[BIP] Normalized transaction IDs

Posted by Adam Back

Nov 5, 2015/22:29 UTC

A proposed solution to the problem of conflicting spends by the private key holder is discussed. The solution involves creating a new public key type, r,Q, and a new address type, a=H(r,Q). A new signature type is also created, which requires that the r from sig=(r,s) matches the r committed to in the address. As the ECDSA signature is s=(H(m)+r*x)/k mod n, if two different messages are signed with the same r value, they reveal the private key via simultaneous equation, allowing anyone who sees both double spends to spend as they can replace the signature with their own one. This converts double signatures into miner can spend. The solution does not necessarily enforce no pubkey reuse (Q), but it does enforce no extended-address reuse (H=(r,Q)). Binary failure address reuse could be an issue and puts pressure on transactional storage on wallets. There is also discussion about the terminology confusion between "signature malleability" and "conflicting spends," with some arguing that addressing all kinds of malleability is necessary for a practically-useful solution.

Link to Raw Post
Bitcoin Logo

TLDR

Join Our Newsletter

We鈥檒l email you summaries of the latest discussions from authoritative bitcoin sources, like bitcoin-dev, lightning-dev, and Delving Bitcoin.

Explore all Products

ChatBTC imageBitcoin searchBitcoin TranscriptsSaving SatoshiBitcoin Transcripts Review
Built with 馃А by the Bitcoin Dev Project
View our public visitor count

We'd love to hear your feedback on this project?

Give Feedback