mirror of
https://github.com/bitcoin/bips.git
synced 2026-05-11 16:51:51 +00:00
BIP-0322: wrap long lines at 100 characters
This re-formats the document for easier editing and diff viewing. Wiki syntax is weird for lists and line wraps break them. Simple lists were changed to <ul> or <ol> tags but complex lists remain as they are to not bloat the diff too much.
This commit is contained in:
Oli
@@ -13,19 +13,33 @@
|
||||
|
||||
== Abstract ==
|
||||
|
||||
A standard for interoperable signed messages based on the Bitcoin Script format, either for proving fund availability, or committing to a message as the intended recipient of funds sent to the invoice address.
|
||||
A standard for interoperable signed messages based on the Bitcoin Script format, either for proving
|
||||
fund availability, or committing to a message as the intended recipient of funds sent to the invoice
|
||||
address.
|
||||
|
||||
== Motivation ==
|
||||
|
||||
The current message signing standard only works for P2PKH (1...) invoice addresses. We propose to extend and generalize the standard by using a Bitcoin Script based approach. This ensures that any coins, no matter what script they are controlled by, can in-principle be signed for. For easy interoperability with existing signing hardware, we also define a signature message format which resembles a Bitcoin transaction (except that it contains an invalid input, so it cannot be spent on any real network).
|
||||
The current message signing standard only works for P2PKH (1...) invoice addresses. We propose to
|
||||
extend and generalize the standard by using a Bitcoin Script based approach. This ensures that any
|
||||
coins, no matter what script they are controlled by, can in-principle be signed for. For easy
|
||||
interoperability with existing signing hardware, we also define a signature message format which
|
||||
resembles a Bitcoin transaction (except that it contains an invalid input, so it cannot be spent on
|
||||
any real network).
|
||||
|
||||
Additionally, the current message signature format uses ECDSA signatures which do not commit to the public key, meaning that they do not actually prove knowledge of any secret keys. (Indeed, valid signatures can be tweaked by 3rd parties to become valid signatures on certain related keys.)
|
||||
Additionally, the current message signature format uses ECDSA signatures which do not commit to the
|
||||
public key, meaning that they do not actually prove knowledge of any secret keys. (Indeed, valid
|
||||
signatures can be tweaked by 3rd parties to become valid signatures on certain related keys.)
|
||||
|
||||
Ultimately no message signing protocol can actually prove control of funds, both because a signature is obsolete as soon as it is created, and because the possessor of a secret key may be willing to sign messages on others' behalf even if it would not sign actual transactions. No signmessage protocol can fix these limitations.
|
||||
Ultimately no message signing protocol can actually prove control of funds, both because a signature
|
||||
is obsolete as soon as it is created, and because the possessor of a secret key may be willing to
|
||||
sign messages on others' behalf even if it would not sign actual transactions. No signmessage
|
||||
protocol can fix these limitations.
|
||||
|
||||
== Types of Signatures ==
|
||||
|
||||
This BIP specifies three formats for signing messages: ''legacy'', ''simple'' and ''full''. Additionally, a variant of the ''full'' format can be used to demonstrate control over a set of UTXOs.
|
||||
This BIP specifies three formats for signing messages: ''legacy'', ''simple'' and ''full''.
|
||||
Additionally, a variant of the ''full'' format can be used to demonstrate control over a set of
|
||||
UTXOs.
|
||||
|
||||
{| class="wikitable"
|
||||
|- style="font-weight:bold;"
|
||||
@@ -50,7 +64,8 @@ This BIP specifies three formats for signing messages: ''legacy'', ''simple'' an
|
||||
| full <code>to_sign</code> transaction, consensus and base64-encoded
|
||||
|}
|
||||
|
||||
<sup>1</sup>: Possible on a technical level but should NOT be used anymore in the context of this BIP.<br/>
|
||||
<sup>1</sup>: Possible on a technical level but should NOT be used anymore in the context of this
|
||||
BIP.<br/>
|
||||
<sup>2</sup>: Excluding time lock scripts.
