Bitcoin Optech #157: Proposed New Opcodes And Wiki Pages

The Bitcoin Optech newsletter presents readers with a high-stage abstract of a in reality principal technical knowledge taking place in Bitcoin, alongside with sources that support them learn extra. To support our readers not sleep-to-date with Bitcoin, we’re republishing the most modern issue of this article below. Bear in mind to subscribe to receive this lisp straight to your inbox.

This week’s newsletter summarizes a dialogue a pair of proposed recent opcode and links to an updated wiki page for tracking bech32m reinforce. Additionally included are our traditional sections with highlights from a Bitcoin Core PR Review Club assembly, strategies about preparing for taproot, and descriptions of famous changes to stylish Bitcoin infrastructure tasks.

News

• Inquire of for OP_CHECKSIGFROMSTACK rep strategies: Jeremy Rubin posted to the Bitcoin-Dev mailing checklist a draft specification for an OP_CHECKSIGFROMSTACK opcode and asked for strategies from any developers who would make a choice an quite a entire lot of rep. Some selections had been talked about, however the thread also branched off into a dialogue about whether or no longer an OP_CAT opcode must be launched at the the same time.

• OP_CAT and OP_CSFS would enable arbitrary transaction introspection—the flexibility to receive bitcoins to a script that could check nearly any fragment of the transaction that later spends those bitcoins. This would possibly occasionally maybe maybe moreover enable many developed aspects (including variations1 of different proposed upgrades like SIGHASH_ANYPREVOUT and OP_CHECKTEMPLATEVERIFY), however OP_CAT also makes it that you just are going to be ready to pay attention to of to invent recursive covenants which could completely restrict the spendability of any bitcoins dedicated to the covenant. Any other folks occupy objected to permitting covenants in Bitcoin, however plenty of arguments had been made to the rep that the worst case problems of recursive covenants already exist in Bitcoin this day so we shouldn’t agonize about enabling OP_CAT or a same opcode.
• Despite the dialogue, Rubin decided he desired to maintain his OP_CSFS proposal honest of any proposal so as to add OP_CAT, arguing that OP_CSFS is useful enough by itself.
• Tracking bech32m reinforce: the Bitcoin Wiki page for bech32 adoption has been updated to look at which instrument and products and providers reinforce spending or receiving to bech32m addresses for taproot.

• Bitcoin Core PR Review Club

  In this month-to-month fragment, we summarize a up-to-the-minute Bitcoin Core PR Review Club assembly, highlighting some of the crucial questions and solutions. Click on on a quiz below to appear a abstract of the reply from the assembly.

  Insist script_util helpers for constructing P2{PKH,SH,WPKH,WSH} scripts is a PR by Sebastian Falbesoner which substitutes e-book script creation with calls to script_util helper functions in purposeful tests and fixes an error in the get_multisig() characteristic. The review membership assembly broke down terminology and each and each of the script output sorts worn in the PR.

  • What carry out key_to_p2pkh_script, script_to_p2sh_script, key_to_p2wpkh_scriptand script_to_p2wsh_script in script_util.py carry out?

    These are helper functions to maintain CScript objects for Pay to Public Key Hash, Pay to Script Hash, Pay to Catch out about Public Key Hash, and Pay to Catch out about Script Hash scripts from public keys and scripts. ➚

  • Elaborate scriptPubKey, scriptSig, and take into yarn.

    The scriptPubKey and scriptSig are fields in the output and input of a transaction, respectively, for specifying and satisfying spending stipulations. The take into yarn is an additional discipline for the the same reason launched with Segregated Catch out about. Spending requirements are dedicated to in an output’s scriptPubKey and the input that spends it’ll be accompanied by knowledge satisfying those stipulations in the scriptSig and/or take into yarn. ➚

  • Elaborate redeem script and take into yarn script. What is the relationship between them?

    P2SH and P2WSH output sorts commit to a script hash in the scriptPubKey. When the output is spent, the spender must present the script itself, alongside with any signatures or other knowledge required to invent it pass. The script is is known as a redeemScript when contained in the scriptSig and a take into yarn script when in the take into yarn. In that sense, they are analogous; a redeemScript is to a P2SH output what a take into yarn script is to a P2WSH output. They put no longer seem like mutually odd, on the other hand, since a transaction spending a P2SH-P2WSH output contains each and each. ➚

  • To ship cash to somebody with spending stipulations encoded in a script, what is included in the scriptPubKey of the output? What needs to be equipped in the input when the coin is spent?

