Timeline for Segwit includes the input amount in the SignatureHash. What possible attack can this prevent?
Current License: CC BY-SA 4.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 20, 2022 at 9:45 | comment | added | Antoine Poinsot | @AndrewChow actually it is. More than a couple thousands input per day contain an ACP signature. (transactionfee.info/charts/…, transactionfee.info/charts/…, transactionfee.info/charts/…) The Specter supports signing using ACP. However it it's an "advanced" thing. | |
| Jun 18, 2022 at 14:49 | history | edited | Ava Chow♦ | CC BY-SA 4.0 |
added 2 characters in body
|
| May 24, 2022 at 16:35 | comment | added | Ava Chow♦ | @TheQuantumPhysicist Yes, if you signed with anyone can pay, then the amounts are not directly committed to, because otherwise it wouldn't allow anyone to pay. The point of anyone can pay is that inputs can be added and removed by anyone, unless at least one input uses SIGHASH_ALL. However anyone can pay is almost never used in practice, and hardware signers (for which the protection is largely targeted towards) won't sign with anything other than SIGHASH_ALL. | |
| May 24, 2022 at 12:03 | comment | added | The Quantum Physicist | Thank you for the answer; I appreciate it. The Optech link in my question's comment gave me the answer, but the Taproot part from you is extra-helpful. If I understand correctly, the solution from Taproot is considered the default new way of doing things. If, however, someone wants to create an "Anyone can pay" commitment, the new solution wouldn't work, and then verification would require the old route of downloading the whole transaction of the inputs. Am I getting this right? | |
| May 24, 2022 at 11:49 | vote | accept | The Quantum Physicist | ||
| May 19, 2022 at 15:37 | comment | added | Pieter Wuille | The difference is really that with segwit, the input amounts are signed directly. They were already signed through the fact that the the prevout txids are signed, and these commit to the output amounts. But if signing software/hardware wants to observe those values, it needs to be provided with the preimages of those txids, which is a lot of data. By additionally including the input amounts directly in the signature message, we know signatures will be invalid if the amount provided to the signer mismatches the actual UTXO spent. | |
| May 19, 2022 at 15:26 | history | answered | Ava Chow♦ | CC BY-SA 4.0 |