Quote from: FeedbackLoop on February 12, 2014, 09:59:01 AM

Quote from: hgmichna on February 12, 2014, 09:59:01 AM

Why not sign the entire transaction including the TXID?

Any random one? Even with thousands of inputs an attacker wouldn't be able to sign a mutated ID with any of the inputs.
Looking around I actually get the feeling that one of the reasons why this minor issue was left on the shelf was because there's so many different people with so many possible different solutions.

Adding any new requirement would "break" the protocol. Changing the behavior of signature production/requiring a new field in the transaction indicating which input signed the txid, would make all old wallet/miners/clients/exchange software unoperative.

It would require forking the chain, because the blockchain does not actually contain that info. (I guess though the whole transaction signature might be dropped when the transaction is included in the chain; but then it would be only an "voluntary" rule enforced by miner to NOT include a mutated transaction by a third party.)

Anyway, such "breaking" behavior is generally undesirable. The devs were trying to come up with a unique "canonical" way to construct a transaction such as there is only ONE way to make a given transaction, so that the resulting txid is unique too. A pool recieving a non-canonical transaction would mutate it before inclusion. Software requiring specific txid would make sure of producing a canonical transaction.

That way we would introduce a new desirable behavior, without breaking anything.

Quote from: FeedbackLoop on February 12, 2014, 09:59:01 AM

Looking around I actually get the feeling that one of the reasons why this minor issue was left on the shelf was because there's so many different people with so many possible different solutions.

In fact I feel it is EXACTLY that.

That, and that, any change cannot be made overnight. And requires a few month of developpement/testing/deployment before thinking of enforcing it. -> A very complicated process for a "non-bug", if people had read the specs and had not assumed txid were non-mutable.

(un)fortunately, the current crisis provides an opportunity to act much more quickly, because we already -do- have broken behavior, it can't get much worse. It can now be "spun" as a critical update that anybody must implement to continue to be able to use bitcoin.