4 ms·

So, basically, a dead code elimination scheme? I do wonder how it could ensure the code running is the actual code signed for as its hash would be different th

• nullc 5y ago
  Because the code is rearranged into a top level arbitrary tree ORs and the hashing commits to this tree. At signing time, the signer reveals a hash for every non-taken branch, so that the commitment still checks that leaf being executed was an admissible one. The dead-code elimination goes further than that, because at the top level this hash root is hidden inside a public key which can be a key controlled by all the participants jointly (or some subset if appropriate). At signing time if these top level parties are available and cooperate they can just sign, and no script is ever revealed, it's impossible for third parties to tell it was ever there-- saving resources and preserving privacy. (And the possibility to complete the transaction using the script means they don't gain from failing to cooperate)