Timeline for Why don't add salt to the tapscript in Taproot?
Current License: CC BY-SA 4.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 19, 2021 at 15:19 | comment | added | Pieter Wuille | @MichaelFolkson As the tagged hash is predictable it can't function as a salt. It prevents the data being hashed from accidentally matching a hash used in a different context, but it cannot provide privacy as the tag isn't secret. | |
| Jul 19, 2021 at 9:02 | comment | added | sphpmp | If each leaf node has a different tag, then indeed that would be my answer, but I don't see that they are different at the moment (correct me if I'm wrong). And, thank you very much for your answer! | |
| Jul 19, 2021 at 9:00 | comment | added | sphpmp | Tagged Hash seems to prevent a branch node from being able to be interpreted as a leaf node. And all the tags for leaf nodes when I read BIP 341 were Tapleaf. So I guess it's still different from what salt means. | |
| Jul 19, 2021 at 8:44 | comment | added | Michael Folkson | I think the answer to your question then is that tagged hashes are used throughout Taproot and this performs a similar role to a salt. github.com/bitcoinops/taproot-workshop/blob/… | |
| Jul 19, 2021 at 8:15 | comment | added | sphpmp | No, I don't want to discuss here whether an attacker could spend this UTXO, but only whether this would lead to a leak of unused scripts, as this seems to defeat the original purpose of Taproot? And by adding salt to the script, for an observer, even if he knows some information, he cannot know the script corresponding to the hash (because of the presence of the salt). | |
| Jul 19, 2021 at 8:09 | comment | added | Michael Folkson | Just checking I understand your question. In your scenario a script is revealed and a blockchain observer uses the details of that script to try to work out through (informed) brute force the other scripts in the Taproot tree (MAST) that weren't revealed and used to spend? Or uses the details of that script to try to work out the other scripts in other Taproot trees? Because obviously the observer/attacker doesn't know the private key(s) and so can't steal the funds even if he/she succeeds in brute forcing a particular script from a hash. | |
| Jul 19, 2021 at 7:53 | comment | added | sphpmp | Yes, it would be very difficult to find hash collisions, but would it be easier if there were some qualifications? For example, the three unlocking conditions in a MAST are 1. sig from A && sig B && timelock 10 Blocks 2. sig from A && timelock 100 Blocks 3. sig from B && timelock 200 Blocks They then eventually unlocked with condition 1. The observer then tries A's public key + time lock to collide. I know this is a rare example, but it still works, right? And if you add salt to the script it seems to stop it? | |
| Jul 19, 2021 at 7:40 | history | edited | Michael Folkson | CC BY-SA 4.0 |
added 268 characters in body
|
| Jul 19, 2021 at 7:31 | history | answered | Michael Folkson | CC BY-SA 4.0 |