9
votes
Accepted
Are Micropayment channels still subject to malleability after BIP65?
There are a variety of different ways to construct a micropayment channel, but there are two designs that I think are particularly relevant to your question about "simple, one-directional, ...
- 11.6k
9
votes
Accepted
Why was the Oct 2015 Transaction Malleability event possible in spite of BIP62/66?
Canonical DER signature implemented in BIP 66 fixes issue #1 of BIP 62 ( Non-DER encoded ECDSA signatures )
Amacilin's code exploits issue #5 in BIP 62 ( Inherent ECSDA signature malleability ), ...
- 2,072
8
votes
Accepted
Is it possible to combine two separate transactions into one transaction by only using their signatures?
The only possibility in Bitcoin today is the one described by kaykurokawa. Every signature specifies which inputs and outputs it signs for, so if you want independently-created signatures, it will be ...
- 95.8k
7
votes
Accepted
Are the witnesses segregated with Schnorr signatures?
Schnorr (bip-340) signatures have been introduced as part of v1 Segwit outputs with the CHECKSIGADD opcode. Therefore bip-340 signatures are part of the witness and are not part of the hash forming ...
- 5,577
6
votes
Accepted
Lightning network: how was malleability actually fixed?
As far as I know, the malleability issue was fixed with the Segwit soft fork in August 2017.
Yes.
Was the malleability issue fixed with SIGHASH_NOINPUTor with some other method?
No, using SegWit.
...
- 95.8k
6
votes
Is it possible to combine two separate transactions into one transaction by only using their signatures?
Yes. But they require the transaction to be signed a certain way. OP_CHECKSIG has settable flags, which determines which of the inputs and outputs are signed.
If SIGHASH_SINGLE and ...
- 2,072
6
votes
Accepted
Why was transaction malleability fix required for Lightning network?
Alice creates a multisig transaction sending 100btc to a shared Alice-Bob output–one that requires both signatures–and signs it. We’ll call this transaction Tx0. And she only reveals Tx0 to Bob after:
...
- 448
6
votes
Accepted
When is a Miniscript solution malleable?
Malleability in the context of Miniscript
Malleability is the possibility for a third party to turn a valid satisfaction into another valid satisfaction. That is, to change the witness in the input of ...
- 5,577
5
votes
How do I uniquely identify a transaction (to protect against malleability)?
This is an interesting problem, one that has been studied and discuss within the bitcoin community quite a bit.
The basic way to do this is to keep track of a normalized TXID alongside of the actual ...
- 14k
5
votes
Accepted
Does Segwit mean easier government monitoring?
No, that's completely wrong. There is absolutely no anonymity benefit to third-party transaction malleability.
Third-party transaction malleability makes use of a symmetry in ECDSA signatures that ...
- 69.8k
5
votes
Accepted
Are non-SegWit transactions still malleable?
It's important to point out that segwit doesn't prevent malleability: in many ways the actual transaction data can still be changed by third parties. It just makes it harmless for the purposes of ...
- 95.8k
4
votes
Accepted
Why are miners allowed to change a tx id?
BIP 62 proposed to make transaction malleability impossible.
No it didn't. It would have outlawed a limited number of known and addressable forms of malleability.
In particular, it did not prevent ...
- 95.8k
4
votes
Accepted
In ECDSA, why is (r,−s mod n) complementary to (r, s)?
ECDSA signatures are pairs (r,s) such that r = x(m/s*G + r/s*P) mod n, where P is the public key and m is the message digest. x() in that equation means "the X coordinate of".
In that ...
- 95.8k
4
votes
Are non-SegWit transactions still malleable?
Does that mean that non-SegWit transactions are still malleable?
Yes. Segwit does not change non-segwit inputs so the malleability fixes it introduces only apply to segwit inputs.
If so, what ...
- 66.4k
4
votes
Accepted
Transaction malleability
The transaction that you submitted and the transaction that was malleated in-flight or by a miner are both legitimate (valid) transactions. Transaction malleability means that a valid transaction can ...
