Received-SPF: pass (sog-mx-3.v43.ch3.sourceforge.com: domain of gmail.com
	designates 209.85.210.175 as permitted sender)
	client-ip=209.85.210.175; envelope-from=gmaxwell@gmail.com;
	helo=mail-ia0-f175.google.com; 
MIME-Version: 1.0
In-Reply-To: <CAErK2CgWFarfs1WhGHs2L0b6ZuqCMhu72+dLNj0EZ1vN8=Au=g@mail.gmail.com>
References: <CAErK2CgWFarfs1WhGHs2L0b6ZuqCMhu72+dLNj0EZ1vN8=Au=g@mail.gmail.com>
Date: Tue, 4 Dec 2012 22:23:37 -0500
Message-ID: <CAAS2fgQxQEAtspRQixU7KAqhcXYnev=20-hbDpMCO9nTEKT+RQ@mail.gmail.com>
From: Gregory Maxwell <gmaxwell@gmail.com>
To: Mike Koss <mike@coinlab.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Cc: "bitcoin-development@lists.sourceforge.net"
	<bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] String-based Hierarchical Deterministic
 Keys - Alternative to BIP 32
Precedence: list

On Tue, Dec 4, 2012 at 10:06 PM, Mike Koss <mike@coinlab.com> wrote:
> I've implemented an alternative to the BIP 32 proposal.  I wanted a syste=
m
> based on a hierarchical string representation (rather than hierarchy of
> integers as BIP 32 proposes).  For example I name keys like this:
>
> [hd1.75491111].store.1. 1D7GM5dkUtxvGeWgn7SYtanBuyj1MD1EZy
> [hd1.75491111].store.2. 1QAqDbzpNKViGSjVe1XmnGbmZtvz5hM7t1
> [hd1.75491111].store.3. 14XkSN92QLGeorYPpoVbG87DQhowEx3mFn
> [hd1.75491111].store.4. 1JLcGdod6Wm33rMZuZZUmAEE6osLhM4QMn
>
> First draft of proposal:
>
> https://gist.github.com/4211704

As Pieter pointed out recently=E2=80=94 it's not (realistically) possible t=
o
blindly iterate through strings.  This means your proposal loses the
backup recoverablity property which is part the point of a
deterministic wallet:  If you have a backup prior to a new string name
being established you must also have a reliable backup of the string
as well.

Of course, if you're backing up the strings then you can also backup a
map equating the hdwallet indexes to your strings, and in the event of
a catastrophic loss where you are only left with the original ultimate
root you lose no coins (only metadata) with the BIP32 scheme. If,
instead, we have your scheme and the backup of strings is incomplete
then some or all assigned coin may be lost forever.

Your extended hierarchy of multiplers also makes me uncomfortable.
BIP32 uses a HMAC in its construction to obtain strongly unstructured
points.