|
||||
|
||||
=== Legacy ===
|
||||
@@ -61,17 +76,29 @@ The legacy format MAY be used, but must be restricted to the legacy P2PKH invoic
|
||||
|
||||
=== Simple ===
|
||||
|
||||
A ''simple'' signature consists of a witness stack, consensus encoded as a vector of vectors of bytes, and base64-encoded. Validators should construct <code>to_spend</code> and <code>to_sign</code> as defined below, with default values for all fields except that
|
||||
A ''simple'' signature consists of a witness stack, consensus encoded as a vector of vectors of
|
||||
bytes, and base64-encoded. Validators should construct <code>to_spend</code> and
|
||||
<code>to_sign</code> as defined below, with default values for all fields except that
|
||||
|
||||
* <code>message_hash</code> is a BIP340-tagged hash of the message, as specified below
|
||||
* <code>message_challenge</code> in <code>to_spend</code> is set to the scriptPubKey being signed with
|
||||
* <code>message_signature</code> in <code>to_sign</code> is set to the provided simple signature.
|
||||
<ul>
|
||||
<li>
|
||||
<code>message_hash</code> is a BIP340-tagged hash of the message, as specified below
|
||||
</li>
|
||||
<li>
|
||||
<code>message_challenge</code> in <code>to_spend</code> is set to the scriptPubKey being signed
|
||||
with
|
||||
</li>
|
||||
<li>
|
||||
<code>message_signature</code> in <code>to_sign</code> is set to the provided simple signature.
|
||||
</li>
|
||||
</ul>
|
||||
|
||||
and then proceed as they would for a full signature.
|
||||
|
||||
=== Full ===
|
||||
|
||||
Full signatures follow an analogous specification to the BIP-325 challenges and solutions used by Signet.
|
||||
Full signatures follow an analogous specification to the BIP-325 challenges and solutions used by
|
||||
Signet.
|
||||
|
||||
Let there be two virtual transactions <code>to_spend</code> and <code>to_sign</code>.
|
||||
|
||||
@@ -87,7 +114,10 @@ The <code>to_spend</code> transaction is:
|
||||
vout[0].nValue = 0
|
||||
vout[0].scriptPubKey = message_challenge
|
||||
|
||||
where <code>message_hash</code> is a BIP340-tagged hash of the message, i.e. sha256_tag(m), where tag = <code>BIP0322-signed-message</code> and <code>m</code> is the message as is without length prefix or null terminator, and <code>message_challenge</code> is the to be proven (public) key script.
|
||||
where <code>message_hash</code> is a BIP340-tagged hash of the message, i.e. sha256_tag(m), where
|
||||
tag = <code>BIP0322-signed-message</code> and <code>m</code> is the message as is without length
|
||||
prefix or null terminator, and <code>message_challenge</code> is the to be proven (public) key
|
||||
script.
|
||||
|
||||
The <code>to_sign</code> transaction is:
|
||||
|
||||
@@ -101,26 +131,48 @@ The <code>to_sign</code> transaction is:
|
||||
vout[0].nValue = 0
|
||||
vout[0].scriptPubKey = OP_RETURN
|
||||
|
||||
A full signature consists of the base64-encoding of the <code>to_sign</code> transaction in standard network serialisation once it has been signed.
|
||||
A full signature consists of the base64-encoding of the <code>to_sign</code> transaction in standard
|
||||
network serialisation once it has been signed.
|
||||
|
||||
=== Full (Proof of Funds) ===
|
||||
|
||||
A signer may construct a proof of funds, demonstrating control of a set of UTXOs, by constructing a full signature as above, with the following modifications.
|
||||
A signer may construct a proof of funds, demonstrating control of a set of UTXOs, by constructing a
|
||||
full signature as above, with the following modifications.
