bitcoin-dev

Should Graftroot be optional?

Should Graftroot be optional?

Original Postby Gregory Maxwell

Posted on: June 20, 2018 14:30 UTC

In a recent Bitcoin development discussion, the concept of graftroot signatures was brought up.

One potential advantage of these signatures is that they commit to a single outpoint, which makes it impossible for them to be used to spend all outpoints that pay to the same public key. However, if a graftroot signature cannot be made independent of the outpoint, this greatly reduces its functionality. This is because users would have to stay online and sign new grafts as coins show up, rather than being able to prepare grafts before the coins exist. The two main benefits of grafts are the ability to delegate before coins exist and making the transfer atomic compared to pre-signing a transaction. Making outpoint binding optional would be more useful than requiring it, so that users could choose to either sign for particular outputs or in a blanket way. The author of the post had originally assumed that outpoint binding could be achieved by checking the outpoint in the graft-script. However, it may be worth avoiding the overhead of expressing a match condition in the script, since this would add 36 bytes to the witness. Instead, people should use output binding grafts whenever reasonably possible.