Received-SPF: pass (sog-mx-4.v43.ch3.sourceforge.com: domain of taplink.co
	designates 50.117.27.232 as permitted sender)
	client-ip=50.117.27.232; envelope-from=jeremy@taplink.co;
	helo=mail.taplink.co; 
Content-Type: text/plain; charset=iso-8859-15; format=flowed; delsp=yes
To: "Gregory Maxwell" <gmaxwell@gmail.com>
References: <CABsx9T2G=yqSUGr0+Ju5-z9P++uS20AwLC+c3DnFMHtcQjQK6w@mail.gmail.com>
	<CAAS2fgTz0TaGhym_35V3N2-vHVzU9BeuV8q+QJjwh5bg77FEZg@mail.gmail.com>
	<CANEZrP0huBWqgvQik9Yc26Tu4CwR0VSXcfC+qfzsZqvoU4VJGA@mail.gmail.com>
	<20140113133746.GI38964@giles.gnomon.org.uk>
	<CANEZrP1KAVhi_-cxCYe0rR9LUSYJ8MyW8=6eSJZ65FeY5ZJNuQ@mail.gmail.com>
	<20140114225321.GT38964@giles.gnomon.org.uk>
	<CANAnSg0tH_bK_19rsRRHOeZgrGYeWMhW89fXPyS4DQGmS4r_7A@mail.gmail.com>
	<CALimQCXgc0eXeOcqFGUaCpSF7gKEe87KzvLqHZwUysV3WyjjGw@mail.gmail.com>
	<CAAS2fgShChAQryfUOBp60jB-zxn2tH986fu1HfT+LsNdBYnoYg@mail.gmail.com>
	<CAJHLa0P5r2+kxy7w8G=h=TAhdk1jUoW5UOiv-euo47uQY0u9ZA@mail.gmail.com>
	<20140115230901.GA25135@netbook.cypherspace.org>
	<op.w9q85wkhyldrnw@laptop-air.hsd1.ca.comcast.net>
	<CAAS2fgTRKgkO15VUvVgttP-iEBNF4=G+++Xo-XsaRBmOxyXXKA@mail.gmail.com>
Date: Mon, 20 Jan 2014 20:00:05 -0800
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: "Jeremy Spilman" <jeremy@taplink.co>
Organization: TapLink
Message-ID: <op.w90qqfh4yldrnw@laptop-air>
In-Reply-To: <CAAS2fgTRKgkO15VUvVgttP-iEBNF4=G+++Xo-XsaRBmOxyXXKA@mail.gmail.com>
User-Agent: Opera Mail/1.0 (Win32)
oclient: 192.168.168.135#jeremy@taplink.co#465
Cc: "bitcoin-development@lists.sourceforge.net"
	<bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] unlinakble static address? & spv-privacy
 (Re: Stealth Addresses)
Precedence: list

On Wed, 15 Jan 2014 17:32:31 -0800, Gregory Maxwell <gmaxwell@gmail.com>  
wrote:
> I'd point out that regardless of how long the desired prefix is, the
> encoded prefix should probably always be constant length in all
> reusable addresses.

I might be misunderstanding, but I think prefix length must be specified  
in the reusable address, however I agree the prefix actually published to  
the blockchain should be constant length.

> If you don't want a particular prefix then the
> sender should just pick random data for the rest of the space. There
> is no need to publish any additional distinguishing data in the form
> of how long the prefix is.

Let's say the payee's reusable address is '<version> <prefix> <Q1> <Q2>  
...', where <prefix> is 2 bytes. Without any length indicator. What's the  
payer going to put on the blockchain? How would they know what the 'rest  
of the space' is? They would have to put the whole <prefix> verbatim into  
the OP_RETURN without knowing how many bits of <prefix> the payee actually  
wants to see there.

If instead, the address is '<version> <prefix> <prefixLen> <Q1> <Q2> ...'  
where <prefix> is 2 bytes, and <prefixLen> is 1 byte, representing number  
of bits of prefix that should be fixed.

Then payer will know how much of <prefix> from the address should be taken  
verbatim, and the rest of the two bytes would be replaced with random  
data, and exactly two bytes would be put in the OP_RETURN.

If <prefixLen> was zero, the 2 byte prefix in the reusable address must be  
ignored, and an entirely random 2 byte prefix would be put into the  
OP_RETURN.

I'm a bit worried about broken implementations copying the <prefix> from  
the reusable address into OP_RETURN when <prefixLen> is 0, and ending up  
basically identifying the payee. That's the only reason I can think of to  
make '<prefix> <prefixLen>' optional in the reusable address, to prevent  
the opportunity to screw it up. You would *still* put a 2-byte random  
prefix in the OP_RETURN, even if the fields weren't in the address at all.  
It's just a minor concern though.