delvingbitcoin

Proving UTXO set inclusion in zero-knowledge

Proving UTXO set inclusion in zero-knowledge

Original Postby ajtowns

Posted on: September 17, 2024 02:00 UTC

In an analysis of the proposed alternative to taproot ring signatures, a significant focus is placed on the efficiency and practicality of the verification process.

The method discussed eliminates the necessity for verifiers to possess the entire Unspent Transaction Output (UTXO) set, requiring only the corresponding "utreexo" root. This approach is lauded for its simplicity and potential to streamline verification processes in blockchain transactions.

However, the terminology used to describe this method as "utreexo" might not be entirely accurate. Traditional utreexo constructions necessitate knowledge of the entire UTXO set history, which cannot be recreated solely from the current UTXO set. This discrepancy suggests that the method in question more closely resembles a standard Merkle tree structure of the UTXO set rather than a true "utreexo" model. The distinction is crucial for understanding the limitations and functionalities of the proposed system.

Furthermore, doubts are raised regarding the applicability of this approach to lightning channel announcements. The concern stems from the possibility of proving a UTXO's existence at a certain block, only to have it spent in the subsequent block, essentially reducing the method to a mere proof-of-use-of-blockspace. Additionally, the potential for using the same UTXO multiple times with different blinding factors to announce multiple lightning channels introduces challenges to the integrity of the system. A suggested solution involves linking the verifier's public key to the advertised public key of the channel, potentially mitigating issues related to the resale of UTXOs.

For further details, readers are encouraged to review the technical discussion available at GitHub.