3 ms·

> The effect is that instead of being limited to a few thousand bytes of operations for the rules governing your coin, you could have gigabytes of rules, and ye

by runeks 6y ago

> The effect is that instead of being limited to a few thousand bytes of operations for the rules governing your coin, you could have gigabytes of rules, and yet never expose them (and burn network resources and your privacy) -- or if you do need to to expose some of them, you only need to show a small amount. ... and as a bonus have your transactions look just like a really boring maximally simple wallet's transactions. If I have e.g. a 1GB script, how much of it will I need to reveal if my counterparty doesn’t cooperate? For example, is it realistic to have 1GB of script and only needing to reveal, say, 1KB in case the other party doesn’t cooperate?

nullc 6y ago
The amount you reveal depends on the construction of the script, but it scales with the log2() of the number of leaves in the DNF representation. So, for example, if you create a coin which could be spent by any Californian (assuming you knew a key for each), your full script would be 1.17 GB, but when someone spends the coin their signature would be 896 bytes, assuming you set it up to be equally efficient for all people. That 896 bytes plus the 32 byte public key would be all that ever hits the blockchain. You're not constrained to assume equal-probablity however: if you have a probability model for how likely each condition is you can construct a huffman tree and the overhead for any particular condition is just the number of bits in its huffman codeword times 32 bytes. If your probabilities are accurate this will minimize the average size. So for example, say your directory had a list of 100 known bitcoiners that were overwhelmingly likely to spend the coin their signature could be 288 bytes, while being just a bit larger for the other residents. If you, correctly, assumed that I would be the most likely to spend the coin you could stick my key at the root and I could spend it with just 64 bytes -- the same as an ordinary wallet controlled by one person rather than controlled by 40 million people. For some usages there is a key creation vs spending size tradeoff-- e.g. you can expand the tree further to make the revealed nodes smaller, at a cost of an exponential blowup in the time it takes you to construct the script. One thing that some protocols should be able to do (at least eventually) is set things up so that in the event of non-cooperation the additional transaction fees get mostly covered by the non-cooperating party.
- runeks 5y ago
  Thank you for the explanation! This sounds amazing. I’m really looking forward to seeing what can be built on top of Bitcoin if this activates.

by runeks 6y ago

nullc 6y ago

The amount you reveal depends on the construction of the script, but it scales with the log2() of the number of leaves in the DNF representation. So, for example, if you create a coin which could be spent by any Californian (assuming you knew a key for each), your full script would be 1.17 GB, but when someone spends the coin their signature would be 896 bytes, assuming you set it up to be equally efficient for all people. That 896 bytes plus the 32 byte public key would be all that ever hits the blockchain. You're not constrained to assume equal-probablity however: if you have a probability model for how likely each condition is you can construct a huffman tree and the overhead for any particular condition is just the number of bits in its huffman codeword times 32 bytes. If your probabilities are accurate this will minimize the average size. So for example, say your directory had a list of 100 known bitcoiners that were overwhelmingly likely to spend the coin their signature could be 288 bytes, while being just a bit larger for the other residents. If you, correctly, assumed that I would be the most likely to spend the coin you could stick my key at the root and I could spend it with just 64 bytes -- the same as an ordinary wallet controlled by one person rather than controlled by 40 million people. For some usages there is a key creation vs spending size tradeoff-- e.g. you can expand the tree further to make the revealed nodes smaller, at a cost of an exponential blowup in the time it takes you to construct the script. One thing that some protocols should be able to do (at least eventually) is set things up so that in the event of non-cooperation the additional transaction fees get mostly covered by the non-cooperating party.

runeks 5y ago
Thank you for the explanation! This sounds amazing. I’m really looking forward to seeing what can be built on top of Bitcoin if this activates.