For discussion: limit transaction size to mitigate CVE-2013-2292



Summary:

The email conversation between Gregory Maxwell and Gavin Andresen discusses the implementation of a limit on the maximum size of a transaction in a block to mitigate potential CPU exhaustion denial-of-service attacks. However, Maxwell argues that this approach is indirect as it fails to address the N^2 costs related to repeated hashing in checksig. Andresen acknowledges this but notes that counting signature operations is not as trivial as checking transaction size. He suggests that a limit on sigops is the right way to go and that accurately counting the number of sigops required to validate a transaction should also be implemented. Andresen adds that he would hate to impose a 100,000 byte transaction size limit, which could be challenging to move away from in the future.


Updated on: 2023-06-10T03:02:41.276821+00:00