MIME-Version: 1.0
In-Reply-To: <C9A47922-5777-44AC-871A-6C27A22054AC@blockchain.com>
References: <7601C2CD-8544-4501-80CE-CAEB402A72D2@blockchain.com>
	<CAAUaCyii2U5VBLS+Va+F3h4Hka0OWDnFFmjtsvyaaD4TKVzV3Q@mail.gmail.com>
	<CAAUaCyiZ0bmWZLZc-yDvVHupzbdRR=Kdq4P8VkWqpU1L3G-u3A@mail.gmail.com>
	<C9A47922-5777-44AC-871A-6C27A22054AC@blockchain.com>
From: Jacob Eliosoff <jacob.eliosoff@gmail.com>
Date: Thu, 9 Nov 2017 15:45:43 -0500
Message-ID: <CAAUaCyjVxJbPrbBUdb9irK5CNnuqUSnzSjywpozhLqONcb_m_w@mail.gmail.com>
To: Mats Jerratsch <mats@blockchain.com>
Content-Type: multipart/alternative; boundary="94eb2c184b14652b42055d92e3e8"
Cc: Bitcoin Dev <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Generalised Replay Protection for Future Hard
	Forks
Precedence: list

--94eb2c184b14652b42055d92e3e8
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

OK, I see.  On the whole this is the best replay protection solution I've
seen.  In particular, I hope developers of Bech32 and other new address
formats will take a close look at incorporating a fork ID this way.

As I understand you, a private key in cold storage would (of course) remain
valid across HFs, but an *address* would be valid only for the nForkId it
was generated for.  There may be cold-storage-type cases where it's
important for an address to be valid across all chains, ie, to
intentionally allow replay?  But I guess this could just be a special
nForkId value, say -1?


On Nov 8, 2017 9:45 AM, "Mats Jerratsch" <mats@blockchain.com> wrote:

> Hey Jacob!
>
> > Take the specific and common case of non-upgraded wallet software.
> Suppose a HF happens, and becomes the network used by 90% of users.  Will
> old wallets still default to the old nForkId (10% legacy chain)?  If so,
> I'd expect a lot of accidental mis-sends on that chain.
>
> With this proposal implemented, a 'mis-send' is fundamentally impossible.
> The address contains the identifier of the token that should be sent.
>
> If anything, it's possible to 'mis-receive'.
> That is, the receiving wallet was not aware of a newer chain, and the
> receiver actually wanted to receive the newer token, but instead his wall=
et
> created an address for the old token. It is the responsibility of the
> receiver to write a correct invoice. This is the case everywhere else in
> the world too, so this seems like a reasonable trade-off.
>
> I would even argue that this should hold in a legal case, where the
> receiver cannot claim that he was expecting a payment in another token
> (contrary to how it is today, like when users send BTC to a BCH address,
> losing their funds with potentially no legal right for reimbursement). If=
 I
> sent someone an invoice over 100=E2=82=AC, I cannot later proclaim that I=
 actually
> expected $100.
>
> With this proposal, wallets are finally able to distinguish between
> different tokens. With this ability, I expect to see different
> implementations, some wallets which advertise staying conservative,
> following a strict ruleset, and other wallets being more experimental,
> following hashing rate or other metrics.
>
>

--94eb2c184b14652b42055d92e3e8
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto">OK, I see.=C2=A0=C2=A0<span style=3D"font-family:sans-ser=
if">On the whole this is the best replay protection solution I&#39;ve seen.=
=C2=A0 In particular, I hope developers of Bech32 and other new address for=
mats will take a close look at incorporating a fork ID this way.</span><div=
 dir=3D"auto"><font face=3D"sans-serif"><br></font><div dir=3D"auto">As I u=
nderstand you, a private key in cold storage would (of course) remain valid=
 across HFs, but an <i>address</i> would be valid only for the nForkId it w=
as generated for.=C2=A0 There may be cold-storage-type cases where it&#39;s=
 important for an address to be valid across all chains, ie, to intentional=
ly allow replay?=C2=A0 But I guess this could just be a special nForkId val=
ue, say -1?<div dir=3D"auto"><div dir=3D"auto"><br></div></div></div></div>=
</div><div class=3D"gmail_extra"><br><div class=3D"gmail_quote">On Nov 8, 2=
017 9:45 AM, &quot;Mats Jerratsch&quot; &lt;<a href=3D"mailto:mats@blockcha=
in.com">mats@blockchain.com</a>&gt; wrote:<br type=3D"attribution"><blockqu=
ote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc s=
olid;padding-left:1ex">Hey Jacob!<br>
<br>
&gt; Take the specific and common case of non-upgraded wallet software.=C2=
=A0 Suppose a HF happens, and becomes the network used by 90% of users.=C2=
=A0 Will old wallets still default to the old nForkId (10% legacy chain)?=
=C2=A0 If so, I&#39;d expect a lot of accidental mis-sends on that chain.<b=
r>
<br>
With this proposal implemented, a &#39;mis-send&#39; is fundamentally impos=
sible. The address contains the identifier of the token that should be sent=
.<br>
<br>
If anything, it&#39;s possible to &#39;mis-receive&#39;.<br>
That is, the receiving wallet was not aware of a newer chain, and the recei=
ver actually wanted to receive the newer token, but instead his wallet crea=
ted an address for the old token. It is the responsibility of the receiver =
to write a correct invoice. This is the case everywhere else in the world t=
oo, so this seems like a reasonable trade-off.<br>
<br>
I would even argue that this should hold in a legal case, where the receive=
r cannot claim that he was expecting a payment in another token (contrary t=
o how it is today, like when users send BTC to a BCH address, losing their =
funds with potentially no legal right for reimbursement). If I sent someone=
 an invoice over 100=E2=82=AC, I cannot later proclaim that I actually expe=
cted $100.<br>
<br>
With this proposal, wallets are finally able to distinguish between differe=
nt tokens. With this ability, I expect to see different implementations, so=
me wallets which advertise staying conservative, following a strict ruleset=
, and other wallets being more experimental, following hashing rate or othe=
r metrics.<br>
<br>
</blockquote></div></div>

--94eb2c184b14652b42055d92e3e8--