BIP 347: OP_CAT in Tapscript #1525

EthanHeilman · 2023-12-11T23:16:22Z

This BIP defines OP_CAT a new tapscript opcode which allows the concatenation of two values on the stack. This opcode would be activated via a soft fork by redefining the opcode OP_SUCCESS126.

See our implementation PR in bitcoin-inquisition: bitcoin-inquisition/bitcoin#39

kallewoof

Some minor nits. Idea seems sensible. Mailing list post seems mostly positive sentiment as well.

@luke-jr ?

bip-???-cat.mediawiki

Co-authored-by: kallewoof <kalle.alm@gmail.com>

"If an if only has a single-statement then-clause, it can appear on the same line as the if, without braces. In every other case, braces are required, and the then and else clauses must appear correctly indented on a new line." Co-authored-by: kallewoof <kalle.alm@gmail.com>

Co-authored-by: kallewoof <kalle.alm@gmail.com>

Bloc6 · 2023-12-12T23:21:33Z

Definitely looking forward to test drive this BIP.

EthanHeilman · 2023-12-14T18:55:10Z

Can we get a BIP number assigned? Any blockers to doing this?

kallewoof

Sorry, some more μ-nits. Fine with it as is though.

bip-???-cat.mediawiki

Co-authored-by: kallewoof <kalle.alm@gmail.com>

TIL that it is "a one" rather than "an one" Co-authored-by: kallewoof <kalle.alm@gmail.com>

bip-???-cat.mediawiki

vostrnad · 2023-12-15T05:30:15Z

bip-???-cat.mediawiki

+
+* Bitstream, a protocol for the atomic swap (fair exchange) of bitcoins for decryption keys, that enables decentralized file hosting systems paid in Bitcoin. While such swaps are currently possible on Bitcoin without OP_CAT they require the use of complex and computationally expensive Verifiable Computation cryptographic techniques. OP_CAT would remove this requirement on Verifiable Computation, making such protocols far more practical to build in Bitcoin. <ref>R. Linus, "BitStream: Decentralized File Hosting Incentivised via Bitcoin Payments", 2023, https://robinlinus.com/bitstream.pdf</ref>
+* Tree Signatures provide a multisignature script whose size can be logarithmic in the number of public keys and can encode spend conditions beyond n-of-m. For instance a transaction less than 1KB in size could support tree signatures with a thousand public keys. This also enables generalized logical spend conditions. <ref> P. Wuille, "Multisig on steroids using tree signatures", 2015, https://blog.blockstream.com/en-treesignatures/</ref>
+* Post-Quantum Lamport Signatures in Bitcoin transactions. Lamport signatures merely require the ability to hash and concatenate values on the stack. <ref>J. Rubin, "[bitcoin-dev] OP_CAT Makes Bitcoin Quantum Secure [was CheckSigFromStack for Arithmetic Values]", 2021, https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2021-July/019233.html</ref>


Lamport signatures in tapscript aren't actually quantum secure because the taptweak still relies on EC operations.

As far as I know it is an open question if the taptweak based commitment is quantum secure or not. This BIP could not take a position on this question. I will reword this to fix any confusion.

You're right, I spoke too soon.

I'm glad you brought this up. I wouldn't want the BIP to be seen as making an authoritative statement on this question. Let me know if you think my change addresses the issue or not.

bip-???-cat.mediawiki

Co-authored-by: Vojtěch Strnad <43024885+vostrnad@users.noreply.github.com>

bip-???-cat.mediawiki

Co-authored-by: Vojtěch Strnad <43024885+vostrnad@users.noreply.github.com>

bip-???-cat.mediawiki

… Bitcoin

bip-???-cat.mediawiki

Co-authored-by: Mark "Murch" Erhardt <murch@murch.one>

bip-0347.mediawiki

Co-authored-by: Vojtěch Strnad <43024885+vostrnad@users.noreply.github.com>

Co-authored-by: Mark "Murch" Erhardt <murch@murch.one>

murchandamus · 2024-04-30T14:22:13Z

I put the BIP number in the title, I hope you don’t mind. It seems to me that there are still a couple open review comments, will swing by again later to check whether it’s ready for the next round of review.

murchandamus

I have left a couple more nits that you may address or ignore freely, I don’t consider any to be blocking.

The BIP described in this PR fulfills the criteria set out in BIP2, it:

Is properly formatted
Has a complete preamble
Concisely specifies a new feature in sufficient detail for implementation
Covers Motivation, Rationale, Backwards Compatibility
Has an acceptable license

and therefore appears to be ready to be merged.¹

ACK 696cc17

^{¹ This should be obvious, but to make it explicit: This is a clerical assessment of the completeness of this PR. I am neither endorsing this BIP nor expressing any opinion on whether OP_CAT should be activated.}

bip-0347.mediawiki

murchandamus · 2024-05-01T17:13:34Z

@luke-jr had previously requested changes:

Missing a section for backward compatibility

which I consider to have been addressed. I will abstain from merging this PR for some time, to give other editors a chance to make their own assessment.

