4 ms·

Bitcoin script is a large source of complexity, and it turns out to be mostly redundant. Schnorr signatures allow the use of so-called scriptless scripts [1] [2

by tromp 3y ago

Bitcoin script is a large source of complexity, and it turns out to be mostly redundant. Schnorr signatures allow the use of so-called scriptless scripts [1] [2], which can do most of the things than Bitcoin script is used for, including multisig, absolute and relative timelocks, payment channels, discrete log contracts, and atomic swaps (using adaptor signatures). All without the need for a scripting language. The example you gave of a multisig output that can be spent by either Alice, or Bob after some time, is easily handled too. [1] https://github.com/BlockstreamResearch/scriptless-scripts https://github.com/BlockstreamResearch/scriptless-scripts [2] https://tlu.tarilabs.com/cryptography/introduction-to-scriptless-scripts https://tlu.tarilabs.com/cryptography/introduction-to-script...

adastra22 3y ago
> absolute and relative timelocks That's a stretch. Replacing timelocks with hashcash (or equivalent) is hardly the same thing. But generally speaking "scriptless scripts" suffer from the need for interactive construction. There's a long way to go until scriptless scripts is a full replacement for script, if it is even possible.
- tromp 3y ago
  Who said anything about replacing timelocks with hashcash? I'm talking about actual relative timelocks, that put a minimum block distance between 2 particular transactions. > suffer from the need for interactive construction. Interactive construction is already widely in use in relative timelocks' prime application of payment channels.
  - adastra22 3y ago
    The scope of potential smart contract applications is much broader, and vastly more interesting than payment channels (yawn). And payment channels are pretty much the only application (definitionally) in which you can get away with "all parties are online, or this contract will be cancelled anyway" assumptions. Do you have a citation for a block-based relative timelock? The only such things I've seen are verifiable delay functions, which are a lot more like hashcash. What about absolute lock times? Those are far more interesting in applications of business logic, like logistics contracts. Most of which require non-interactive state updates.
    - tromp 3y ago
      > payment channels (yawn) Don't you find 2nd layers like Lightning interesting, as a way to scale far beyond the limited L1 capacity? > Do you have a citation for a block-based relative timelock? See the thread starting with https://lists.launchpad.net/mimblewimble/msg00546.html https://lists.launchpad.net/mimblewimble/msg00546.html > What about absolute lock times? Those are trivially supported in any Mimblewimble chain.
      - adastra22 3y ago
        Not really, no. Lightning is still payments, multi-party and multi-hop. If the entire realm of Blockchain and smart contract technology was restricted to just payments, well I suppose that would be something. But far short of the total revolution of societal structure that was promised. I personally wouldn’t care to work on it if that was the case. Lightning is an implementation of distributed payments. Smart contracts are an implementation of decentralized law. Your link to the mailing list thread describes essentially the same approach that bitcoin has for dealing with lock times. I would not normally describe this as “scriptless scripts,” which I have understood to me using the signing operation itself to achieve some goal that would otherwise be done in script. The locktime here is still enforced by special cased code of the consensus algorithm. If the number of things you want to do are fixed and enumerable then I suppose this is a valid approach. But it does not allow for general, arbitrary, future-defined constraints. To give a concrete, simple example: show me how to do a return peg validation on scriptless scripts. If it can’t even do that, it is not a replacement for scripts.
        tromp 3y ago
        > far short of the total revolution of societal structure that was promised. Satoshi promised no such thing. That sounds more like an Ethereum promise (to which I don't subscribe). > show me how to do a return peg validation on scriptless scripts How does one do return peg validation in bitcoin script?
        adastra22 3y ago

by tromp 3y ago

adastra22 3y ago

> absolute and relative timelocks That's a stretch. Replacing timelocks with hashcash (or equivalent) is hardly the same thing. But generally speaking "scriptless scripts" suffer from the need for interactive construction. There's a long way to go until scriptless scripts is a full replacement for script, if it is even possible.

tromp 3y ago
Who said anything about replacing timelocks with hashcash? I'm talking about actual relative timelocks, that put a minimum block distance between 2 particular transactions. > suffer from the need for interactive construction. Interactive construction is already widely in use in relative timelocks' prime application of payment channels.
- adastra22 3y ago
  The scope of potential smart contract applications is much broader, and vastly more interesting than payment channels (yawn). And payment channels are pretty much the only application (definitionally) in which you can get away with "all parties are online, or this contract will be cancelled anyway" assumptions. Do you have a citation for a block-based relative timelock? The only such things I've seen are verifiable delay functions, which are a lot more like hashcash. What about absolute lock times? Those are far more interesting in applications of business logic, like logistics contracts. Most of which require non-interactive state updates.
  - tromp 3y ago
    > payment channels (yawn) Don't you find 2nd layers like Lightning interesting, as a way to scale far beyond the limited L1 capacity? > Do you have a citation for a block-based relative timelock? See the thread starting with https://lists.launchpad.net/mimblewimble/msg00546.html https://lists.launchpad.net/mimblewimble/msg00546.html > What about absolute lock times? Those are trivially supported in any Mimblewimble chain.
    - adastra22 3y ago
      Not really, no. Lightning is still payments, multi-party and multi-hop. If the entire realm of Blockchain and smart contract technology was restricted to just payments, well I suppose that would be something. But far short of the total revolution of societal structure that was promised. I personally wouldn’t care to work on it if that was the case. Lightning is an implementation of distributed payments. Smart contracts are an implementation of decentralized law. Your link to the mailing list thread describes essentially the same approach that bitcoin has for dealing with lock times. I would not normally describe this as “scriptless scripts,” which I have understood to me using the signing operation itself to achieve some goal that would otherwise be done in script. The locktime here is still enforced by special cased code of the consensus algorithm. If the number of things you want to do are fixed and enumerable then I suppose this is a valid approach. But it does not allow for general, arbitrary, future-defined constraints. To give a concrete, simple example: show me how to do a return peg validation on scriptless scripts. If it can’t even do that, it is not a replacement for scripts.
      - tromp 3y ago
        > far short of the total revolution of societal structure that was promised. Satoshi promised no such thing. That sounds more like an Ethereum promise (to which I don't subscribe). > show me how to do a return peg validation on scriptless scripts How does one do return peg validation in bitcoin script?
        adastra22 3y ago