7 ms·

Low-level Bitcoin

68 points by jc123 12y ago

b1db77d2 12y ago
A little note about the "make a privkey" section of the signature example; it can sometimes* make invalid privkeys that are off the end of the EC curve. Only integers between 0x1 and 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141 are valid in our particular case. Super unlikely to ever get a sha256 hash that matches the invalid portion, but it's worthwhile to point out. * probably never, but worth mentioning
- Theyeard 12y ago
  Excellent point, added as annotation, thanks!
- oleganza 12y ago
  This curve order limit actually introduces a small bias. You can choose a number greater than a curve order, but then it'll be taken modulo the order, so some incredibly small amount of numbers will be biased closer to zero. In practice the probability to hit such numbers is less than 2^-128, so you may easily skip all checks and take the number as is. Of course, nitpickers will nitpick and that's why in all standards that describe key and nonce generation (BIP32, RFC 6979 etc), you'll see boilerplate code that checks for such numbers and does some extra cumbersome computations just to avoid these from happening.
VMG 12y ago
Possible bug: The instructions BOOLAND and BOOLOR don't interpret the stack values the same way IF, VERIFY etc do. They decode the top stack values as integers and compare against zero, thus they have to fail when the top stack item size is greater than 4 bytes. Edit: littleEndian.decode also doesn't seem to respect the size limits Edit2: .. or signed integers for that matter. So while this is a very cool basic concept, it's not a complete implementation. The reference client provides test suites https://github.com/bitcoin/bitcoin/blob/master/src/test/data/script_valid.json https://github.com/bitcoin/bitcoin/blob/master/src/test/data... https://github.com/bitcoin/bitcoin/blob/master/src/test/data/script_invalid.json https://github.com/bitcoin/bitcoin/blob/master/src/test/data...
- Theyeard 12y ago
  Yes, you're right, numbers treatment is not exactly the same as in Bitcoin Core. The script interpreter supports only basics and it was implemented to show how Bitcoin Script works in general for another article [0]. But it was not clear from this text whether it's a complete implementation or not so it looks like a bug. I've added the annotation [1] and will update the interpreter in the future. Of course if one wanted to use Bitcoin in real projects I'd rather recommend Bitcoin.js [2] but that's another topic. Thanks for comment! [0]: https://curiosity-driven.org/bitcoin-contracts https://curiosity-driven.org/bitcoin-contracts [1]: https://curiosity-driven.org/low-level-bitcoin#operators https://curiosity-driven.org/low-level-bitcoin#operators [2]: http://bitcoinjs.org/ http://bitcoinjs.org/
  - VMG 12y ago
    No problem - I wasn't sure if this is something you're currently working on or just a demonstration. The script interpreter is a tricky beast that looks easy but has a lot of edge cases. If one client behaves slightly different, a blockchain fork could happen: https://bitcoin.org/en/alert/2013-03-11-chain-fork https://bitcoin.org/en/alert/2013-03-11-chain-fork
    - Theyeard 12y ago
      Yes, exactly. And there are a lot of tricky corner cases like SIGHASH_SINGLE when number of inputs != number of outputs with hash 0x01 [0]. Actually the entire implementation (Bitcoin Core) is the specification :) It's interesting from the software design point of view - an extreme case of backwards compatibility. It's hard even within Bitcoin Core as some changes already caused forks [1]. The article is just a demonstration but it won't hurt if it was as accurate as possible (while still being readable) :) [0] https://en.bitcoin.it/wiki/OP_CHECKSIG#Procedure_for_Hashtype_SIGHASH_SINGLE https://en.bitcoin.it/wiki/OP_CHECKSIG#Procedure_for_Hashtyp... [1] http://bitcoinmagazine.com/3668/bitcoin-network-shaken-by-blockchain-fork/ http://bitcoinmagazine.com/3668/bitcoin-network-shaken-by-bl...
norswap 12y ago
This article had me wondering what will happen when people start storing copyrighted data (or worse, pedopornographic images) inside the blockchain.
- Theyeard 12y ago
  They already do that: http://www.righto.com/2014/02/ascii-bernanke-wikileaks-photographs.html http://www.righto.com/2014/02/ascii-bernanke-wikileaks-photo... Also related: http://en.wikipedia.org/wiki/Illegal_number http://en.wikipedia.org/wiki/Illegal_number
  - the_mitsuhiko 12y ago
    So what happens if someone puts CP into the block chain and publishes the instructions to retrieve after two months?
    - Theyeard 12y ago
      The same thing that happens to every other data put in transactions - if they're included in blocks every node (full verifying node [0]) downloads it and stores it locally forever. [0]: https://code.google.com/p/bitcoinj/wiki/FullVerification https://code.google.com/p/bitcoinj/wiki/FullVerification
      - the_mitsuhiko 12y ago
        So a lawless space? What if a judge wants the data to be removed?
        lastcanal 12y ago
        Then they'd need some very powerful mining equipment! Bitcoin uses merkel trees to ensure transactions in blocks never change.
        JoeAltmaier 12y ago