Co-authored-by: Mark "Murch" Erhardt <murch@murch.one>

This improves readability, thanks! Co-authored-by: Mark "Murch" Erhardt <murch@murch.one>

Co-authored-by: Mark "Murch" Erhardt <murch@murch.one>

jonatack

ACK, mod non-working url and squash commits

jonatack · 2024-05-01T22:11:25Z

bip-0347.mediawiki

+* Bitstream, a protocol for the atomic swap (fair exchange) of bitcoins for decryption keys, that enables decentralized file hosting systems paid in Bitcoin. While such swaps are currently possible on Bitcoin without OP_CAT, they require the use of complex and computationally expensive Verifiable Computation cryptographic techniques. OP_CAT would remove this requirement on Verifiable Computation, making such protocols far more practical to build in Bitcoin. <ref>R. Linus, "BitStream: Decentralized File Hosting Incentivised via Bitcoin Payments", 2023, https://robinlinus.com/bitstream.pdf</ref>
+* Tree signatures provide a multisignature script whose size can be logarithmic in the number of public keys and can encode spend conditions beyond n-of-m. For instance a transaction less than 1KB in size could support tree signatures with up to 4,294,967,296 public keys. This also enables generalized logical spend conditions. <ref> P. Wuille, "Multisig on steroids using tree signatures", 2015, https://blog.blockstream.com/en-treesignatures/</ref>
+* Post-Quantum Lamport signatures in Bitcoin transactions. Lamport signatures merely require the ability to hash and concatenate values on the stack. <ref>J. Rubin, "[bitcoin-dev] OP_CAT Makes Bitcoin Quantum Secure [was CheckSigFromStack for Arithmetic Values]", 2021, https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2021-July/019233.html</ref> It has been proposed that if ECDSA is broken or a powerful computer was on the horizon, there might be an effort to protect ownership of bitcoins by allowing people to mark their taproot outputs as "script-path only" and then move their coins into such outputs with a leaf in the script tree requiring a Lamport signature. It is an open question if a tapscript commitment would preserve the quantum resistance of Lamport signatures. Beyond this question, the use of Lamport Signatures in taproot outputs is unlikely to be quantum resistant even if the script spend-path is made quantum resistant. This is because taproot outputs can also be spent with a key. An attacker with a sufficiently powerful quantum computer could bypass the taproot script spend-path by finding the discrete log of the taproot output and thus spending the output using the key spend-path. The use of "Nothing Up My Sleeve" (NUMS) points as described in [[bip-0341.mediawiki|BIP341]] to disable the key spend-path does not disable the key spend-path against a quantum attacker as NUMS relies on the hardness of finding discrete logs. We are not aware of any mechanism which could disable the key spend-path in a taproot output without a softfork change to taproot.
+* Non-equivocation contracts <ref>T. Ruffing, A. Kate, D. Schröder, "Liar, Liar, Coins on Fire: Penalizing Equivocation by Loss of Bitcoins", 2015, https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.727.6262&rep=rep1&type=pdf</ref> in tapscript provide a mechanism to punish equivocation/double spending in Bitcoin payment channels. OP_CAT enables this by enforcing rules on the spending transaction's nonce. The capability is a useful building block for payment channels and other Bitcoin protocols.


https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.727.6262&rep=rep1&type=pdf doesn't seem to be the correct link for me

I believe that link is dead now. Let me fix it, thanks for finding.

weikengchen · 2024-05-02T00:21:27Z

It seems useful to use the ACM DOI URI for that paper mentioned above with the nonfunctional link: https://dl.acm.org/doi/10.1145/2810103.2813686

It is very likely to still work for ten more years. Although it is paywalled, people can find free versions online.

The requested "Backwards Compatibility" section has been added.

murchandamus · 2024-05-03T02:02:13Z

The build check was failing, because the BIP had not been added to the table in the README yet, so I added a commit to add it to the table.

real-or-random · 2024-05-06T10:44:55Z

It seems useful to use the ACM DOI URI for that paper mentioned above with the nonfunctional link: dl.acm.org/doi/10.1145/2810103.2813686

It is very likely to still work for ten more years. Although it is paywalled, people can find free versions online.

Yep, sorry, we weren't allowed to upload it to eprint.iacr.org or arXiv due to copyright reasons. (The ACM is evil...)

