Segwit commitment to post-quantum witness data?

As you might imagine, the exact same question came up around the 2015-2017 segregated witness proposal. You can probably find records of discussions then.

The main reason is that block hashes, and PoW, are no longer committing to all data that is relevant for validation. Blocks, in the worst case, are pretty expensive to validate, and the latency in doing so is critical for block validation purposes. Thankfully, it is also very expensive to create a block (~10 minutes worth of global PoW), which is an extremely effective rate limiter on the creation of invalid blocks, and simultaneously a strong economic incentive not to create them. However, this only works because PoW commits to the witness data. Without it, any relay node can create infinitely many invalid versions of a valid (or inherently invalid) block, at basically zero cost, and verification logic cannot cache the result; it needs to check each and every one. Unlike for individual transactions, nodes do not have the option of dropping too-expensive blocks; they must accept them if they are valid.

Practically speaking, it means block validation failures wouldn’t be cacheable anymore, because a block’s identity (its hash) would just commit to its effects, not whether it is valid.

Another reason which may not apply as strongly in this specific case is auditability: if someone steals coins from a 2-of-3 multisig e.g. you may want the ability to see which signers did that. That’s especially relevant for OP_CHECKMULTISIG where the signature themselves choose the subset. That opcode doesn’t exist anymore in BIP-342 Tapscript, and could easily be avoided for future script proposals.

In the context of block-wide SNARK proofs, I think this means you want solutions that either:

  • Have the proof be part of the consensus rules, i.e., have the block commit to the SNARK proof, and have block validity defined in terms of that.
  • Have an “after the fact” proof that some nodes may accept, sort of like utreexo, which falls outside of the consensus rules. It would just need to make sure that it proves “a specific pqdata exists, which matches the commitments in the revealed data, that combined with the revealed non-pqdata, pass validity rules.”.