MIME-Version: 1.0
Date: Fri, 13 Mar 2015 20:29:42 +0100
Message-ID: <CAPswA9zzVDxW8_WXg5833r2Z4pxZOppYtNLHMQ=Nw-H72cMz7w@mail.gmail.com>
From: Kalle Rosenbaum <kalle@rosenbaum.se>
To: bitcoin-development@lists.sourceforge.net
Content-Type: multipart/alternative; boundary=001a113769d0b76e14051130851f
Subject: [Bitcoin-development] Proof of Payment
Precedence: list

--001a113769d0b76e14051130851f
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Hi all,

I've been thinking about how a person can prove that she has made a
payment. I came up with an idea I call Proof of Payment (PoP) and I would
highly appreciate your comments. Has something like this been discussed
somewhere before?

*Use cases*

There are several scenarios in which it would be useful to prove that you
have paid for something. For example:

   - A pre-paid hotel room where your PoP functions as a key to the door.
   - An online video rental service where you pay for a video and watch it
   on any device.
   - An ad-sign where you pay in advance for e.g. 2-weeks exclusivity.
   During this period you can upload new content to the sign whenever you l=
ike
   using PoP.
   - A lottery where all participants pay to the same address, and the
   winner of the T-shirt is selected among the transactions to that address=
.
   You exchange the T-shirt for a PoP for the winning transaction.

These use cases can be achieved without any personal information (no
accounts, no e-mails, etc) being involved.
Desirable properties:

   1. A PoP should be generated on demand.
   2. It should only be usable once to avoid issues due to theft.
   3. It should be able to create a PoP for any payment, regardless of
   script type (P2SH, P2PKH, etc.).

Current methods of proving a payment, as I know of:

   - BIP0070, The PaymentRequest together with the transactions fulfilling
   the payment makes some sort of proof. However, it does not meet 1 or 2 a=
nd
   it obviously only meets 3 if the payment is made through BIP0070. Also,
   there's no standard way to request/provide the proof.
   - Signing messages, chosen by the entity that the proof is provided to,
   with the private keys used to sign the transaction. This could meet 1 an=
d 2
   but probably not 3. This is not standardized either.

*Proof of Payment, the data structure*

A proof of payment for a transaction T, PoP(T), is used to prove that one
has ownership of the credentials needed to unlock all the inputs of T. It
has the exact same structure as a bitcoin transaction with the same inputs
as T and with a single OP_RETURN output:

OP_RETURN PoP <txid> <nonce>

| Field     | Size [B] | Description                        |
|-----------|----------|------------------------------------|
| PoP       | 3        | Literal identifying this as a PoP  |
| <txid>    | 32       | The transaction to Prove           |
| <nonce>   | 5        | Unsigned integer                   |

The PoP is signed using the same signing process that is used for bitcoin
transactions. The purpose of the nonce is to make it harder to use a stolen
PoP. Once the PoP has reached the destination, that PoP is useless since
the destination will generate a new nonce for every PoP.

*Proof of Payment, the process*

   1. A proof of payment request is sent from the server to the wallet. The
   request contains:
      1. a random nonce
      2. a destination where to send the PoP, for example a https URL
      3. data hinting the wallet which transaction to create a proof for.
      For example:
      - txid, if known by the server
         - PaymentRequest.PaymentDetails.merchant_data (in case of a
         BIP0070 payment)
         - amount
         - label, message or other information from a BIP0021 URL
      2. The wallet identifies the transaction T, if possible. Otherwise
   asks the user to select among the ones that fit the hints in 1.3.
   3. The wallet checks that T is on the blockchain, meaning all the inputs
   are spent.
   4. The wallet creates an unsigned PoP (UPoP) for T, and asks the user to
   sign it.
   5. The user confirms
   6. The UPoP(T) is signed by the wallet, creating PoP(T).
   7. The PoP is sent to the destination in 1.2.
   8. The server receiving the PoP validates it and responds with =E2=80=9C=
valid=E2=80=9D
   or =E2=80=9Cinvalid=E2=80=9D
   9. The wallet displays the response in some way to the user.

Remarks:

   - The method of transferring the PoP request at step 1 is not very well
   thought through, but I think we can extend BIP0021 to cater for this. Fo=
r
   example read a URI, representing a PoP request, using QR code or NFC. A
   more advanced approach would be to extend BIP0070.
   - The nonce must be randomly generated by the server for every new PoP
   request.

