3 ms·

It's more like a two-party roll of a die with a practically infinite number of faces. If both rolls sum even, Alice wins. Otherwise, Bob wins. Alice and Bob co

by apo 8y ago

It's more like a two-party roll of a die with a practically infinite number of faces. If both rolls sum even, Alice wins. Otherwise, Bob wins. Alice and Bob commit to their rolls by hashing them then making a future spend contingent on revealing the roll that produced the hash. The trick is how to reveal both rolls without giving an advantage to the one who reveals second. This is the problem the protocol solves - through transaction setup and the newly-activated Script opcodes.

EthanHeilman 8y ago
>It's more like a two-party roll of a die with a practically infinite number of faces. If both rolls sum even, Alice wins. Otherwise, Bob wins. What you are describing is a coin flipping protocol [0]. From the article: >To my knowledge this is the first time someone has proposed such a scheme on Bitcoin though I suppose it's possible it has come up before and I just missed it. There have been coin flipping protocols for Bitcoin since at least 2013-2014 [1]. The main contribution of the above post appears to be that they actually performed the protocol which is neat and quite a bit of work. [0]: https://en.wikipedia.org/wiki/Commitment_scheme#Coin_flipping https://en.wikipedia.org/wiki/Commitment_scheme#Coin_flippin... [1]: Back, Bentov (2014) https://arxiv.org/abs/1402.3698 https://arxiv.org/abs/1402.3698
- Promarged 8y ago
  This paper [0] (from 2013) linked from this article [1] was also executed on chain, see date here [2] and the actual script via API here [3]. [0]: https://eprint.iacr.org/2013/784 https://eprint.iacr.org/2013/784 [1]: https://curiosity-driven.org/bitcoin-contracts https://curiosity-driven.org/bitcoin-contracts [2]: https://blockexplorer.com/tx/7ae5760af2105a5ba54a914f188686e2743ead50cd690afb7e609f7b99e0ae31#o0 https://blockexplorer.com/tx/7ae5760af2105a5ba54a914f188686e... [3]: https://blockexplorer.com/api/tx/7ae5760af2105a5ba54a914f188686e2743ead50cd690afb7e609f7b99e0ae31#o0 https://blockexplorer.com/api/tx/7ae5760af2105a5ba54a914f188...

by apo 8y ago

EthanHeilman 8y ago

>It's more like a two-party roll of a die with a practically infinite number of faces. If both rolls sum even, Alice wins. Otherwise, Bob wins. What you are describing is a coin flipping protocol [0]. From the article: >To my knowledge this is the first time someone has proposed such a scheme on Bitcoin though I suppose it's possible it has come up before and I just missed it. There have been coin flipping protocols for Bitcoin since at least 2013-2014 [1]. The main contribution of the above post appears to be that they actually performed the protocol which is neat and quite a bit of work. [0]: https://en.wikipedia.org/wiki/Commitment_scheme#Coin_flipping https://en.wikipedia.org/wiki/Commitment_scheme#Coin_flippin... [1]: Back, Bentov (2014) https://arxiv.org/abs/1402.3698 https://arxiv.org/abs/1402.3698

Promarged 8y ago
This paper [0] (from 2013) linked from this article [1] was also executed on chain, see date here [2] and the actual script via API here [3]. [0]: https://eprint.iacr.org/2013/784 https://eprint.iacr.org/2013/784 [1]: https://curiosity-driven.org/bitcoin-contracts https://curiosity-driven.org/bitcoin-contracts [2]: https://blockexplorer.com/tx/7ae5760af2105a5ba54a914f188686e2743ead50cd690afb7e609f7b99e0ae31#o0 https://blockexplorer.com/tx/7ae5760af2105a5ba54a914f188686e... [3]: https://blockexplorer.com/api/tx/7ae5760af2105a5ba54a914f188686e2743ead50cd690afb7e609f7b99e0ae31#o0 https://blockexplorer.com/api/tx/7ae5760af2105a5ba54a914f188...