|
||||
|
||||
* All outputs that the signer wishes to demonstrate control of are included as additional inputs of <code>to_sign</code>, and their witness and scriptSig data should be set as though these outputs were actually being spent.
|
||||
<ul>
|
||||
<li>
|
||||
All outputs that the signer wishes to demonstrate control of are included as additional inputs
|
||||
of <code>to_sign</code>, and their witness and scriptSig data should be set as though these
|
||||
outputs were actually being spent.
|
||||
</li>
|
||||
</ul>
|
||||
|
||||
Unlike an ordinary signature, validators of a proof of funds need access to the current UTXO set, to learn that the claimed inputs exist on the blockchain, and to learn their scriptPubKeys.
|
||||
Unlike an ordinary signature, validators of a proof of funds need access to the current UTXO set, to
|
||||
learn that the claimed inputs exist on the blockchain, and to learn their scriptPubKeys.
|
||||
|
||||
== Detailed Specification ==
|
||||
|
||||
For all signature types, except legacy, the <code>to_spend</code> and <code>to_sign</code> transactions must be valid transactions which pass all consensus checks, except of course that the output with prevout <code>000...000:FFFFFFFF</code> does not exist.
|
||||
For all signature types, except legacy, the <code>to_spend</code> and <code>to_sign</code>
|
||||
transactions must be valid transactions which pass all consensus checks, except of course that the
|
||||
output with prevout <code>000...000:FFFFFFFF</code> does not exist.
|
||||
|
||||
=== Verification ===
|
||||
|
||||
A validator is given as input an address ''A'' (which may be omitted in a proof-of-funds), signature ''s'' and message ''m'', and outputs one of three states
|
||||
* ''valid at time T and age S'' indicates that the signature has set timelocks but is otherwise valid
|
||||
* ''inconclusive'' means the validator was unable to check the scripts
|
||||
* ''invalid'' means that some check failed
|
||||
A validator is given as input an address ''A'' (which may be omitted in a proof-of-funds), signature
|
||||
''s'' and message ''m'', and outputs one of three states
|
||||
|
||||
<ul>
|
||||
<li>
|
||||
''valid at time T and age S'' indicates that the signature has set timelocks but is otherwise
|
||||
valid
|
||||
</li>
|
||||
<li>
|
||||
''inconclusive'' means the validator was unable to check the scripts
|
||||
</li>
|
||||
<li>
|
||||
''invalid'' means that some check failed
|
||||
</li>
|
||||
</ul>
|
||||
|
||||
==== Verification Process ====
|
||||
|
||||
@@ -153,31 +205,63 @@ Validation consists of the following steps:
|
||||
|
||||
Signers who control an address ''A'' who wish to sign a message ''m'' act as follows:
|
||||
|
||||
# They construct <code>to_spend</code> and <code>to_sign</code> as specified above, using the scriptPubKey of ''A'' for <code>message_challenge</code> and tagged hash of ''m'' as <code>message_hash</code>.
|
||||
# Optionally, they may set nLockTime of <code>to_sign</code> or nSequence of its first input.
|
||||
# Optionally, they may add any additional inputs to <code>to_sign</code> that they wish to prove control of.
|
||||
# They satisfy <code>to_sign</code> as they would any other transaction.
|
||||
<ol>
|
||||
<li>
|
||||
They construct <code>to_spend</code> and <code>to_sign</code> as specified above, using the
|
||||
scriptPubKey of ''A'' for <code>message_challenge</code> and tagged hash of ''m'' as
|
||||
<code>message_hash</code>.
|
||||
</li>
|
||||
<li>
|
||||
Optionally, they may set nLockTime of <code>to_sign</code> or nSequence of its first input.
|
||||
</li>
|
||||
<li>
|
||||
Optionally, they may add any additional inputs to <code>to_sign</code> that they wish to prove
|
||||
control of.
