中本聪致迈克·赫恩：用于时间锁定存款的多重签名合约模式（2011 年 4 月 20 日）
首次公开证据
打开首次公开证据如果脚本语言不是无状态的，如果它能够访问任何会发生变化或在节点之间存在差异的外部信息，攻击者就可以利用它让链发生分叉。唯一的例外是，它在某个时间之前始终为假、之后永久为真，而这已通过 nLockTime 实现。
既然 Google 是可信的，用户能否向 Google 支付一笔象征性的押金，然后由 Google 在他们关闭账户时退还？
不过，回答你的问题：是的，不借助信任也能做到：
来自用户的交易 1 支付给一个脚本，该脚本要求同时提供 Google 和用户的签名才能花费。
交易 2（合约）花费交易 1，并将钱支付给用户。nLockTime 是释放这笔钱的时间。
步骤：
- Google 给用户一个公钥，用来创建交易 1。
- 用户私下创建交易 1，暂时不广播。
- 用户把交易 1 的哈希交给 Google。
- Google 签署自己在交易 2 中的部分，设置 nLockTime，然后把它交给用户。
- 用户广播交易 1。
- 用户签署自己在交易 2 中的一半，然后广播它。
按照这些步骤，用户在广播交易 1 之前，就已经拿到了 Google 对交易 2 所签的一半，因此他可以确信自己签字投入这笔钱所换取的条件是什么。
这是安全签署合约的一般模式。先准备交易 2，让各方知道自己把钱付进了什么。广播交易 1 是为了锁定资金，并将其分配给交易 2。换句话说，各方都把自己的钱交给一个由全体一致同意控制的资金池，但在此之前，各方已经签署协议，同意对这笔钱采取默认操作；或者对多个可用选项进行了部分签署，任意一方都可以通过添加最后一个签名来完成其中一个选项。
经共同同意，各方随时都可以写出交易 2 的另一个版本，立即释放资金。
英文原文
展开英文原文
If the script language is not stateless, if it has access to any outside information that changes or varies between nodes, attackers can use it to fork the chain. The only exception is if it is always false before a certain time and permanently true after, which is implemented with nLockTime.
Since Google is trusted, couldn't users pay a token deposit to Google and Google pays them back when they close the account?
To answer your question though, yes it can be done without using trust:
Tx 1 from User pays to a script that requires the signature of both Google and User to spend.
Tx 2 (the contract) spends Tx 1 and pays it to User. nLockTime is the time to release the money.
Steps:
- Google gives User a pubkey to use in creating Tx 1.
- User privately creates Tx 1, does not broadcast it yet.
- User gives the hash of Tx 1 to Google.
- Google signs its part of Tx 2, with nLockTime set, and gives it to User.
- User broadcasts Tx 1.
- User signs his half of Tx 2 and broadcasts it.
With these steps, the user already has Google's signed half of Tx 2 in hand before he broadcasts Tx 1, so he is assured of what bargain he is signing the money to.
This is the general pattern for safely signing contracts. Tx 2 is prepared first so the parties know what they're paying into. Tx 1 is broadcast to lock up the money and assign it to Tx 2. In other words, all parties assign their money to a pool that is controlled by the unanimous agreement of the group, but first the group has already signed agreement for the default action to take with the money, or partially signed multiple available options that a party can complete by adding the last signature.
By mutual agreement, the parties can always write another version of Tx 2 that releases the money immediately.