    The scriptPubKey involves the script hash and opcodes to check a match: OP_HASH160 OP_PUSHBYTES_20 <20B script hash> OP_EQUAL. The scriptSig involves the script itself and initial stack. ➚

  • Why will we utilize Pay-To-Script-Hash in resolution to Pay-To-Script?

    The principle motivation as acknowledged in BIP16 is to invent a generic methodology of funding arbitrarily complex transactions whereas inserting the burden of supplying spending stipulations on the one who redeems the funds. People also talked about that preserving the script out of scriptPubKeys methodology its connected prices are no longer paid till redemption and results in a smaller UTXO residing. ➚

  • When a non-segwit node validates a P2SH-P2WSH input, what does it carry out? What does a segwit-enabled node carry out to boot to the scheme performed by a non-segwit node?

    The non-segwit node never sees the take into yarn; it simply enforces P2SH principles by verifying that the redeemScript matches the hash dedicated to in the scriptPubKey. A segwit node recognizes this knowledge as a take into yarn program and uses the take into yarn knowledge and applicable scriptCode to place in force segwit principles. ➚

  • What is defective with the P2SH-P2WSH script in the conventional get_multisig() characteristic?

    It uses the take into yarn script in resolution to its hash in the P2SH-P2WSH redeem script. ➚

• Preparing for taproot #4: from P2WPKH to single-sig P2TR

  A weekly sequence about how developers and restore providers can put collectively for the upcoming activation of taproot at block height 709,632.

  For wallets that already reinforce receiving and spending v0 segwit P2WPKH outputs, upgrading to v1 segwit P2TR for single-sig must be easy. Listed below are the major steps:

  • Insist a brand recent BIP32 key derivation direction: you don’t must switch your BIP32 Hierarchical Deterministic (HD) code and your customers don’t must switch their seeds.2 On the opposite hand, you are strongly encouraged to utilize a brand recent derivation direction for your P2TR public keys (comparable to defined by BIP86); as soon as you don’t carry out this, there’s a that you just are going to be ready to pay attention to of assault that could happen as soon as you utilize the the same keys with each and each ECDSA and schnorr signatures.
  • Tweak your public key by its hash: though technically no longer required for single-sig, particularly when all of your keys are derived from a randomly-chosen BIP32 seed, BIP341 recommends having your key commit to an unspendable scripthash tree. That is as straightforward as the utilize of an Elliptic Curve addition operation that sums your public key with the curve point of that key’s hash. Advantages of complying with this advice are that you just’ll be ready to utilize the the same code as soon as you later add scriptless multisignature reinforce or as soon as you add reinforce for tr() descriptors.
  • Set aside your addresses and video display for them: utilize bech32m to invent your addresses. Funds will be despatched to the scriptPubKey OP_1 . You doubtlessly can scan for transactions paying the script the utilize of whatever methodology you utilize to scan for v0 segwit addresses like P2WPKH.
  • Making a spending transaction: your entire non-take into yarn fields for taproot are the the same as for P2WPKH, so that you just don’t must anxiousness about changes to the transaction serialization.
  • Set aside a signature message: right here’s a dedication to the tips from the spending transaction. Quite loads of the tips is the the same as what you signal for a P2WPKH transaction, however the express of the fields is changed and a few extra things are signed. Implementing right here is correct a topic of serializing and hashing diverse knowledge, so writing the code must be easy.
  • Brand a hash of the signature message: there are diverse systems to invent schnorr signatures. The right kind is not any longer to “roll your occupy crypto” however as a replace to utilize the characteristic from a well-reviewed library you trust. But as soon as you are going to be ready to’t carry out that for some reason, BIP340 presents an algorithm that must be easy to place in force as soon as you already occupy accessible the primitives for making ECDSA signatures. Whenever you occupy your signature, put it in the take into yarn knowledge for your input and ship your spending transaction.
• Even before taproot prompts at block 709,632, you are going to be ready to check your code the utilize of testnet, the general public default signet, or Bitcoin Core’s inner most regtest mode. Whilst you add taproot reinforce to your initiate provide wallet, we support you so as to add a hyperlink to the PR(s) implementing it on the taproot uses and bech32m adoption pages of the Bitcoin Wiki so other developers can learn from your code.

  Releases and initiate candidates

  New releases and initiate candidates for stylish Bitcoin infrastructure tasks. Please maintain in mind upgrading to recent releases or serving to to check initiate candidates.

