You cannot reuse a plain P2WPKH signer
Yes, but Bitcoin Core signer is close enough to be used. For example:
createrawtransaction '[{"txid":"0b4b0db2652cb346205e685a2b1494188950523ed49cc54beae479afd7831d43","vout":0,"sequence":300}]' '[{"tb1qw508d6qejxtdg4y5r3zarvary0c5xw7kxpjzsx":0.00049880}]' 0 true
0200000001431d83d7af79e4ea4bc59cd43e5250891894142b5a685e2046b32c65b20d4b0b00000000002c01000001d8c2000000000000160014751e76e8199196d454941c45d1b3a323f1433bd600000000
signrawtransactionwithkey "0200000001431d83d7af79e4ea4bc59cd43e5250891894142b5a685e2046b32c65b20d4b0b00000000002c01000001d8c2000000000000160014751e76e8199196d454941c45d1b3a323f1433bd600000000" '[" cMahea7zqjxrtgAbB7LSGbcQUr1uX1ojuat9jZodMN87JcbXMTcA"]' '[{"txid":"0b4b0db2652cb346205e685a2b1494188950523ed49cc54beae479afd7831d43","vout":0,"scriptPubKey":"0014751e76e8199196d454941c45d1b3a323f1433bd6","amount":0.00050000}]' "SINGLE|ANYONECANPAY"
{
"hex": "02000000000101431d83d7af79e4ea4bc59cd43e5250891894142b5a685e2046b32c65b20d4b0b00000000002c01000001d8c2000000000000160014751e76e8199196d454941c45d1b3a323f1433bd602473044022057bd466515b398e3643bd290492e9af1e0a004e58017b7302e0a80b5ff186f0c02205aa84d9468e49c1128ece23dd5474883762e83663c53fa382575585b59dfeb7883210279be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f8179800000000",
"complete": true
}
And then, we can split it into parts:
txBegin=02000000000101431d83d7af79e4ea4bc59cd43e5250891894142b5a685e2046b32c65b20d4b0b00000000002c01000001d8c2000000000000160014751e76e8199196d454941c45d1b3a323f1433bd6
witnessSize=02
witnessData=473044022057bd466515b398e3643bd290492e9af1e0a004e58017b7302e0a80b5ff186f0c02205aa84d9468e49c1128ece23dd5474883762e83663c53fa382575585b59dfeb7883210279be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798
locktime=00000000
Then, between "witnessData" and "locktime", we have to put our Script, and increase "witnessSize" into "03":
decoderawtransaction 02000000000101431d83d7af79e4ea4bc59cd43e5250891894142b5a685e2046b32c65b20d4b0b00000000002c01000001d8c2000000000000160014751e76e8199196d454941c45d1b3a323f1433bd603473044022057bd466515b398e3643bd290492e9af1e0a004e58017b7302e0a80b5ff186f0c02205aa84d9468e49c1128ece23dd5474883762e83663c53fa382575585b59dfeb7883210279be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798237c8276937693b2757cab76a914751e76e8199196d454941c45d1b3a323f1433bd688ac00000000
{
"txid": "2f118ad613dc03defab7ec6078164357d37e1cfde64883d78de0dd11de9f962a",
"hash": "1ef40752821f960e5b118394ea10669aa560d28c5fd53a34992cd9684d4b9bb8",
"version": 2,
"size": 227,
"vsize": 119,
"weight": 473,
"locktime": 0,
"vin": [
{
"txid": "0b4b0db2652cb346205e685a2b1494188950523ed49cc54beae479afd7831d43",
"vout": 0,
"scriptSig": {
"asm": "",
"hex": ""
},
"txinwitness": [
"3044022057bd466515b398e3643bd290492e9af1e0a004e58017b7302e0a80b5ff186f0c02205aa84d9468e49c1128ece23dd5474883762e83663c53fa382575585b59dfeb7883",
"0279be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798",
"7c8276937693b2757cab76a914751e76e8199196d454941c45d1b3a323f1433bd688ac"
],
"sequence": 300
}
],
"vout": [
{
"value": 0.00049880,
"n": 0,
"scriptPubKey": {
"asm": "0 751e76e8199196d454941c45d1b3a323f1433bd6",
"desc": "addr(tb1qw508d6qejxtdg4y5r3zarvary0c5xw7kxpjzsx)#0wnhlaqf",
"hex": "0014751e76e8199196d454941c45d1b3a323f1433bd6",
"address": "tb1qw508d6qejxtdg4y5r3zarvary0c5xw7kxpjzsx",
"type": "witness_v0_keyhash"
}
}
]
}
So, maybe it is not 1:1 replacement, but it is close enough, to sign something directly from Bitcoin Core, tweak it here and there, and then broadcast. Which means, that potential code changes are minimal, to reach any valid signature. And then, it is all about grinding it further, to beat any attackers. And that grinding is exactly in Hourglass's spirit: in that proposal, miners also could steal coins, but their ability to do that was limited by consensus rules, just like it is here (so, that kind of models can be tested, before any soft-fork will be deployed).
If ECDSA or SHA-256 is broken, an attacker who knows the key can deliberately craft tiny DER (eg 912 bytes) and get the shortest delay.
Crafting 9-12 bytes signature will be extremely hard in practice. If SHA-256 will be broken, then yes, 9-byte signatures will be possible, but then, the whole chain can be overwritten with anything. However, if secp256k1 will be broken, then r-value will have one byte, but grinding s-value will still require gradually breaking SHA-256. Which means, that different miners will still have to compete, and grind smaller and smaller signatures, to get the coins earlier, than the rest. And it still means starting from something like 40-byte signature, so something like 160 block timelock.
That is a race, not a safety net.
Original Hourglass is also a race.
Thirty-six blocks is not much of a rescue window against a motivated sweeper.
People can repeat "OP_DUP OP_ADD" as many times, as they want, or add some constant, to make that window bigger.
ensure you set the type bits for blocks vs time correctly
Type flag is bit number 22. It means 0x00400000, so at least 1 MB signature. It is very hard to achieve that in P2WSH, where you have 520 byte stack size limit. Which means, that you can get something like 2080 block timelock in case of the biggest signature. Which also means, that if you use 2048 as your factor (around two weeks per byte), then it will still be 520*2048=1064960 blocks of delay. Still not enough to reach 4194304, and every value below that is just a timelock, measured in the number of blocks. Also, opcodes like OP_LESSTHAN or OP_WITHIN can restrict things further, if users need it.
Because it is P2WSH with custom logic, ordinary wallets cannot send or spend without special tooling.
They can get quite close with existing tools, so potential changes are quite small (it is all about adding witness stack push with the Script, and also grinding the signature with Proof of Work).
Calling it P2WPKH-compatible might confuse users.
Maybe. But it is as close to be compatible, as it could be. If things are separated with OP_CODESEPARATOR, then z-value can be computed by existing wallets, so that users don't have to fight with Segwit format, and they can focus on getting from Bitcoin Core, what they can, and then improve it a little with any external tools.
