Received-SPF: pass (sog-mx-1.v43.ch3.sourceforge.com: domain of gmail.com
	designates 209.85.213.182 as permitted sender)
	client-ip=209.85.213.182; envelope-from=pieter.wuille@gmail.com;
	helo=mail-ig0-f182.google.com; 
MIME-Version: 1.0
In-Reply-To: <20140509181353.GB27819@savin>
References: <CANEZrP3VNXSc2cd3b9pz9iC2BR0-vG=tfYwMyUGBGaWPq+geXQ@mail.gmail.com>
	<20140509150325.GA30436@savin>
	<CANEZrP1m=-GWD5rLRe9vrx0JYKeKXghNw-a47ZbJTd1h3ngFww@mail.gmail.com>
	<20140509152715.GA12421@savin>
	<CANEZrP0Yom_JjN2PnPsfKV5S4wZSze4XTcJJU2ZWee4VGo20tw@mail.gmail.com>
	<CAPg+sBh-OA7xSp3=SEGS1fP-d2CDMzMy_=S_jOs1hvdaWTw0mA@mail.gmail.com>
	<20140509181353.GB27819@savin>
Date: Fri, 9 May 2014 20:38:22 +0200
Message-ID: <CAPg+sBiSkeoD-Rxkoo+Dp8vTt0hE4FGLVxrdqTox6Njo8Mk5pw@mail.gmail.com>
From: Pieter Wuille <pieter.wuille@gmail.com>
To: Peter Todd <pete@petertodd.org>
Content-Type: text/plain; charset=ISO-8859-1
Cc: Bitcoin Dev <bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] ECDH in the payment protocol
Precedence: list

On Fri, May 9, 2014 at 8:13 PM, Peter Todd <pete@petertodd.org> wrote:
> I don't think we're going to find that's practical unfortunately due to
> change. Every payment I make ties up txouts, so if we try to base the
> atomicity of payments on whether or not the payee decides to broadcast
> the transaction the payor is stuck with txouts that they can't use until
> the payee makes up their mind. That leads to lots and lots of nasty edge
> cases.

I haven't talked much about it except for on IRC, but my idea was this:
* PaymentACK messages become signed (with the same key as the payment
request, or using some delegation mechanism, so that the same key
doesn't need to remain online).
* Instead of a full Bitcoin transaction, a Payment message contains a
scriptSig-less Bitcoin transaction + a limit on its byte size (and
perhaps a limit on its sigop count).
* The sender sends such a Payment to the receiver before actually
signing the transaction (or at least, before revealing the signed
form).
* The receiver only ACKs if the transaction satisfies the request, is
within time limits, isn't unlikely to confirm.
* If the sender likes the ACK (the refund and memo fields are intact,
the transaction isn't changed, the signature key is valid, ...), he
either sends the full transaction (with receiver taking responsibility
for broadcasting) or broadcasts it himself.

Together, this means that a paymentACK + a confirmed matching Bitcoin
transaction can count as proof of payment. Both parties have a chance
to disagree with the transaction, and are certain all communicated
data (apart from transaction signatures) in both directions happened
correctly before committing. It would completely remove the chance
that the Bitcoin transaction gets broadcast without the receiver
liking it (for legitimate or illegitimate reasons), or without the
backchannel functioning correctly.

It's also compatible with doing multiple payments in one Bitcoin
transaction - you can ask for ACKs from multiple parties before
signing the transaction.

Of course, the sender can still withhold the signed transaction (in
which case nothing happened, but we probably need a second timeout),
or the receiver can always claim to have never received the
transaction. The sender can broadcast the transaction himself in order
to prevent that, after obtaining an ACK.

-- 
Pieter