But it's lawfully available under https://publications.cispa.saarland/565/1/penalizing.pdf (Web Archive: https://web.archive.org/web/20221023121048/https://publications.cispa.saarland/565/1/penalizing.pdf), and I've also just made it available under https://raw.githubusercontent.com/real-or-random/accas/master/paper.pdf (Web Archive: https://web.archive.org/web/20240506104315/https://raw.githubusercontent.com/real-or-random/accas/master/paper.pdf).

bip-0347.mediawiki

EthanHeilman · 2024-05-06T17:13:45Z

@real-or-random Just added a stable URL for Liar, Liar, Coins on Fire! citation.

murchandamus

ACK 7ad0f82

Seems to me that all open review comments have been addressed.

jonatack

ACK 7ad0f82

Create bip-???-cat.mediawiki

83ca57f

kallewoof reviewed Dec 12, 2023

View reviewed changes

bip-???-cat.mediawiki Outdated Show resolved Hide resolved

bip-???-cat.mediawiki Outdated Show resolved Hide resolved

bip-???-cat.mediawiki Outdated Show resolved Hide resolved

bip-???-cat.mediawiki Outdated Show resolved Hide resolved

EthanHeilman and others added 4 commits December 12, 2023 08:24

Fixes typo

f1169dd

Co-authored-by: kallewoof <kalle.alm@gmail.com>

Grammar fix

0335c9d

Co-authored-by: kallewoof <kalle.alm@gmail.com>

Adds brackets

3d31e5c

Co-authored-by: kallewoof <kalle.alm@gmail.com>

kallewoof approved these changes Dec 15, 2023

View reviewed changes

EthanHeilman and others added 8 commits December 14, 2023 23:43

Wording

bb725e6

Co-authored-by: kallewoof <kalle.alm@gmail.com>

Keeps past tense consistant

9779dc9

Co-authored-by: kallewoof <kalle.alm@gmail.com>

Better phrasing

c5d66d6

Co-authored-by: kallewoof <kalle.alm@gmail.com>

Phrasing

848352f

Co-authored-by: kallewoof <kalle.alm@gmail.com>

Typo

a2b0100

Co-authored-by: kallewoof <kalle.alm@gmail.com>

Removes space in ref

6a790ec

Co-authored-by: kallewoof <kalle.alm@gmail.com>

Removes space in ref

01db3ac

Co-authored-by: kallewoof <kalle.alm@gmail.com>

Typos

945e2a3

TIL that it is "a one" rather than "an one" Co-authored-by: kallewoof <kalle.alm@gmail.com>

vostrnad reviewed Dec 15, 2023

View reviewed changes

EthanHeilman and others added 4 commits December 15, 2023 09:54

Prefer bytes to Bytes

7180c1c

Co-authored-by: Vojtěch Strnad <43024885+vostrnad@users.noreply.github.com>

Increases conciseness and clarity

6f5a74d

Co-authored-by: Vojtěch Strnad <43024885+vostrnad@users.noreply.github.com>

Lowercase bytes

d4f85b1

Co-authored-by: Vojtěch Strnad <43024885+vostrnad@users.noreply.github.com>

Adds subsection header

beb5802

Co-authored-by: Vojtěch Strnad <43024885+vostrnad@users.noreply.github.com>

EthanHeilman commented Dec 15, 2023

View reviewed changes

bip-???-cat.mediawiki Outdated Show resolved Hide resolved

EthanHeilman and others added 4 commits December 15, 2023 15:46

Use BSD-3 license

0a143d3

Code formatting

8219830

Co-authored-by: Vojtěch Strnad <43024885+vostrnad@users.noreply.github.com>

Code formatting

0b8a7e4

Co-authored-by: Vojtěch Strnad <43024885+vostrnad@users.noreply.github.com>

Period to colon

77509f6

Co-authored-by: Vojtěch Strnad <43024885+vostrnad@users.noreply.github.com>

EthanHeilman commented Dec 16, 2023

View reviewed changes

bip-???-cat.mediawiki Outdated Show resolved Hide resolved

Avoids designing or discussing how to add post-quantum commitments to…

4f39e4b

… Bitcoin

vostrnad approved these changes Dec 17, 2023

View reviewed changes

bip-???-cat.mediawiki Outdated Show resolved Hide resolved

bip-???-cat.mediawiki Outdated Show resolved Hide resolved

EthanHeilman and others added 3 commits April 26, 2024 14:01

Consistent formatting for Section Headings

5413e18

Co-authored-by: Mark "Murch" Erhardt <murch@murch.one>

Consistent formatting for Section Headings

dbc612e

Co-authored-by: Mark "Murch" Erhardt <murch@murch.one>

Changes title of BIP to "Enable OP_CAT in Tapscript"

a05543c

EthanHeilman changed the title ~~BIP for reenabling OP_CAT~~ BIP for enabling OP_CAT in tapscript Apr 29, 2024

vostrnad reviewed Apr 29, 2024

View reviewed changes

bip-0347.mediawiki Outdated Show resolved Hide resolved

EthanHeilman and others added 2 commits April 29, 2024 19:36

OP_CAT in Tapscript

1d55304

Co-authored-by: Vojtěch Strnad <43024885+vostrnad@users.noreply.github.com>

Fixes typos

3d78cc0

Co-authored-by: Mark "Murch" Erhardt <murch@murch.one>

murchandamus changed the title ~~BIP for enabling OP_CAT in tapscript~~ BIP 347: OP_CAT in Tapscript Apr 30, 2024

