Anyways, yes, it is possible with Bitcoin *today*. Here are some IRC logs where gmaxwell partially explained it, and linked to a more in depth thread:
Quote from: #bitcoin-dev
(03:35:06 PM) rfish: https://en.bitcoin.it/wiki/Script
(03:35:08 PM) gmaxwell: No. Scripts have little to do with _outputs_ they control if a coin can be _spent_.
(03:35:11 PM) rfish: Is that implemented in bitcoin?
(03:35:22 PM) wyager left the room (quit: Quit: wyager).
(03:35:24 PM) gmaxwell: rfish: yes, from the very first public release.
(03:37:02 PM) rfish: hmmm, does one exist already?
(03:37:23 PM) gmaxwell: rfish: no, defeats the purpose of a lottery— to make money for its operator.
(03:38:23 PM) rfish: that evert X amount of blocks
(03:39:10 PM) rfish: the none zeros in the hash of Y blocks are summed together, used to pick a winner and automatically gives the loot to the winner
(03:40:00 PM) gmaxwell: rfish: no. you can't do exactly that, but a lottery can be constructed none the less. (depending on block hashes is generally a bad idea, fwiw)
(03:40:49 PM) rfish: why is depending on block hashes a bad idea?
(03:40:56 PM) gmaxwell: rfish: because miners control them.
(03:47:13 PM) justanotheruser: gmaxwell: is there a trustless way to determine a winner?
(03:47:35 PM) sipa: transaction hashes seems even worse than block hashes
(03:47:38 PM) gmaxwell: justanotheruser: players commit to random values by sharing hashes of them. then to redeem you provide preimages and the hash of them selects the winner.
(03:47:55 PM) gmaxwell: oh crap this is in #bitcoin-dev? (only noticed because sipa talked
)
(03:48:51 PM) justanotheruser: gmaxwell: This can be done in a transaction? Also, yes this is #bitcoin-dev. You can tell by the lack of "to da moon"
(03:48:53 PM) gmaxwell: justanotheruser: see also https://bitcointalksearch.org/topic/fair-coin-toss-with-no-extortion-and-no-need-to-trust-a-third-party-277048 and related threads.
(03:35:08 PM) gmaxwell: No. Scripts have little to do with _outputs_ they control if a coin can be _spent_.
(03:35:11 PM) rfish: Is that implemented in bitcoin?
(03:35:22 PM) wyager left the room (quit: Quit: wyager).
(03:35:24 PM) gmaxwell: rfish: yes, from the very first public release.
(03:37:02 PM) rfish: hmmm, does one exist already?
(03:37:23 PM) gmaxwell: rfish: no, defeats the purpose of a lottery— to make money for its operator.
(03:38:23 PM) rfish: that evert X amount of blocks
(03:39:10 PM) rfish: the none zeros in the hash of Y blocks are summed together, used to pick a winner and automatically gives the loot to the winner
(03:40:00 PM) gmaxwell: rfish: no. you can't do exactly that, but a lottery can be constructed none the less. (depending on block hashes is generally a bad idea, fwiw)
(03:40:49 PM) rfish: why is depending on block hashes a bad idea?
(03:40:56 PM) gmaxwell: rfish: because miners control them.
(03:47:13 PM) justanotheruser: gmaxwell: is there a trustless way to determine a winner?
(03:47:35 PM) sipa: transaction hashes seems even worse than block hashes
(03:47:38 PM) gmaxwell: justanotheruser: players commit to random values by sharing hashes of them. then to redeem you provide preimages and the hash of them selects the winner.
(03:47:55 PM) gmaxwell: oh crap this is in #bitcoin-dev? (only noticed because sipa talked
)(03:48:51 PM) justanotheruser: gmaxwell: This can be done in a transaction? Also, yes this is #bitcoin-dev. You can tell by the lack of "to da moon"
(03:48:53 PM) gmaxwell: justanotheruser: see also https://bitcointalksearch.org/topic/fair-coin-toss-with-no-extortion-and-no-need-to-trust-a-third-party-277048 and related threads.
