Is it time to reevaluate OP_EVAL ?

[Nicolas Dorier]

Now that redeem scripts can be arbitrary, I think OP_EVAL might find a new usage.

Imagine you create a redeem that can be proven by anybody knowing some secret OR owning a specific bitcoin address.

Script redeemScript = new Script(
    "OP_IF "
        + "OP_HASH256 " + Op.GetPushOp(secretHash) + " OP_EQUAL " +
    "OP_ELSE "
        + address.ScriptPubKey + " " +
    "OP_ENDIF");

Such script works fine if address is a P2PKH, however if address is a P2SH then the only condition to satisfy the ELSE branch is to know the redeem script of address.
This could be fixed with OP_EVAL by the following way. (assuming address is P2SH)

Script redeemScript = new Script(
    "OP_IF "
        + "OP_HASH256 " + Op.GetPushOp(secretHash) + " OP_EQUAL " +
    "OP_ELSE "
        "OP_DUP " + address.ScriptPubKey + " OP_EVAL" +
    "OP_ENDIF");

Sure, we could also use multi sig or public key ScriptPubKey directly in the ELSE branch, but they might not necessarily be known by the builder of the redeem script.

[1714647353]

1714647353

[1714647353]

1714647353

[1714647353]

1714647353

[edmundedgar]

Now that redeem scripts can be arbitrary, I think OP_EVAL might find a new usage.

Imagine you create a redeem that can be proven by anybody knowing some secret OR owning a specific bitcoin address.

Script redeemScript = new Script(
    "OP_IF "
        + "OP_HASH256 " + Op.GetPushOp(secretHash) + " OP_EQUAL " +
    "OP_ELSE "
        + address.ScriptPubKey + " " +
    "OP_ENDIF");

Such script works fine if address is a P2PKH, however if address is a P2SH then the only condition to satisfy the ELSE branch is to know the redeem script of address.
This could be fixed with OP_EVAL by the following way. (assuming address is P2SH)

Script redeemScript = new Script(
    "OP_IF "
        + "OP_HASH256 " + Op.GetPushOp(secretHash) + " OP_EQUAL " +
    "OP_ELSE "
        "OP_DUP " + address.ScriptPubKey + " OP_EVAL" +
    "OP_ENDIF");

Sure, we could also use multi sig or public key ScriptPubKey directly in the ELSE branch, but they might not necessarily be known by the builder of the redeem script.

You could of course put the content that would have been hashed directly into one of the branches of the OP_IF, rather than trying to do these recursive script hashes. Presumably one of the parties to the transaction knows what needs to go in there, because otherwise they won't be able to spend it.

That's what I do here for Reality Keys transactions (output spendable by Alice+Yes or Bob+No or Alice+Bob):
https://github.com/edmundedgar/bitcoin-branching-transaction-builder/

[Nicolas Dorier]

The only problem is that if you want to create a service that allows a user to customize on of the branch, then you need to ask him the a script, and not an address.
And there is no standard way to represent a script that is idiot proof for a user. (base58check)

If OP_EVAL is not added, then I think we will need soon a way to represent a script as a Base58Check data.