Date: Fri, 24 Jan 2014 16:42:35 +0100
From: Adam Back <adam@cypherspace.org>
To: Mike Hearn <mike@plan99.net>
Message-ID: <20140124154235.GA3741@netbook.cypherspace.org>
References: <CAAS2fgQmsxjkQFSiCdeMoVMaqq5720KpUpdkKZOE+XytHsWw0w@mail.gmail.com>
	<20140124090218.GA15398@savin>
	<CANEZrP0MnXr4xjaMPg7v7vTiDQr-y7esvEBE=xk=Y0BUGXak9A@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1; format=flowed
Content-Disposition: inline
In-Reply-To: <CANEZrP0MnXr4xjaMPg7v7vTiDQr-y7esvEBE=xk=Y0BUGXak9A@mail.gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Content-Transfer-Encoding: quoted-printable
Cc: Bitcoin Development <bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] Bait for reusable addresses
Precedence: list

I think prefix has analysis side effects.  There are (at least) 4 things
that link payments: the graph of payment flows, timing, precise amounts, =
IP
addresses, but with prefix a 5th: the prefix allows public elmination of
candidates connections, I think that may make network flow analysis even
more effective than it has been.

So SPV can be tuned as Mike just said, and as Greg pointed out somewhere
bloom is more private than prefix because its a wallet to node connection=
,
not a node broadcast, and Mike mentioned embedded Tor in another post to
boost node-capture issues with hostile network.

So reusable addresses are cool for full node recipients (0-bit prefix) or
trusted server offload (your own desktop, VPS, or trusted service provide=
r
node, and solve real problems for the use case of static and donation
addresses particularly with this second delegatable key for no-funds at r=
isk
search (which is even good as Jeremey said for your own node, in a offlin=
e
wallet use case).

Now while it would be clearly a very nice win if reusable addresses could=
 be
made SPV-like in network characteristics and privacy, but we dont have a
plausible mechanism yet IMO.  Close as we got was Greg's enhancement of
my/your "bloom bait"/"prefix" concept to make multiple candidate baits to
provide some ambiguity (still allows elimination, just slightly less of i=
t).

If we can find some efficient crypto to solve that last one, we could eve=
n
adopt them generally if it was efficient enough without needing interacti=
ve
one-use address release.

Maybe we should ask some math/theoretical crypto people if there is anyth=
ing
like public key watermarking or something that could solve this problem
efficiently.

For the related but different case of transaction level authenticity I li=
ke
Alan's server derived but communicated scalar & base to allow the client =
to
do at least TOFU.

Payment protocol may add another level of identity framework on top of TO=
FU
addresses (at a lower level than the payment messages defined now), and
without then needing a batch upload of offline signed secondary address
sigature that Mike described a while back, at least in person, maybe onli=
ne
somewhere (an add on with similar purpose and effect to Alan's TOFU, but
then with revocation, identity and certification for merchants).

I have not talked about payment protocols main app level function I think=
 we
all understand and agree on the purpose and use of the server and optiona=
l
client certs in that.  People may wish to add other cert types later (eg
PGP, SSH etc) but this version covers the common merchant tech, and allow=
s
client-side certs to be experimented with for identity also (eg imagine a=
s a
way to enrol with regulated entities like exchanges.)

Tell me if I am misunderstanding anything :)

Adam

On Fri, Jan 24, 2014 at 12:26:19PM +0000, Mike Hearn wrote:
>     brittleness. The real world experience is that users, or to be exac=
t
>     wallet authors, turn down SPV privacy parameters until bloom filter=
s
>     have almost no privacy in exchange for little bandwidth usage.
>
>   That's not fundamental though, it just reflects that the only
>   implementation of this is used on a wide range of devices and doesn't
>   yet have any notion of bandwidth modes or monitoring. It can and will
>   be resolved at some point.=C2