Adds post history, fixes created date

696cc17

murchandamus approved these changes May 1, 2024

View reviewed changes

bip-0347.mediawiki Outdated Show resolved Hide resolved

bip-0347.mediawiki Outdated Show resolved Hide resolved

EthanHeilman and others added 3 commits May 1, 2024 16:30

Adds sentence suggested by murchandamus to quantum paragraph

d670035

Co-authored-by: Mark "Murch" Erhardt <murch@murch.one>

Increases commas and capital letters

e9e7636

This improves readability, thanks! Co-authored-by: Mark "Murch" Erhardt <murch@murch.one>

Adds commas

6815c39

Co-authored-by: Mark "Murch" Erhardt <murch@murch.one>

jonatack reviewed May 1, 2024

View reviewed changes

EthanHeilman and others added 3 commits May 2, 2024 18:39

Fixes link to liar liar

6ea9fda

Add BIP-347 OP_CAT to table

31f5192

Merge branch 'master' into cat

f05e162

Improved accuracy of paragraph on OP_CAT's removal in 2010

cda34ee

jonatack reviewed May 6, 2024

View reviewed changes

bip-0347.mediawiki Show resolved Hide resolved

Adds stable URL for Liar, Liar, Coins on Fire!

7ad0f82

murchandamus approved these changes May 6, 2024

View reviewed changes

jonatack approved these changes May 6, 2024

View reviewed changes

murchandamus merged commit feacf8f into bitcoin:master May 6, 2024
3 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

BIP 347: OP_CAT in Tapscript #1525

BIP 347: OP_CAT in Tapscript #1525

EthanHeilman commented Dec 11, 2023

kallewoof left a comment

Bloc6 commented Dec 12, 2023

EthanHeilman commented Dec 14, 2023

kallewoof left a comment

vostrnad Dec 15, 2023

EthanHeilman Dec 16, 2023

vostrnad Dec 16, 2023

EthanHeilman Dec 16, 2023 •

edited

murchandamus commented Apr 30, 2024 •

edited

murchandamus left a comment

murchandamus commented May 1, 2024

jonatack left a comment •

edited

jonatack May 1, 2024

EthanHeilman May 2, 2024 •

edited

EthanHeilman May 2, 2024

weikengchen commented May 2, 2024

murchandamus commented May 3, 2024

real-or-random commented May 6, 2024

EthanHeilman commented May 6, 2024

murchandamus left a comment

jonatack left a comment

BIP 347: OP_CAT in Tapscript #1525

BIP 347: OP_CAT in Tapscript #1525

Conversation

EthanHeilman commented Dec 11, 2023

kallewoof left a comment

Choose a reason for hiding this comment

Bloc6 commented Dec 12, 2023

EthanHeilman commented Dec 14, 2023

kallewoof left a comment

Choose a reason for hiding this comment

vostrnad Dec 15, 2023

Choose a reason for hiding this comment

EthanHeilman Dec 16, 2023

Choose a reason for hiding this comment

vostrnad Dec 16, 2023

Choose a reason for hiding this comment

EthanHeilman Dec 16, 2023 • edited

Choose a reason for hiding this comment

murchandamus commented Apr 30, 2024 • edited

murchandamus left a comment

Choose a reason for hiding this comment

murchandamus commented May 1, 2024

jonatack left a comment • edited

Choose a reason for hiding this comment

jonatack May 1, 2024

Choose a reason for hiding this comment

EthanHeilman May 2, 2024 • edited

Choose a reason for hiding this comment

EthanHeilman May 2, 2024

Choose a reason for hiding this comment

weikengchen commented May 2, 2024

murchandamus commented May 3, 2024

real-or-random commented May 6, 2024

EthanHeilman commented May 6, 2024

murchandamus left a comment

Choose a reason for hiding this comment

jonatack left a comment

Choose a reason for hiding this comment

EthanHeilman Dec 16, 2023 •

edited

murchandamus commented Apr 30, 2024 •

edited

jonatack left a comment •

edited

EthanHeilman May 2, 2024 •

edited