Ordinal Number BIP Discussion

[casey]

Suggestions, feedback, criticism, and ideas for applications are all welcome.

[VzxPLnHqr]

This Ordinal Number concept is interesting for a variety of reasons. Thank you for writing it up.

Do you envision that software allowing for measurement/tracking of ordinals as they move through time would ultimately be included in widely used implementations such as bitcoin core? If so, there is a concern (and you have probably already thought about!):

1. If ordinals become widely adopted and, specifically, if they become the canonical way to "address" a satoshi
2. Then, it becomes possible to implement censoring soft-forks which basically blacklist certain ordinals via a block validation rule which essential says: "reject any block which moves ordinals a, b, c..."

Obviously such censorship is not what bitcoin is about.

Nevertheless, since it is impossible to prevent people from interpreting satoshis in this ordinal fashion, there are some very neat things that ordinals compactly enable. The example you gave of using a set of ordinals to create a rotating set of keys is one such interesting potential use-case.

I wonder whether it is worthwhile to investigate a notion of "secret ordinals."

As I understand it, the technique for initializing a set of ordinals hinges on creating a rule which is deterministic across time (across block boundaries) such that the ordinals can be tracked over time by interested observer/participants. Initializing a set of ordinals via "order in which they are mined" is one such way of initializing the set, but I wonder if we can come up with a family of such initialization techniques?

A not-so-secret way of creating as many sets of ordinals as there are UTXOs might be the following:

1. rather than creating a set of ordinals starting from the genesis block
2. follow the same rules from your proposal, but start it from an arbitrary UTXO
3. then only people who know/follow that UTXO would be able to "see" the set of ordinals which spawn from it

Of course, I do wonder whether the ordering you laid out will simply turn out to be the most canonical ordering since, by definition, it encompasses all existing satoshis whereas what I tried to describe above will only be a subset. So maybe everyone will converge on your ordering anyway.

I am not sure if any of this is making sense, but I hope it is helpful feedback for you?

[casey]

This Ordinal Number concept is interesting for a variety of reasons. Thank you for writing it up.

Thank you! You're most welcome.

Do you envision that software allowing for measurement/tracking of ordinals as they move through time would ultimately be included in widely used implementations such as bitcoin core?

I actually don't. I think that even if widely adopted, most users and applications won't use ordinals, and so only wallets and software that deals specifically with ordinals will track them. Since there isn't a consensus component to ordinals, and Bitcoin Core is conservative software that focuses on consensus and a payments wallet, I don't think it will get added to Core.

If so, there is a concern (and you have probably already thought about!):

1. If ordinals become widely adopted and, specifically, if they become the canonical way to "address" a satoshi
2. Then, it becomes possible to implement censoring soft-forks which basically blacklist certain ordinals via a block validation rule which essential says: "reject any block which moves ordinals a, b, c..."

I see the concern, although I think it's probably not a huge risk, for a couple of reasons:

• Blacklisting by address, or by relationship to other UTXOs (for example using the common-input-ownership heuristic is already possible.
• Blacklisting based on ordinals would be extremely ineffective, since you could, in a single very simple transaction, trade all your dirty ordinals for ordinals with no history, but still have the same number of sats.
• If people do blacklist specific ordinals, for example because there are valuable things (PKI roots, NFTs, etc) associated with those ordinals, then I'm not sure that it's a good argument against the ordinal scheme in isolation, since those valuable things were enabled by ordinals. It is good argument for an alternative, if one exists, that enables the same use-cases as the current scheme, but is private.

I wonder whether it is worthwhile to investigate a notion of "secret ordinals."

I've been thinking about this a lot too. I haven't been able to come up with a similarly simple and private scheme. I think one reason that the current ordinal scheme is simple is because the current bitcoin consensus rules do most of the work. They ensure that satoshis are neither created or destroyed in transactions, so all the scheme needs to do is come up with a numbering scheme and a transfer rule for satoshis. A scheme which doesn't rely on this would likely be much more complicated.

A not-so-secret way of creating as many sets of ordinals as there are UTXOs might be the following:

1. rather than creating a set of ordinals starting from the genesis block
2. follow the same rules from your proposal, but start it from an arbitrary UTXO
3. then only people who know/follow that UTXO would be able to "see" the set of ordinals which spawn from it

I've been thinking about this, but I've actually only been thinking of it as a performance optimization. In the current ordinal scheme, where ordinals are identified by number, finding out where an ordinal is, or which ordinal a particular satoshi in an output has, potentially requires following an arbitrary number of transactions back in time, back to when the satoshi was first mined.

