2
BIP-141 defines a witness reserved value as part of a flexible commitment structure:
Double-SHA256(witness root hash|witness reserved value)
The purpose is to support commitments (i.e., data associated with a block) beyond the witness root hash. That part makes sense, but it seems like the value of witness reserved value should be defined in BIP-141. For example, should it be omitted altogether when hashing the witness root hash? Should it be set to 0x00? Some other value?
When creating a coinbase Null Data output, what value does the miner use for "witness reserved value" given that a hash for (witness root hash|witness reserved value) is required? – Rich Apodaca – 2017-06-11T18:49:24.183
Any value at all is allowed. – Pieter Wuille – 2017-06-11T18:53:10.827
It seems that a node must know the witness reserved value used by a miner in order to properly validate the commitment in the coinbase output. The commitment is defined in terms of the double SHA-256 of (witness root hash|witness reserved value). In other words, the commitment in the coinbase output depends on the value of witness reserved value chosen by the miner. Yet this value doesn't appear anywhere explicitly. I'm missing something, but what is it? – Rich Apodaca – 2017-06-11T21:41:29.500
The value is included in the coinbase witness, so every validating node knows it. It can be any 32-byte value, though. – Pieter Wuille – 2017-06-11T22:43:48.293
Thanks - I think I found it: "the coinbase's input's witness must consist of a single 32-byte array for the witness reserved value." In other words, the value of "witness reserved value" is found in the coinbase transaction's witness. A coinbase transaction has only one input, so its only witness field contains the "witness reserved value" as its only item. Right? – Rich Apodaca – 2017-06-12T00:02:32.220