  • LND 0.13.1-beta.rc2 is a repairs initiate with minor enhancements and worm fixes for aspects launched in 0.13.0-beta.

Primary code and documentation changes

• Primary changes this week in Bitcoin Core, C-Lightning, Eclair, LND, Rust-Lightning, libsecp256k1, Hardware Wallet Interface (HWI), Rust Bitcoin, BTCPay Server, Bitcoin Enchancment Proposals (BIPs), and Lightning BOLTs.
  • C-Lightning #4625 updates its LN provides implementation to check the most modern specification changes. Particularly, provides are now no longer required to have confidence a signature. This vastly shortens the encoded string for provides, bettering QR code recognizability.
  • Eclair #1746 provides reinforce for replicating knowledge to a PostsgreSQL database in parallel to the major SQLite database. The feature is supposed to facilitate testing for servers that want to invent an eventual backend transition. Final twelve months, Suredbits engineer Roman Taranchenko described customizing Eclair for mission-utilize with a PostgreSQL backend in an Optech discipline file.
  • LND #5447 provides a doc describing the model to residing up a pair of LND nodes in a cluster with an quite a entire lot of database that is replicated between the cluster’s nodes and which enables for computerized failover. readers could moreover decide to incompatibility this with the near taken by Eclair and described in Newsletter #128.
  • Libsecp256k1 #844 makes plenty of updates to the API for schnorr signatures. Most famous is acommit that lets in signing and verifying messages of any size. All most modern uses of signatures in Bitcoin signal a 32-byte hash, however permitting signing of variable-size knowledge will be helpful for applications outside of Bitcoin or to enable a brand recent opcode comparable to OP_CHECKSIGFROMSTACK to check signatures created for non-Bitcoin systems. It’s expected that the BIP340 specification of schnorr signatures for Bitcoin will be updated to characterize safely signing variable size knowledge.
  • BIPs #943 updates BIP118 to form on soon-to-be activated taproot and tapscript in resolution to SegWit v0. Additionally, this revision renames the title to SIGHASH_ANYPREVOUT from SIGHASH_NOINPUT to duplicate that the sighash flag is now typically known as “ANYPREVOUT” provided that whereas any prevout could moreover potentially be worn with the signature, some aspects of the input are peaceful dedicated to.
  • BTCPay Server #2655 indicators to web browsers that they occupy to no longer ship the HTTP refererfield when the user clicks on a hyperlink to a transaction in a block explorer. This avoids telling the block explorer what BTCPay server the user came from—that knowledge being sturdy proof that the server either originated or acquired the transaction being considered in the block explorer. Even with this switch, customers wanting sturdy privacy must peaceful steer clear of taking a search for their very occupy transactions on third-celebration block explorers.
• Footnotes
  • Utilizing OP_CHECKSIGFROMSTACK (OP_CSFS) to place in force the theory feature of proposals like BIP118’s SIGHASH_ANYPREVOUT or BIP119’s OP_CHECKTEMPLATEVERIFY would require extra block dwelling than those optimized proposals if scriptpath spending is worn. The argument in desire of OP_CSFS is that it enables starting with a generic development and proving that folks will of route utilize the feature before a consensus switch is worn so as to add a extra ambiance friendly implementation. Additionally, with the introduction of taproot keypath spends, any script would maybe be resolved with the minimal utilize of block dwelling in some issue, maybe decreasing the need for explicit constructions that keep dwelling in non-optimum scenarios. ↩
  • When Electrum upgraded to segwit v0, it required somebody who desired to receive to bech32 addresses generate recent seeds. This used to be no longer technically required however it completely allowed the authors of Electrum to introduce some recent aspects into their custom seed derivation methodology. One of those aspects used to be capability for a seed model number to specify which scripts a seed is supposed to be worn with. This permits accumulate deprecation of weak scripts (e.g., a future a model of Electrum is more probably to be released that now no longer helps receiving to legacy P2PKH addresses).

    Across the the same time the Electrum developers had been deploying their versioned seeds, Bitcoin Core developers began the utilize of output script descriptors to resolve the the same field of permitting script deprecation (to boot to solving other problems). The next table compares Electrum’s versioned seeds and Bitcoin Core’s descriptors to the implicit scripts methodology beforehand worn by each and each wallets and peaceful in not fresh utilize among most other wallets.

Catch the normal post right here.

Please subscribe to the Bitcoin Optech newsletter straight to receive this lisp straight to your inbox each and each month.