Topic: Pruning OP_RETURNs with illegal content (Read 4182 times)

I built a simple testbed that encodes data in "sigs" (that use random K values) and although not the cheapest way to store data (the experiment was two bytes per sig and on an average laptop was taking roughly 15 seconds per byte pair to "mine" the sigs) it demonstrates that it is impossible to stop encoding of whatever data you want in the blockchain without even using OP_RETURN stuff.

One way to help with this is to make P2SH mandatory.

This means that the UTXO set could be stored as a set of hashes.  You don't even have to store the hash target.

UTXO pays to H = hash(output script)

You can store hash(salt | hash(output script)).  The salt isn't really required.

When someone tries to spend the output, they have to provide the output script as part of the P2SH process.

Archive nodes would have to store H though.  Attackers could encode their data in H.

This could be helped by requiring that blocks near the tip include H, but blocks more than 144 blocks deep can encode hash(H).

New blocks

UTXO: pay to H1 = hash(output script)

Old blocks

UTXO: pay H2 = hash(hash(output script))

This ensures that all the long term hashes (H2) have a known H1 that they are a hash of.

This makes it harder to encode info in the hashes.  You could still encode it in the last few bits though.

I have to agree with that about PGP.

In my opinion, information implies storage and presentation. Take child pornography as an example, the data stored in the hard disk or even blockchain is storage, the video which decoded from that data is presentation. You CAN NOT prevent somebody publishing the data, cause the data can be transferred into infinite formations. If it's said that blockchain must solve this problem, so ALL the information systems also need to solve it.

There should be an upvote or karma button on this forum.
Or otherwise a bitcoin voting system something.

I like your post. I would upvote.

The funny thing is, bitcoin doesn't give a f*ck about rules or law.
Bitcoin doesn't 'know' what is illegal or not.
So, it doesn't matter.

I would like to invite anybody to put as much 'illegal' zeros and ones into the blockchain as possible.
I'm pretty sure that bitcoin will live on like nothing really happened.

Isn't it great?

#unicorns

Sure, you wouldn't want to do that with random scripts in the blockchain.

On the other hand, colored coin techniques allow you to know if the recipient of certain utxos has indicated a readiness to participate in Diffie-Hellman payments due to the fact that they've handled the outputs in a manner consistent with the color rules.

If one of the coloring rules happens to be "outputs of this color must be stored in pay-to-pubkey or pay-to-multisig outputs", then you could have the colored coins represents shares, and use Diffie-Hellman to derive dividend payment addresses.

Doesn't even require OP_RETURN for any step of the process.

It's true but that data can be provided in a way thats optional-- aux data that may or may not come along with the blocks-- or even completely externally.  It's not like you can expect to grab other people's random pubkeys and do things with them and have anything but doom come of it. ("What do you mean you didn't know, I sent you a message!" "No you didn't." "Yes I did, it was right here." "Thats not my house, thats the neighbors flower bed." "Yea, so? it was accessible to you! plus it was encrypted with your key!" "and thats not my key!" "Sure it is, I took this random key you used in 1997 and added four to it, you could have decoded that"...)

The answer is yes. In two ways:  The easier but less useful way is to point out that Zero Knowledge proofs for general computation are known to be possible (and are verging on practical for non-trivial problems now).  In theory I could give you a blockchain tip, a utxo set for it, and it's total work behind it, along with a ZK proof that the chain was completely valid, and that the utxo set agrees. This meets your criteria.

The other way depends exactly on what you mean by "blockchain validation". Basically, do you ever consider signatures prunable? e.g. when they're burried deep in the chain.  We do know how to make txout scriptPubKeys "provable a hash". If signatures are pruned and all txouts are hashes then there are basically no non-trivial sidechannels left.

On the other hand, if those pubkeys are actually pubkeys and not arbitrary data, you can do Diffie-Hellman with them.

That's a useful property.

It may be absurd that there is reason to be concerned about such things, but there is reason to be concerned none the less.  Sometimes the world is absurd.

I'm not Peter, but yes it absolutely is absurd.  What is legal is constantly changing and has thousands of different definitions depending on where you happen to be.

The whole point of Bitcoin is technology that works across all borders and allows for consensus everywhere, irrespective of borders and man-made laws.  If you don't like some of the data that gets stored on your computer, you are free to delete it.  But yes, full nodes must keep all data passed to them.  That's how the system works.  It's *good* it works that way.

Yes tools that enable free speech also allow bad guys to say bad things, but having free speech guaranteed by technology is worth that price.  Tor is valuable even if it allows pedos to set up hidden services.  PGP is valuable even if it means the terrorists can plan things.  Bitcoin is valuable even if it means nodes get passed data they don't approve of.  The benefits of these technologies far outweight these concerns, and their preservation is of the utmost importance, far outweighing the concern for the bad things bad people do with them.  Robbers and kidnappers use cars and phones to do the bad things they do -- but would you think it's appropriate that the government should monitor where you go and who you call to make sure that you don't engage in that activity?

There is no tool that only does good things for good people.  There are only tools.  We accept that some tools make life easier for bad people, because they also make life so much better for good people.  Having phones and cars... and Tor and PGP and Bitcoin, is better than a world without those things.  And talking about crippling them so that their bad uses are harder does nothing but cripple the entire system, and subverts the entire point of the technology.

There is no phone that can only be used by good people.  And there is no distributed consensus system that can take any kind of data except illegal data.  And to talk about such a thing is silly... but to *want* such a thing is absurd.

Yes, it is absurd.

well said Peter.

There is no reason for you, personally, to keep around any old transactions for things burred in the blockchain. Pruning removes all transactions and signatures already and a full verifying node can happily be run this way.

I don't think there is a technical solution either.  I don't think there is a political one either given the immense number of jurisdictions.  It is like trying to remove pee from a pool instantly.

If the "illegal where" is "where the individual user is located" there is really no solution since some data can not be pruned except some type of blacklist (a bad idea as above) where the most restrictive laws anywhere are enforced.  That was kind of the point in asking the question. :-)

Illegal where the individual user is located.  I don't think there is a technical solution because Bitcoin's scripting language is so open ended*.  If it was impossible to store arbitrary data outside of OP_RETURN outputs and OP_RETURN outputs could be pruned (intra-transaction pruning) then it wouldn't be universally pruned.  Local users would prune what they feel is objectionable or illegal on an individual basis.  All that is academic though because it is so easy to encode arbitrary data in the blockchain in a manner which simply can not be pruned by full nodes.

The simplest method would be in a native (non-P2SH) multisig output.  Any PkScript would work but up to 3 of 3 native multisig with an output just above the dust threshold is considered standard, can't be pruned, and can be used multiple times in one transaction.

PkScript:  1 3 OP_CHECKMULTISIG

Instead of three valid pubkeys one could encode up to 195 bytes:

PkScript:  1 <65 bytes> <65 bytes> <65 bytes> 3 OP_CHECKMULTISIG

Now this can never be provably never be spent so nodes could remove it from the UTXO but that is easily solved by encoding 128 bytes using two fake pubkeys w/ proper prefix and one valid key.

PkScript:  1 <04|64 bytes> <04|64 bytes> 3 OP_CHECKMULTISIG


* I think the problem is more universally described as can a blockchain be constructed such that non-transaction data is limited only to outputs that can be pruned without affecting blockchain validation.  I believe the answer is no.  It can be made harder to accomplish but it can't be made impossible.