...
Recording all transactions that have happened is done because that's the easiest way to generate the proof, not because storing that kind of history is the purpose of Bitcoin.
Well said.
embedding the hash of UTXO in the block headers and retaining only the last few hundred blocks is being experimented with as a client option.
The real trick will be figuring out a secure way of letting the entire network do it.
I don't think committed UTXO sets by themselves are sufficient.
I hadn't thought about this...
If a wrong UTXO hash would invalidate the block it should work, no? But then there's also incentive to omit it due to the risk of the block being rejected. Requiring it would be a hard fork? Is that the problem?
EDIT: found a good "in a nutshell" description:
https://rustyrussell.github.io/pettycoin/2014/11/29/Pettycoin-Revisted-Part-I:-UTXO-Commitments.htmlI've been a believer in UTXO commits for a while, it moves bitcoin nodes towards being maintainers of the current ledger instead of maintainers of every transaction in human history. The current ledger is arguably the useful aspect, there might be some value to the total history but we haven't seen it yet.
One way to make this work is to add a dedicated hash of the UTXO set to each block (this does not need to be in the header, it could follow the coinbase as a special transaction). The UTXO set would have to be in a deterministic order obviously.
With each block, the mining node would include a hash of the UTXO set that is valid for that block. Every P2P node would validate this hash against their UTXO set, which should match. Mined blocks with an invalid UTXO hash would be rejected by the network. Mined blocks with an accepted UTXO by the network could be trusted.
Today, to join the P2P network a full node needs to download:
1) The full history of every block
With a hash of the UTXO set, to join the P2P network a full node only needs to download:
1) The headers since genesis (small/easy)
2) The most recent full block
3) The UTXO set as of the most recent block, which is validated against the block's UTXO hash
That node would now have all the information needed to participate and fully validate new transactions and blocks. Any new transaction will either use inputs from the "starting" UTXO set (which has been validated) or inputs in new blocks that were generated.
For attacks, if you took control of the majority of nodes and majority of mining power, it might be possible to introduce an incorrect UTXO set and then have everyone blindly use that going forward. But this would be completely visible to anyone on the network at the time that I don't see how a successful attack would work. In addition the "full chain" would always be available to validate against, you could think of bitcoin having a few archival nodes with the full chain stored for prosperity.