|
||||
</li>
|
||||
<li>
|
||||
They satisfy <code>to_sign</code> as they would any other transaction.
|
||||
</li>
|
||||
</ol>
|
||||
|
||||
They then encode their signature, choosing either ''simple'' or ''full'' as follows:
|
||||
|
||||
* If they added no inputs to <code>to_sign</code>, left nSequence and nLockTime at 0, and ''A'' is a Segwit address (either pure or P2SH-wrapped), then they may base64-encode <code>message_signature</code>
|
||||
* Otherwise they must base64-encode <code>to_sign</code>.
|
||||
<ul>
|
||||
<li>
|
||||
If they added no inputs to <code>to_sign</code>, left nSequence and nLockTime at 0, and ''A'' is a
|
||||
Segwit address (either pure or P2SH-wrapped), then they may base64-encode
|
||||
<code>message_signature</code>
|
||||
</li>
|
||||
<li>
|
||||
Otherwise they must base64-encode <code>to_sign</code>.
|
||||
</li>
|
||||
</ul>
|
||||
|
||||
== Compatibility ==
|
||||
|
||||
This specification is backwards compatible with the legacy signmessage/verifymessage specification through the special case as described above.
|
||||
This specification is backwards compatible with the legacy signmessage/verifymessage specification
|
||||
through the special case as described above.
|
||||
|
||||
== Reference implementation ==
|
||||
|
||||
* Bitcoin Core pull request (basic support) at: https://github.com/bitcoin/bitcoin/pull/24058
|
||||
<ul>
|
||||
<li>
|
||||
Bitcoin Core pull request (basic support) at: https://github.com/bitcoin/bitcoin/pull/24058
|
||||
</li>
|
||||
</ul>
|
||||
|
||||
== Acknowledgements ==
|
||||
|
||||
Thanks to David Harding, Jim Posen, Kalle Rosenbaum, Pieter Wuille, Andrew Poelstra, and many others for their feedback on the specification.
|
||||
Thanks to David Harding, Jim Posen, Kalle Rosenbaum, Pieter Wuille, Andrew Poelstra, and many others
|
||||
for their feedback on the specification.
|
||||
|
||||
== References ==
|
||||
|
||||
# Original mailing list thread: https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2018-March/015818.html
|
||||
<ol>
|
||||
<li>
|
||||
Original mailing list thread:
|
||||
https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2018-March/015818.html
|
||||
</li>
|
||||
</ol>
|
||||
|
||||
== Copyright ==
|
||||
|
||||
@@ -185,8 +269,11 @@ This document is licensed under the Creative Commons CC0 1.0 Universal license.
|
||||
|
||||
== Test vectors ==
|
||||
|
||||
Basic test vectors for message hashing, transaction hashes and "simple" variant test cases can be found in [[bip-0322/basic-test-vectors.json|<code>basic-test-vectors.json</code>]].
|
||||
Basic test vectors for message hashing, transaction hashes and "simple" variant test cases can be
|
||||
found in [[bip-0322/basic-test-vectors.json|<code>basic-test-vectors.json</code>]].
|
||||
|
||||
Generated test vectors for more "simple" and "full" variant test cases can be found in [[bip-0322/generated-test-vectors.json|<code>generated-test-vectors.json</code>]].
|
||||
Generated test vectors for more "simple" and "full" variant test cases can be found in
|
||||
[[bip-0322/generated-test-vectors.json|<code>generated-test-vectors.json</code>]].
|
||||
|
||||
They were generated using [https://github.com/guggero/btcd/blob/f0d8719873ac70412dd813ef6e81358864c4eaa3/btcutil/bip322/bip322_test.go#L910 this code].
|
||||
They were generated using
|
||||
[https://github.com/guggero/btcd/blob/f0d87198/btcutil/bip322/bip322_test.go#L910 this code].
|
||||
|
||||
Reference in New Issue
Block a user