*Validating a PoP*

The server needs to validate the PoP and reply with =E2=80=9Cvalid=E2=80=9D=
 or =E2=80=9Cinvalid=E2=80=9D.
That process is outlined below:

   1. Check the format of the PoP. It must pass normal transaction checks,
   except for the inputs being already spent.
   2. Check the output script. It must conform to the OP_RETURN output
   format outlined above.
   3. Check that the nonce is the same as the one you requested.
   4. Check that the txid in the output is the transaction you actually
   want proof for. If you don=E2=80=99t know what transaction you want proo=
f for,
   check that the transaction actually pays for the product/service you
   deliver (in the video rental case, find the transaction among all paymen=
ts
   for that specific video).
   5. Check that the inputs of the PoP are exactly the same as in
   transaction T.
   6. Check the signatures of all the inputs, as would be done on a normal
   transaction.
   7. If the signatures are valid, the PoP is valid.

*Security issues*

   - Someone can intercept the PoP-request and change the destination so
   that the user sends the PoP to the bad actor.
   - Someone can intercept the PoP-request and change for example the txid
   to trick the user to sign a PoP for another transaction than the intende=
d.
   This can of course be avoided by actually looking at the UPoP before
   signing it. The bad actor could also set hints for a transaction that th=
e
   user didn=E2=80=99t make, resulting in a broken service.
   - Someone can steal a PoP and try to use the service hoping to get a
   matching nonce. Probability per try: 1/(2^40). The server should have
   mechanism for detecting a brute force attack of this kind, or at least s=
low
   down the process by delaying the PoP request by some 100 ms or so.
   - Even if a wallet has no funds it might still be valuable as a
   generator for PoPs. This makes it important to keep the security of the
   wallet after it has been emptied.

The first two issues are the same as for traditional bitcoin payments. They
could be mitigated by using secure connections and possibly also extending
BIP0070 to support PoPs.

*Further work*

   - Figure out how to make use of, and extend, BIP0070 for the purpose of
   PoPs
   - Define an extension for BIP0021 to support PoP requests (something
   along the lines of BIP0072)
   - Implement a proof-of-concept
   - Possibly propose BIPs for the different parts.

