From d16d687433141e54ceec03279d3e1d5979a208e2 Mon Sep 17 00:00:00 2001 From: Antoine Poinsot Date: Mon, 9 Jan 2023 14:23:40 +0100 Subject: [PATCH] website: mention that malleability analysis assumes common standardness rules --- index.html | 1 + 1 file changed, 1 insertion(+) diff --git a/index.html b/index.html index 2e42c6f..eb310ba 100644 --- a/index.html +++ b/index.html @@ -538,6 +538,7 @@

Malleability

  • The attacker does not have access to any of the private keys of public keys that participate in the Script. Participants with private keys inherently have the ability to produce different satisfactions by creating multiple signatures. While it is also interesting to study the impact rogue participants can have, we treat it as a distinct problem.
  • The attacker only has access to hash preimages that honest users have access to as well. This is a reasonable assumption because hash preimages are revealed once globally, and then available to everyone. On the other hand, making the assumption that attackers may have access to more preimages than honest users makes a large portion of scripts impossible to satisfy in a non-malleable way.
  • The attacker gets to see exactly one satisfying witness of any transaction. If he sees multiple, it becomes possible for the attacker to mix and match different satisfactions. This is very hard to reason about.
    • +
  • The attacker is constrained by common standardness rules. A miner may be able to malleate a witness considered non-malleable by Miniscript.
  • We restrict this analysis to scripts where no public key is repeated. If signatures constructed for one part of the script can be bound to other checks in the same script, a variant of the mixing from the previous point becomes available that is equally hard to reason about. Furthermore this situation can be avoided by using separate keys.