68 points by jc123 12y ago

A little note about the "make a privkey" section of the signature example; it can sometimes* make invalid privkeys that are off the end of the EC curve. Only integers between 0x1 and 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141 are valid in our particular case. Super unlikely to ever get a sha256 hash that matches the invalid portion, but it's worthwhile to point out. * probably never, but worth mentioning

Theyeard 12y ago
Excellent point, added as annotation, thanks!
oleganza 12y ago
This curve order limit actually introduces a small bias. You can choose a number greater than a curve order, but then it'll be taken modulo the order, so some incredibly small amount of numbers will be biased closer to zero. In practice the probability to hit such numbers is less than 2^-128, so you may easily skip all checks and take the number as is. Of course, nitpickers will nitpick and that's why in all standards that describe key and nonce generation (BIP32, RFC 6979 etc), you'll see boilerplate code that checks for such numbers and does some extra cumbersome computations just to avoid these from happening.

VMG 12y ago

Possible bug: The instructions BOOLAND and BOOLOR don't interpret the stack values the same way IF, VERIFY etc do. They decode the top stack values as integers and compare against zero, thus they have to fail when the top stack item size is greater than 4 bytes. Edit: littleEndian.decode also doesn't seem to respect the size limits Edit2: .. or signed integers for that matter. So while this is a very cool basic concept, it's not a complete implementation. The reference client provides test suites https://github.com/bitcoin/bitcoin/blob/master/src/test/data/script_valid.json https://github.com/bitcoin/bitcoin/blob/master/src/test/data... https://github.com/bitcoin/bitcoin/blob/master/src/test/data/script_invalid.json https://github.com/bitcoin/bitcoin/blob/master/src/test/data...

Theyeard 12y ago
Yes, you're right, numbers treatment is not exactly the same as in Bitcoin Core. The script interpreter supports only basics and it was implemented to show how Bitcoin Script works in general for another article [0]. But it was not clear from this text whether it's a complete implementation or not so it looks like a bug. I've added the annotation [1] and will update the interpreter in the future. Of course if one wanted to use Bitcoin in real projects I'd rather recommend Bitcoin.js [2] but that's another topic. Thanks for comment! [0]: https://curiosity-driven.org/bitcoin-contracts https://curiosity-driven.org/bitcoin-contracts [1]: https://curiosity-driven.org/low-level-bitcoin#operators https://curiosity-driven.org/low-level-bitcoin#operators [2]: http://bitcoinjs.org/ http://bitcoinjs.org/
- VMG 12y ago
  No problem - I wasn't sure if this is something you're currently working on or just a demonstration. The script interpreter is a tricky beast that looks easy but has a lot of edge cases. If one client behaves slightly different, a blockchain fork could happen: https://bitcoin.org/en/alert/2013-03-11-chain-fork https://bitcoin.org/en/alert/2013-03-11-chain-fork
  - Theyeard 12y ago
    Yes, exactly. And there are a lot of tricky corner cases like SIGHASH_SINGLE when number of inputs != number of outputs with hash 0x01 [0]. Actually the entire implementation (Bitcoin Core) is the specification :) It's interesting from the software design point of view - an extreme case of backwards compatibility. It's hard even within Bitcoin Core as some changes already caused forks [1]. The article is just a demonstration but it won't hurt if it was as accurate as possible (while still being readable) :) [0] https://en.bitcoin.it/wiki/OP_CHECKSIG#Procedure_for_Hashtype_SIGHASH_SINGLE https://en.bitcoin.it/wiki/OP_CHECKSIG#Procedure_for_Hashtyp... [1] http://bitcoinmagazine.com/3668/bitcoin-network-shaken-by-blockchain-fork/ http://bitcoinmagazine.com/3668/bitcoin-network-shaken-by-bl...

norswap 12y ago

This article had me wondering what will happen when people start storing copyrighted data (or worse, pedopornographic images) inside the blockchain.

Theyeard 12y ago
They already do that: http://www.righto.com/2014/02/ascii-bernanke-wikileaks-photographs.html http://www.righto.com/2014/02/ascii-bernanke-wikileaks-photo... Also related: http://en.wikipedia.org/wiki/Illegal_number http://en.wikipedia.org/wiki/Illegal_number
- the_mitsuhiko 12y ago
  So what happens if someone puts CP into the block chain and publishes the instructions to retrieve after two months?
  - Theyeard 12y ago
    The same thing that happens to every other data put in transactions - if they're included in blocks every node (full verifying node [0]) downloads it and stores it locally forever. [0]: https://code.google.com/p/bitcoinj/wiki/FullVerification https://code.google.com/p/bitcoinj/wiki/FullVerification
    - the_mitsuhiko 12y ago
      So a lawless space? What if a judge wants the data to be removed?
      - lastcanal 12y ago
        Then they'd need some very powerful mining equipment! Bitcoin uses merkel trees to ensure transactions in blocks never change.
      - JoeAltmaier 12y ago