIP148) chain and any legacy chains malicious 
miners might choose to split off. And none of this changes the fact that such 
miners will be unable to sell their legacycoins at Bitcoin market prices, 
because whether other transactions are replayed or not, *their* coins won't be 
valid on the main chain.

Luke
___
bitcoin-dev mailing list
bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev

Re: [bitcoin-dev] Replay attacks make BIP148 and BIP149 untennable

[Gregory Maxwell via bitcoin-dev]

On Tue, Jun 6, 2017 at 10:39 PM, Tao Effect via bitcoin-dev
 wrote:
> I believe the severity of replay attacks is going unvoiced and is not
> understood within the bitcoin community because of their lack of experience
> with them.

Please don't insult our community-- the issues with replay were
pointed out by us to Ethereum in advance and were cited specifically
in prior hardfork discussions long before Ethereum started editing
their ledger for the economic benefit of its centralized
administrators.

The lack of extensive discussion on these issues you're seeing is
rather symptomatic of engineers that take stability seriously not
taking BIP148 seriously; not symptomatic of people not knowing about
them. The same concerns also applies to all these HF proposals (which
for some reason you don't mention), arguably even stronger.  The same
basic pattern exists: There are people that just don't care about the
technical issues who have made up their minds, and so you don't see
technical discussion.  Those people who do see the issues already
called out the proposals as being ill-advised.   Replay isn't even the
largest of the technical issues (network partitioning, for example, is
a much larger one).

BIP149 is arguably something of another matter in particular because
it has a time-frame that allows dealing with replay and other issues--
and particularly because it has a time-frame that can allow for the
avoidance of a meaningful fork at all.
___
bitcoin-dev mailing list
bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev

[bitcoin-dev] Replay attacks make BIP148 and BIP149 untennable

[Tao Effect via bitcoin-dev]

This is just me putting in my formal objection to BIP148 and BIP149 based on my 
experience with the ETH/ETC hard fork and involvement in that drama.

First, it's important to note that ETC/ETH HF is a very different situation 
from BIP148 and all other soft-forks. To those on this mailing list, the 
reasons should be self-evident (one results in two incompatible chains, the 
other doesn't).

However, replay attacks are common to both possibilities (i.e. when BIP148 has 
<51% hash power).

I believe the severity of replay attacks is going unvoiced and is not 
understood within the bitcoin community because of their lack of experience 
with them.

I further believe that replay attacks are the #1 issue with BIP148, BIP149, 
etc., superseding wipeout attacks in severity.

These are not baseless beliefs, they're born out of experience and I think 
anyone will reach the same conclusion upon study.

In a nutshell, replay attacks mean that all talk of there being potentially 
"two coins" as a result of BIP148 is basically nonsense.

Replay attacks effectively eliminate that possibility.

When users go to "sell their legacy coins", they've just sold their 148 coins, 
and vice versa.

Both of the coin-splitting techniques given so far by the proponents BIP148 are 
also untenable:

- Double-spending to self with nLockTime txns is insanely complicated, risky, 
not guaranteed to work, extremely time consuming, and would likely result in a 
massive increase in backlogged transactions and increased fees.

- Mixing with 148 coinbase txns destroys fungibility.

Without a coin, there is no real threat from BIP148. Without that threat, there 
is no point to BIP148, and the miners know this.

These and other concerns are outlined and explained in more detail in this 
conversation I had yesterday with John Light:

https://www.youtube.com/watch?v=33rL3-p8cPw 


Cheers,
Greg Slepak

--
Please do not email me anything that you are not comfortable also sharing with 
the NSA.



signature.asc
Description: Message signed with OpenPGP
___
bitcoin-dev mailing list
bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev