The transaction fees in the example were off.
2-of-3 P2SH inputs are between 293 and 297 bytes (293 bytes if both
signatures have low-R, 296 bytes if one signature has high-R, 297 bytes
if both signatures have high-R) and P2SH outputs are 32 bytes.
2-of-3 P2WSH (native segwit) inputs are between 104 and 104.5 vbytes
(416–418 WU, depending on low-R/high-R as above) and P2WSH outputs are
43 bytes.
The transaction header has 10 bytes for non-segwit transactions and 42
WU for segwit transactions.
Source:
https://github.com/BitGo/unspents/blob/master/src/dimensions.ts#L69
I have updated the numbers in the example and amended the conclusion
which did not match the new numbers. Calculation details follow.
-----
Let's assume that the wallet is using signature grinding and will always
produce signatures with low-R:
•Without Segregated Witness:
Transaction A using 2-of-3 P2SH inputs and P2SH outputs:
3*293 + 10 + 2*32 = 953
953 * 30 = 28,590
Transaction B using 2-of-3 P2SH inputs and P2SH outputs:
2*293 + 10 + 3*32 = 692
692 * 30 = 20,760
•With Segregated Witness:
Transaction A using 2-of-3 P2WSH (native segwit) inputs and outputs:
3*104 + 10.5 + 2*43 = 408.5
408.5 * 30 = 12,255
Transaction B using 2-of-3 P2WSH (native segwit) inputs and P2WSH
outputs:
2*104 + 10.5 + 3*43 = 347.5
347.5 * 30 = 10,425
Changed "If it is above 500 million..." to "If it is greater than or equal to 500 million" to more accurately reflect the protocol spec.
See: https://en.bitcoin.it/wiki/Script#Locktime
The bullet point previously sounded as if the long script was only stored in the UTXO set when not using P2SH, and stored on the blockchain when using P2SH. This might lead to people thinking it might lead to a smaller blockchain when the script is stored in the UTXO set *instead* of on the blockchain. But without P2SH the long script was stored both in the UTXO set *and* on the blockchain. With P2SH it's only stored on the blockchain, which is a clear advantage over not using P2SH.