- 7,213
4
votes
Is a transaction with a non-segwit input STILL considered malleable? If so how?
I think you are conflating two types of malleability:
The first one is txid malleability of a presigned transaction: two (or more) parties can't trustlessly build a chain of unconfirmed transactions ...
- 5,577
3
votes
testnet3 frequent tx malleability
The miner which confirms current blocks on testnet is malleating transactions. I can confirm this.
But what is the problem? Current consensus rules allow this. Trust me. I am an expert in ...
- 6,724
3
votes
Accepted
testnet3 frequent tx malleability
Someone (let's call her Alice onwards) is messing up with testnet transactions, it happened to one of mines earlier today.
What's happening
Alice is changing the s representation of the EDCSA ...
- 3,087
3
votes
Accepted
If well-built wallet software can avoid transaction malleability, why does the lightning network need an additional malleability fix?
My understanding is that wallets can avoid creating malleable transactions.
It depends. For typical transactions, standardness rules on the network make malleated transactions unlikely to be relayed ...
- 95.8k
3
votes
Accepted
OP_RETURN malleability?
The OP_RETURN is in the scriptPubKey, which is signed as part of the transaction, so it can't be altered. So it is not malleable.
The known types of malleability are described in BIP 62.
- 231
3
votes
Accepted
Bitcoin Core 0.13 -- jsonrpc interface -- conflicted transactions
If you call listtransaction, you should get a JSON array called walletconflicts.
If your transaction conflicts with another transaction in your mempool or with a transaction in a block, this ...
- 5,982
3
votes
Is transaction malleability the only consensus issue that needs fix to allow lightning network?
BIP62 has been scrapped and will never be implemented. Instead a much better solution with many more advantages, Seggregated Wittness, has been developed and is currently being rolled out. Its ...
- 6,296
3
votes
Transaction Malleability, if i want to change signature, what part should I change, so that it would remain valid?
A signature consists of two numbers r and s. You can change s with N - s (N is the elliptic curve order) and it would still be valid.
Sources of malleability are documented here https://github.com/...
- 3,459
3
votes
Accepted
Why didn't Bitcoin implement segwit in the first place?
Why didn't Bitcoin implement segwit in the first place?
The reason Bitcoin didn't initially have SegWit is up to interpretation, I would say that it simply was not thought of prior to transaction ...
- 983
3
votes
what does segwit remove?
If SegWit removes signature data, where does it put it exactly ? what does it mean that it puts at the end of the transaction ? and how does it make a block to contain more transactiosn?
It doesn't ...
- 95.8k
3
votes
How and when were high-s signatures made non-standard?
The requirement for transactions to only have low-s signatures is a standardness rule. Standardness is enforced at the mempool policy level and is not a protocol rule. Although the mempool behavior of ...
- 69.8k
3
votes
Is a transaction with a non-segwit input STILL considered malleable? If so how?
The status of BIP146 is “withdrawn”. Even for segwit inputs, high-s ECDSA signatures are only non-standard but consensus valid.
I don’t know about the other malleability issues in detail, but would ...
- 69.8k
3
votes
Accepted
Bitcoin transaction malleability is it only for unconfirmed transaction?
TL;DR: Yes, once a transaction is confirmed, unless a chain reorganization makes it unconfirmed again, no forms of malleability are possible. SegWit specifically fixed TXID malleability of unconfirmed ...
- 4,854
2
votes
Accepted
Is CheckSequenceVerify only a stop-gap measure?
CSV is not a stop-gap solution. Before you can say that, you first need to define what the problem is.
CSV solves the problem that you can't use CLTV in contracts that need a spending delay where the ...
- 95.8k
2
votes
Spending own generated unconfirmed change in the v.0.9.0 era
It is basically never a good idea to be spending from an unconfirmed transaction, regardless of transaction malleability fixes or other improvements. Unconfirmed transactions are not final and thus ...
- 66.4k
Only top scored, non community-wiki answers of a minimum length are eligible