Segregated witness and deploying it for Bitcoin

Bitcoin transactions

Inputs

Outputs

Script

Amount

TXID

Signatures

Signatures are only for fully validating nodes

Do not ever enter the UTXO set, so no long-term resource costs.

60% of the blockchain

Segregated Witness is about ignoring them where possible

Amount

Script

Inputs

Outputs

All equally needed?

Inputs

Outputs

Scaling Bitcoin, Hong Kong, 7 december 2015

Pieter Wuille

Segregated Witness for Bitcoin

For now, just refers to the scriptSig in inputs

Not part of a transaction's effect, only proving it

was authorized.

Signatures are part of the hash

Multiple possible, but we just care that one exists.

Such an example is called a witness.

We can't...

Assume we can redesign Bitcoin from scratch?

Block header

Inputs

Outputs

Script

Amount

TXID

Signature

Tampering

TXID

Signature

Amount

Script

Merkle tree of txn and witness

Advantages?

= Witness data

Drop signatures from relay

Prune old signatures

Solves all unintentional malleability

BIP62?

This seemed hard

BIP62?

Block header

Inputs

Outputs

Witness

Inputs

Outputs

Amount

Script

{v "Script"}

Signature

TXID ""

Amount

Script

Coinbase

Soft fork scaling

Script versions!

Fraud proofs

Instead of pushing the redeem script directly, add a version byte

A proposal

Simulation:

Currently, Bitcoin only has two security models:

* Full validation

* Header validation ("SPV")

An unknown version byte is treated as anyone can spend

The Bitcoin whitepaper suggested using fraud proofs

No longer restricted to redefining OP_NOP opcodes

All future Script changes become soft forks!

Bitcoin currently has no way to compactly prove subsidy fraud or spending non-existing output

* Add input value and UTXO creation location to witness

We can immediately use that mechanism to allow pushing the hash of the redeem script instead

Thank you

What old nodes see

Implement segregated witness now:

* Discount witness data by 75% for block size

* Or: block limit to 4 MB, but only for witness (soft fork!)

* Disincentivizes UTXO impact

* Fixes malleability

* Enables far simpler script upgrades

* Enables fraud proofs

* Allows pruning witness data for historical data

* Reduces bandwidth for light nodes and historical sync

* P2SH compatible for old senders

* Give time for IBLT and weak blocks to develop

Intend for a hard fork change near future:

* Switch to a cost-based metric

* Limited time cost growth

* Give time for higher level payment systems to develop

Future work:

* Finish prototype implementation

(https://github.com/sipa/bitcoin/segwit)

* Write BIP

Thanks to: Gregory Maxwell, Eric Lombrozo, Luke Dashjr