bitcoin-dev

[BIP] Normalized transaction IDs

[BIP] Normalized transaction IDs

Original Postby Adam Back

Posted on: November 5, 2015 22:29 UTC

A proposed solution to the problem of conflicting spends by the private key holder is discussed.

The solution involves creating a new public key type, r,Q, and a new address type, a=H(r,Q). A new signature type is also created, which requires that the r from sig=(r,s) matches the r committed to in the address. As the ECDSA signature is s=(H(m)+r*x)/k mod n, if two different messages are signed with the same r value, they reveal the private key via simultaneous equation, allowing anyone who sees both double spends to spend as they can replace the signature with their own one. This converts double signatures into miner can spend. The solution does not necessarily enforce no pubkey reuse (Q), but it does enforce no extended-address reuse (H=(r,Q)). Binary failure address reuse could be an issue and puts pressure on transactional storage on wallets. There is also discussion about the terminology confusion between "signature malleability" and "conflicting spends," with some arguing that addressing all kinds of malleability is necessary for a practically-useful solution.