Does Bitcoin Unlimited keep ASICBOOST intact vs going with segwit?

Question

In light of the new findings about ASICBOOST from bitmain. Having that segwit disables ASICBOOST, does this mean that Bitcoin Unlimited leaves this ASICBOOST feature intact? Having that segwit disables this ASICBOOST feature, has Bitcoin Unlimited done the same?

Answer 1

How does ASICBoost work

ASICBoost relies on finding multiple block headers that match in the last sixteen bytes. As SHA-256 takes 64 byte chunks of input, this allows to reuse parts of the calculation for the second chunk.

The last sixteen bytes of the block header are composed of the

• last four bytes of the Merkle root of the transactions
• the time-stamp
• the difficulty statement
• the nonce.

Thus, the last twelve bytes are arbitrary and the only difficult part is to get four bytes of the Merkle root to match up. This could be done by actually using the same Merkle root, but then (since the hash of the previous block is fixed) the only remaining field in the header to introduce variation is the the version field! Mining blocks with varying version fields is pretty obvious and corresponds to the overt application of ASICBoost.

For a comprehensive explanation of ASICBoost see: Jeremy Rubin's Notes on ASICBoost [PDF]

Covert ASICBoost

On the other hand, the covert application relies on finding multiple Merkle roots that collide in the last four bytes. As we know, the Merkle root derives from forming a Merkle tree on all transactions. A straight forward way of doing this would be to grind the coinbase transaction extra-nonce space. However, each time when you change the coinbase transaction, you have to recalculate the complete left branch of the Merkle tree, which requires an additional 11 to 12 extra hashes for blocks with up to 2048 or 4096 transactions respectively. Obviously, finding a partial collision of the Merkle root would be twelve times faster performed on an empty block.

A more efficient way of finding partial collisions of the Merkle root would be to have a fixed left-side tree, i.e. an unchanging coinbase transaction, and to combine this with various right-sides of the tree. This would then only require a single hash to produce a new Merkle root, and you could immediately check whether you've found the desired collision.

In practice, you could efficiently generate right-side trees by combining several compatible candidate trees a few branches down from the Merkle root in different ways. This is why out-of-order transaction-fees and the absence of dependent transaction pairs could be indicators for the use of covert ASICBoost-usage. This process is highly parallelizable.

How does SegWit influence ASICBoost

This more efficient approach is broken by SegWit and many other BIPs, because it requires in the coinbase transaction a Merkle root commitment which is calculated order-sensitively from all other transactions in the block. This means that whenever any transaction in the block is updated the entire left-branch of the Merkle tree needs to be recalculated due to the updated coinbase transaction.

…and Bitcoin Unlimited?

To come back to your question: AFAIK, Bitcoin Unlimited does not require a commitment in the coinbase, and thus would be compatible with the covert application of ASICBoost.

Many thanks go to David Harding who explained the finer details of the above in chat, from which I've adapted some of the above paragraphs.