If instead an ordinal could be declared to start from an arbitrary UTXO, you would only need to go back to that starting UTXO, and follow potentially far fewer transactions.

The way such an ordinal would be identified could be based on satpoints or slots, introduced in the BIP. For a satpoint, you would say "This ordinal starts with TXID:OUTPUT_OFFSET:SAT_OFFSET", where. For a slot, you would say "This ordinal starts with BLOCK_HEIGHT.TRANSACTION_INDEX.OUTPUT_INDEX.SAT_INDEX". Both identify the same thing, but one references a TXID, and one references a physical position. The latter is probably better, since you can create a new ordinal identity before a transaction is mined, whereas the latter is only valid after a transaction is mined, since you can't predict where a transaction will go in a block before it's mined.

However, I think this is a performance optimization only, and not a privacy improvement. Regardless of whether an ordinal is tracked from the genesis block, or from a specific transaction, an attacker will see the same pattern of transactions on-chain, so they won't get any more or less information in either case.

One way the scheme could be made more private is if you could select on a per-ordinal basis some random permutation to perform before assigning inputs to outputs. So, let's say you and I want to agree on some ordinal, we pick a shuffling function to use that we agree on. Then, an attacker would have to guess where an ordinal started in order to follow its progress, and they couldn't just build a database of all ordinals because they wouldn't know what shuffling schemes were used.

I think this is a good possible future extension for the scheme, but I think the current scheme is still valuable. It enables fun use cases like collection rare sats. Also, if each ordinal used a different shuffling scheme, trying to craft a transaction that moved multiple ordinals in a single UTXO would be hard, since they would be using different shuffling schemes and could potentially land on the same sat.

I am not sure if any of this is making sense, but I hope it is helpful feedback for you?

It all makes sense, and it's super helpful feedback! I've been thinking about this on my own and with a few friend for the last few months, and it's great to be able to talk through issues like this with more people.

[casey]

I made an issue for private ordinals: #167 I think the key is not just having the start be private, but having each private ordinal use an unguessable shuffling function.

[josediegorobles]

Hi, i think you are making an interesting proposal. Adding some kind of ids to every sat without any cost to the bitcoin timechain is a valuable proposal.
For now, i'm thinking on some things:

1. I think is not really necessary to have a number for every sat. For every one of the applications suggested, the user that start to use some controlled sat can use the satpoint at this moment txid:vout:relative_sat_position and there is no necessity to trace back the satoshi to the original coinbase and assign a number. So maybe this BIP can be reduced to propose the satpoint relative id for every sat and the norms for knowing for every transaction where is the new satpoint.
2. From the applications I like a lot and think is simple and valuable the identity thing. You can use a SatPoint controls by you as your identity in a server or publish for wathever application, like PGP public keys. You can change keys, transfer ownership with simple bitcoin transactions.
3. For NFTs i think we need something more. Problem i see is time, you can sign a NFT with wathever data and a satpoint and i can use the same data and my satpoint and claims mine is first. Here the single use seals of RGB or Taro cames handy... but it can be envisioned a supersimple protocol for NFTs, with only a single use seal that is attach to a spending utxo and commited to a satpoint ---> from this point it's the satpoint who "decides" ownership, not necessary more single use seals, nor save the data (only for fast proofs, but if you lost the data, you only need the private key over the present UTXO of the sat and the original contract)
4. The satpoint issue can be incorporated to RGB or Taro protocols: if you commited to a satpoint instead of a utxo then the transfers are automatic with the ordinal satpoints rules, no necessity to save new proofs, can be useful to save data or some applications here.

[casey]

1. This is good feedback, and I've been thinking it myself. I like numbering every satoshi for aesthetic reasons. People get excited about it when I explain it, and it enables the collection of rare sats, which I hoped might become popular in and of itself. However, the index required is huge, and for the NFT use-case it makes tracing the history much longer. I think I should create a new BIP with a different name which focuses on sat points and doesn't mention ordinal numbers at all.

2. Definitely, it's a great use-case.

3. Good point, and this is something I've thought a little about too. I think that this might actually not be a problem in practice. Let's say that I went and copied all the BAYC art and minted a new NFT set, CAYC (Casey Ape Yacht Club) with it. Nobody would confuse my new NFT with the original. Now, they could look on chain and see that the BAYC was minted before CAYC, but in practice, I don't think they actually would. Given that, I'm not sure it's worth adding additional complexity in the form of a taproot commitment to solve. What do you think?

4. That's an interesting idea!

[casey]

A simpler way to solve 3. would be to include a timestamp in the NFT metadata, for example one from opentimestamps.org