MIME-Version: 1.0
References: <CAPv7TjbOcH2mte8SWALc2o5aEKLO7qoZ-M_e1wHdGSp6EmMc2Q@mail.gmail.com>
 <9f399e0c2713f2b1d2534cd754356bb5@dtrt.org>
In-Reply-To: <9f399e0c2713f2b1d2534cd754356bb5@dtrt.org>
From: Ruben Somsen <rsomsen@gmail.com>
Date: Tue, 4 Oct 2022 01:01:06 +0200
Message-ID: <CAPv7TjY=35H2rmCxBavLwe3+8A9osao0QAMF_grb6WFA502b5Q@mail.gmail.com>
To: "David A. Harding" <dave@dtrt.org>
Content-Type: multipart/alternative; boundary="00000000000027510305ea2952b9"
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev]
	=?utf-8?q?Trustless_Address_Server_=E2=80=93_Outsou?=
	=?utf-8?q?rcing_handing_out_addresses_to_prevent_address_reuse?=
Precedence: list

--00000000000027510305ea2952b9
Content-Type: text/plain; charset="UTF-8"

Hi David,

Thanks for the excellent suggestion, that makes the protocol much more
elegant and actually increases my optimism about its practicality. Also,
interesting observation that there is overlap with BIP78. From the
perspective of the recipient it does mean there's a potential privacy
reduction when a placeholder transaction goes through (these should perhaps
be marked in the wallet?), but I suppose this is still better than no
payment at all. I also like your point that it doubles as a way to
potentially bridge gaps.

Cheers,
Ruben


On Mon, Oct 3, 2022 at 12:48 AM David A. Harding <dave@dtrt.org> wrote:

> On 2022-09-29 05:39, Ruben Somsen via bitcoin-dev wrote:
> > An alternative mitigation (more user friendly, but more implementation
> > complexity) would be to require the sender to reveal their intended
> > transaction to the server prior to receiving the address[^9]. This is
> > not a privacy degradation, since the server could already learn this
> > information regardless. If the transaction doesn't end up getting
> > sent, any subsequent attempt to reuse one of the inputs should either
> > be (temporarily) blacklisted or responded to with the same address
> > that was given out earlier
> > [...]
> > [^9]: *This would essentially look like an incomplete but signed
> > transaction where the output address is still missing.*
>
> Hi Ruben,
>
> Instead of maintaining a database of inputs that should be blocked or
> mapped to addresses, have the spender submit to you (but not the
> network) a valid transaction paying a placeholder address and in return
> give them a guaranteed unique address.  They can then broadcast a
> transaction using the same inputs to pay the guaranteed unique address.
> If you don't see that transaction within a reasonable amount of time,
> broadcast the transaction paying the placeholder address.  This makes it
> cost the same to them whether they use the unique address or not.  By
> placeholder address, I mean an address of yours that's never received a
> payment but which may have been provided in a previous invoice (e.g. to
> prevent exceeding the gap limit).
>
> In short, what I think I've described is the BIP78 payjoin protocol
> without any payjoining going on (which is allowed by BIP78).  BTCPay
> already implements BIP78, as do several wallets, and I think it
> satisfies all the design constraints you've described.
>
> -Dave
>

--00000000000027510305ea2952b9
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi David,<div><br></div><div>Thanks for the excellent sugg=
estion, that makes the=C2=A0protocol much more elegant and actually increas=
es my optimism=C2=A0about its practicality. Also, interesting observation t=
hat there is overlap with BIP78. From the perspective of the recipient it d=
oes mean there&#39;s a potential privacy reduction when a placeholder trans=
action goes through (these should perhaps be marked in the wallet?), but I =
suppose this is still better than no payment at all. I also like your point=
 that it doubles=C2=A0as a way to potentially bridge gaps.</div><div><br></=
div><div>Cheers,</div><div>Ruben</div><div><br></div><div><br></div><div><b=
r></div><div><br></div><div><br></div><div><br></div></div><br><div class=
=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Mon, Oct 3, 2022 =
at 12:48 AM David A. Harding &lt;<a href=3D"mailto:dave@dtrt.org" target=3D=
"_blank">dave@dtrt.org</a>&gt; wrote:<br></div><blockquote class=3D"gmail_q=
uote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,2=
04);padding-left:1ex">On 2022-09-29 05:39, Ruben Somsen via bitcoin-dev wro=
te:<br>
&gt; An alternative mitigation (more user friendly, but more implementation=
<br>
&gt; complexity) would be to require the sender to reveal their intended<br=
>
&gt; transaction to the server prior to receiving the address[^9]. This is<=
br>
&gt; not a privacy degradation, since the server could already learn this<b=
r>
&gt; information regardless. If the transaction doesn&#39;t end up getting<=
br>
&gt; sent, any subsequent attempt to reuse one of the inputs should either<=
br>
&gt; be (temporarily) blacklisted or responded to with the same address<br>
&gt; that was given out earlier<br>
&gt; [...]<br>
&gt; [^9]: *This would essentially look like an incomplete but signed<br>
&gt; transaction where the output address is still missing.*<br>
<br>
Hi Ruben,<br>
<br>
Instead of maintaining a database of inputs that should be blocked or <br>
mapped to addresses, have the spender submit to you (but not the <br>
network) a valid transaction paying a placeholder address and in return <br=
>
give them a guaranteed unique address.=C2=A0 They can then broadcast a <br>
transaction using the same inputs to pay the guaranteed unique address.=C2=
=A0 <br>
If you don&#39;t see that transaction within a reasonable amount of time, <=
br>
broadcast the transaction paying the placeholder address.=C2=A0 This makes =
it <br>
cost the same to them whether they use the unique address or not.=C2=A0 By =
<br>
placeholder address, I mean an address of yours that&#39;s never received a=
 <br>
payment but which may have been provided in a previous invoice (e.g. to <br=
>
prevent exceeding the gap limit).<br>
<br>
In short, what I think I&#39;ve described is the BIP78 payjoin protocol <br=
>
without any payjoining going on (which is allowed by BIP78).=C2=A0 BTCPay <=
br>
already implements BIP78, as do several wallets, and I think it <br>
satisfies all the design constraints you&#39;ve described.<br>
<br>
-Dave<br>
</blockquote></div>

--00000000000027510305ea2952b9--