Received-SPF: pass (sog-mx-1.v43.ch3.sourceforge.com: domain of petertodd.org
	designates 62.13.149.56 as permitted sender)
	client-ip=62.13.149.56; envelope-from=pete@petertodd.org;
	helo=outmail149056.authsmtp.com; 
Date: Sat, 26 Oct 2013 00:15:51 -0400
From: Peter Todd <pete@petertodd.org>
To: Gregory Maxwell <gmaxwell@gmail.com>
Message-ID: <20131026041551.GA15932@savin>
References: <CAAS2fgRRobkE2GdYomtJof7HCH-9ZczE9EBj7DBS-pCGscUSNQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="T4sUOijqQbZv57TR"
Content-Disposition: inline
In-Reply-To: <CAAS2fgRRobkE2GdYomtJof7HCH-9ZczE9EBj7DBS-pCGscUSNQ@mail.gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Cc: Bitcoin Development <bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] Payment protocol for onion URLs.
Precedence: list


--T4sUOijqQbZv57TR
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Fri, Oct 25, 2013 at 08:31:05PM -0700, Gregory Maxwell wrote:
> One limitation of the payment protocol as speced is that there is no
> way for a hidden service site to make use of its full authentication
> capability because they are unable to get SSL certificates issued to
> them.
>=20
> A tor hidden service (onion site) is controlled by an RSA key.
>=20
> It would be trivial to pack a tor HS pubkey into a self-signed x509
> certificate with the cn set to foooo.onion.
>=20
> If we specified in the payment protocol an additional validation
> procedure for [base32].onion hosts that just has it hash and base32
> encode the pubkey (as tor does) then the payment protocol could work
> seamlessly with tor hosts. (Displaying that the payment request came
> from "foooo.onion").  I believe that the additional code for this
> would be trivial (and I'll write it if there is support for making
> this a standard feature).
>=20
> This would give us an fully supported option which is completely CA
> free... it would only work for tor sites, but the people concerned
> about CA trechery are likely to want to use tor in any case.
>=20
> Thoughts?

Strong ACK on the basis of responding for forum trolls alone.

It's easy enough to make it a genuinely useful tool for multisig wallets
too: keep a copy of your Tor URL bookmarks on your second signing
computer. So long as either computer has the correct URL you're safe.

--=20
'peter'[:-1]@petertodd.org
0000000000000006fbd917e8b4770c566dbc8ed4bedd00f441286ffb6e7f73ac

--T4sUOijqQbZv57TR
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQGrBAEBCACVBQJSa0H3XhSAAAAAABUAQGJsb2NraGFzaEBiaXRjb2luLm9yZzAw
MDAwMDAwMDAwMDAwMDZmYmQ5MTdlOGI0NzcwYzU2NmRiYzhlZDRiZWRkMDBmNDQx
Mjg2ZmZiNmU3ZjczYWMvFIAAAAAAFQARcGthLWFkZHJlc3NAZ251cGcub3JncGV0
ZUBwZXRlcnRvZC5vcmcACgkQJIFAPaXwkfskDgf9FqAe40s1p4PX7C22a4un56PO
Iz18EexpGa5hyk0Y3juCxBzIAvSZJKBiOjUGy3fn4TPQrhYD6ioPVS2c1ORKyvm5
Pmtpqf1+yqpw5Syrtz28KR7JK5XOyfldAW+5gyzLhYAqWBo78zmz5byJJdp5LTy6
+DJQm7FV81YuxmVHXdrfB1KYFUkqLwBqOOIJ9vKGZjlGMjRlHENnOqV86ndgpesQ
Bz2Z8qULsp+/97JqQAifABS0zMi2KPHqb1bmNzuY62TeNSHC6GfVXMtiO9LCcG+8
CczkqlrBq17Y1eP83FxBl1pkja1ACKMCNah++NiLH2HNRO1AuaiWoEqysxvs2w==
=fz7A
-----END PGP SIGNATURE-----

--T4sUOijqQbZv57TR--