BIP118 `ANYSCRIPT` signatures shouldn't commit the `codesep_pos`

[darosior]

BIP118 states:

• Extension:
  • If ''hash_type & 0xc0'' is not SIGHASH_ANYPREVOUTANYSCRIPT:
    • ''tapleaf_hash'' (32): the tapleaf hash as defined in BIP 341
  • ''key_version'' (1): a constant value ''0x01'' representing that this is a signature for a BIP 118 public key.
  • ''codesep_pos'' (4): the opcode position of the last executed OP_CODESEPARATOR before the currently executed signature opcode, with the value in little endian (or ''0xffffffff'' if none executed). The first opcode in a script has a position of 0. A multi-byte push opcode is counted as one opcode, regardless of the size of data being pushed.

However the "codesep_pos" is itself a weak commitment to the Script spent. I think "codesep_pos" should not be committed if the hash type is SIGHASH_ANYPREVOUTANYSCRIPT?

[ajtowns]

I think if you have a script like <P> CHECKSIGVERIFY CODESEP <P> CHECKSIG it would be pretty surprising for the same signature to satisfy both checksigs, given the only purpose CODESEPARATOR has is to require distinct signatures.

That feature's potentially useful if you have a script like IF <n> CLTV DROP CODESEP ENDIF <P> CHECKSIG -- in that case a signature for the CLTV path won't satisfy the non-CLTV path, and re-using the same pubkey saves bytes compared to using a different pubkey via either an ELSE clause or an alternative tapleaf.

[darosior]

Sure, but that feature is already available through the regular APO. I find it surprising that when you opt into signing for any script, it would in fact be valid for most but not any script.