Quote from: justusranvier on February 27, 2015, 06:19:25 AM

Quote from: DeathAndTaxes on February 18, 2015, 07:23:56 PM

Honestly I think new non-P2SH outputs should be made invalid at some point in the future not because of illegal activity but because if used for arbitrary data it bloats not just the blockchain but the far more critical UTXO set.

On the other hand, if those pubkeys are actually pubkeys and not arbitrary data, you can do Diffie-Hellman with them.
That's a useful property.

It's true but that data can be provided in a way thats optional-- aux data that may or may not come along with the blocks-- or even completely externally. It's not like you can expect to grab other people's random pubkeys and do things with them and have anything but doom come of it. ("What do you mean you didn't know, I sent you a message!" "No you didn't." "Yes I did, it was right here." "Thats not my house, thats the neighbors flower bed." "Yea, so? it was accessible to you! plus it was encrypted with your key!" "and thats not my key!" "Sure it is, I took this random key you used in 1997 and added four to it, you could have decoded that"...)

Quote

* I think the problem is more universally described as can a blockchain be constructed such that non-transaction data is limited only to outputs that can be pruned without affecting blockchain validation. I believe the answer is no. It can be made harder to accomplish but it can't be made impossible.

The answer is yes. In two ways: The easier but less useful way is to point out that Zero Knowledge proofs for general computation are known to be possible (and are verging on practical for non-trivial problems now). In theory I could give you a blockchain tip, a utxo set for it, and it's total work behind it, along with a ZK proof that the chain was completely valid, and that the utxo set agrees. This meets your criteria.

The other way depends exactly on what you mean by "blockchain validation". Basically, do you ever consider signatures prunable? e.g. when they're burried deep in the chain. We do know how to make txout scriptPubKeys "provable a hash". If signatures are pruned and all txouts are hashes then there are basically no non-trivial sidechannels left.