Looking forward to reading your comments
Regards,
Kalle Rosenbaum

--001a113769d0b76e14051130851f
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div><div>Hi all,<br></div><div><br>I&#39;ve been thinking=
 about how a person can prove that she has made a payment. I came up with a=
n idea I call Proof of Payment (PoP) and I would highly appreciate your com=
ments. Has something like this been discussed somewhere before?<br><br></di=
v><div><b>Use cases</b><br></div><div><br>There are several scenarios in wh=
ich it would be useful to prove that you have paid for something. For examp=
le:<br><ul><li>A pre-paid hotel room where your PoP functions as a key to t=
he door.</li><li>An online video rental service where you pay for a video a=
nd watch it on any device.</li><li>An ad-sign where you pay in advance for =
e.g. 2-weeks exclusivity. During this period you can upload new content to =
the sign whenever you like using PoP.</li><li>A lottery where all participa=
nts pay to the same address, and the winner of the T-shirt is selected amon=
g the transactions to that address. You exchange the T-shirt for a PoP for =
the winning transaction.</li></ul><p>These use cases can be achieved withou=
t any personal information (no accounts, no e-mails, etc) being involved.<b=
r></p>Desirable properties:<br><ol><li>A PoP should be generated on demand.=
</li><li>It should only be usable once to avoid issues due to theft.</li><l=
i>It should be able to create a PoP for any payment, regardless of script t=
ype (P2SH, P2PKH, etc.).<br></li></ol>Current methods of proving a payment,=
 as I know of:<br><ul><li>BIP0070, The PaymentRequest together with the tra=
nsactions fulfilling the payment makes some sort of proof. However, it does=
 not meet 1 or 2 and it obviously only meets 3 if the payment is made throu=
gh BIP0070. Also, there&#39;s no standard way to request/provide the proof.=
</li><li>Signing messages, chosen by the entity that the proof is provided =
to, with the private keys used to sign the transaction. This could meet 1 a=
nd 2 but probably not 3. This is not standardized either.<br></li></ul><b>P=
roof of Payment, the data structure</b><br><br>A proof of payment for a tra=
nsaction T, PoP(T), is used to prove that one has ownership of the credenti=
als needed to unlock all the inputs of T. It has the exact same structure a=
s a bitcoin transaction with the same inputs as T and with a single OP_RETU=
RN output:<br><br><span style=3D"font-family:monospace,monospace">OP_RETURN=
 PoP &lt;txid&gt; &lt;nonce&gt;<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0 <br>| Field =C2=A0 =C2=A0 | Size [B] | Description=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 |<br>|-----------|--------=
--|------------------------------------|<br>| PoP=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 | 3=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 | Literal identi=
fying this as a PoP=C2=A0 |<br>| &lt;txid&gt; =C2=A0=C2=A0 | 32=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0 | The transaction to Prove=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 |<br>| &lt;nonce&gt;=C2=A0=C2=A0 | 5=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 | Unsigned integer=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0 |</span><br><br>The PoP is signed using the same sign=
ing process that is used for bitcoin transactions. The purpose of the nonce=
 is to make it harder to use a stolen PoP. Once the PoP has reached the des=
tination, that PoP is useless since the destination will generate a new non=
ce for every PoP.<br><br><b>Proof of Payment, the process</b><br></div><ol>=
<li>A proof of payment request is sent from the server to the wallet. The r=
equest contains:</li><ol><li>a random nonce</li><li>a destination where to =
send the PoP, for example a https URL</li><li>data
 hinting the wallet which transaction to create a proof for. For=20
example:<br></li><ul><li>txid, if known by the server<br></li><li>PaymentRe=
quest.PaymentDetails.merchant_data (in case of a BIP0070 payment)</li><li>a=
mount</li><li>label, message or other information from a BIP0021 URL</li></=
ul></ol><li>The wallet identifies the transaction T, if possible. Otherwise=
 asks the user to select among the ones that fit the hints in 1.3.</li><li>=
The wallet checks that T is on the blockchain, meaning all the inputs are s=
pent.<br></li><li>The wallet creates an unsigned PoP (UPoP) for T, and asks=
 the user to sign it.</li><li>The user confirms</li><li>The UPoP(T) is sign=
ed by the wallet, creating PoP(T).</li><li>The PoP is sent to the destinati=
on in 1.2.</li><li>The server receiving the PoP validates it and responds w=
ith =E2=80=9Cvalid=E2=80=9D or =E2=80=9Cinvalid=E2=80=9D</li><li>The wallet=
 displays the response in some way to the user.</li></ol>Remarks: <br><ul><=
li>The method of transferring the PoP request at step 1 is not very well th=
ought through, but I think we can extend BIP0021 to cater for this. For exa=
mple read a URI, representing a PoP request, using QR code or NFC. A more a=
dvanced approach would be to extend BIP0070. </li><li>The nonce must be ran=
domly generated by the server for every new PoP request.</li></ul><b>Valida=
ting a PoP</b><br><br>The server needs to validate the PoP and reply with =
=E2=80=9Cvalid=E2=80=9D or =E2=80=9Cinvalid=E2=80=9D. That process is outli=
ned below:<br><ol><li>Check the format of the PoP. It must pass normal tran=
saction checks, except for the inputs being already spent.</li><li>Check th=
e output script. It must conform to the OP_RETURN output format outlined ab=
ove.</li><li>Check that the nonce is the same as the one you requested.</li=
><li>Check that the txid in the output is the transaction you actually want=
 proof for. If you don=E2=80=99t know what transaction you want proof for, =
check that the transaction actually pays for the product/service you delive=
r (in the video rental case, find the transaction among all payments for th=
at specific video).</li><li>Check that the inputs of the PoP are exactly th=
e same as in transaction T.</li><li>Check the signatures of all the inputs,=
 as would be done on a normal transaction.</li><li>If the signatures are va=
lid, the PoP is valid. </li></ol><b>Security issues</b><br><ul><li>Someone =
can intercept the PoP-request and change the destination so that the user s=
ends the PoP to the bad actor.</li><li>Someone can intercept the PoP-reques=
t and change for example the txid to trick the user to sign a PoP for anoth=
er transaction than the intended. This can of course be avoided by actually=
 looking at the UPoP before signing it. The bad actor could also set hints =
for a transaction that the user didn=E2=80=99t make, resulting in a broken =
service.</li><li>Someone can steal a PoP and try to use the service hoping =
to get a matching nonce. Probability per try: 1/(2^40). The server should h=
ave mechanism for detecting a brute force attack of this kind, or at least =
slow down the process by delaying the PoP request by some 100 ms or so.</li=
><li>Even if a wallet has no funds it might still be valuable as a generato=
r for PoPs. This makes it important to keep the security of the wallet afte=
r it has been emptied.<br></li></ul>The first two issues are the same as fo=
r traditional bitcoin payments. They could be mitigated by using secure con=
nections and possibly also extending BIP0070 to support PoPs.<br><br></div>=
<b>Further work</b><br><ul><li>Figure out how to make use of, and extend, B=
IP0070 for the purpose of PoPs</li><li>Define an extension for BIP0021 to s=
upport PoP requests (something along the lines of BIP0072)</li><li>Implemen=
t a proof-of-concept</li><li>Possibly propose BIPs for the different parts.=
<br></li></ul><div>Looking forward to reading your comments<br>Regards,<br>=
</div><div>Kalle Rosenbaum<br></div><div><br></div></div>

--001a113769d0b76e14051130851f--