pull down to refresh
within a chunk the keys are sequential, so the pubkeys areP,P+G,P+2G, and each thread jumps to the start of its slice with a small table of multiples of G, then walks the slice at one point addition per key. Affine addition needs a modular inverse, the expensive op, so each thread batches 48 points and inverts all their Z-coordinates together with Montgomery's trick: one Fermat inverse for the batch instead of 48.
Cool 🤩️
I did not hand-write the crypto; a lot of it came out of LLMs.
oh
I get about 15.3 million keys per second in Chromium on Linux with an NVIDIA GeForce GTX 1060 6GB (using the proprietary NVIDIA driver)
Aggregation of signatures leads to smaller transactions. Therefore transactions become cheaper.
Witness space has a 75% discount: 1 Byte in the Witness is counted as only 0.25 vBytes.
Therefore if there are many bytes that make use of this discount in a block, it bloats the block size. When a block is filled to the brim with witness data, it can go up to almost 4 MB.
With CISA, we would aggregate many signatures into one and therefore use less witness space.
It wouldn't stop data embedding, but at least actual monetary transactions would become more efficient and cheaper.
If we want to go even further and discourage data embedding, we could remove the witness discount. But that would probably be harder to get consensus on.
Before the witness discount, creating an output was cheaper than spending an input. The original purpose of the witness discount was to incentivize UTXO consolidation by making inputs cheaper than outputs. But with CISA, UTXO consolidation would naturally become cheaper by using less space. This might make the witness discount obsolete. But as I said, I expect some people to be opposed to removing the witness discount, even though I would prefer it.
BIP458 and BIP459 🥳
Glad to see progress on Cross Input Signature Aggregation. Would be awesome to one day have it on Bitcoin:
- Cheaper coinjoins (incentivizing on-chain privacy)
- Smaller transaction size
- More transaction throughput
- Lower fees
- Smaller blocks due to less use of witness space
A soft fork is backward-compatible, a hard fork isn't.
A hardfork is a change to the bitcoin protocol that makes previously invalid blocks/transactions valid, and therefore requires all users to upgrade.
https://en.bitcoin.it/wiki/Hardfork
A softfork is a change to the bitcoin protocol wherein only previously valid blocks/transactions are made invalid. Since old nodes will recognize the new blocks as valid, a softfork is backward-compatible. When a majority of miners upgrade to enforce new rules, it is called a miner-activated softfork (MASF). When full nodes coordinate to enforce new rules, without support from miners, it is called a user-activated softfork (UASF).
Still don't understand why SIGHASH_SINGLE bug is not being fixed in this consensus cleanup: https://www.mail-archive.com/bitcoin-development@lists.sourceforge.net/msg01408.html
https://xcancel.com/1440000bytes/status/2040542265781915809
Good point.
See here for more info about this bug: https://github.com/MatanHamilis/sighash_post
Bier’s implicit view: users rejected large-block hard forks.
Had to specify hard forks, because a block size increase via a soft fork is something we got with SegWit.
Cross Input Signature Aggregation (CISA) mentioned 🤩️
- Better incentives for Coinjoins
- More transaction throughput
- Smaller blocks due to less use of witness space
It would be a win on all fronts!
It was 300kB.
If we had 300 kilobyte blocks starting today, it's 1x the peak sync time in 2019, and we get back to the 2013 sync time in 2035.
OP_0 OP_IF in p2sh scriptsigs will simply thrive on a BIP-110 upgraded chain.At least that wouldn't benefit from the witness discount.
This is for load balancing between several public nodes by including route hints for all the nodes in the invoice. How would that give you deniability that you recieved a payment?
While I do enjoy browsing r/unixporn from time to time, I personally don't actually do any ricing. While I do think it looks cool, it is quite distracting and not exactly benefitial for productivity.
A miner who wants immediate, predictable revenue can sell shares for a fixed return in an open market. A market maker willing to warehouse variance can buy those shares in exchange for expected upside.
👀️ interesting
Hope this can make centralized FPPS pools obsolete.
When I read "CISA" I get excited about Cross-Input Signature Aggregation. Unfortunately this is not news about that kind of CISA. :(
A high end consumer GPU could probably crack it in a few seconds using an optimized Pollard's Kangaroo implementation once the public key is revealed.