MIME-Version: 1.0
From: Ruben Somsen <rsomsen@gmail.com>
Date: Sat, 11 Jun 2022 12:01:58 +0200
Message-ID: <CAPv7TjYXSStBWCnFcuJjVv8AAD6EGN9Vxg30XCF2UHyS5z89mw@mail.gmail.com>
To: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: multipart/alternative; boundary="0000000000002a942505e129268a"
Subject: [bitcoin-dev] BIP47 Prague Discussion
Precedence: list

--0000000000002a942505e129268a
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

This discussion took place at Pizza Day Prague 2022[0] after a brief
discussion on Silent Payments[1]. The main points have been summarized
below.

The discussion was mainly between Alekos Filini, Martin Habov=C5=A1tiak, an=
d
myself, as well as Daniela Brozzoni, Eric Sirion, Pavol Rusnak, Salvatore
Ingala, and others.

Also available as a gist:
https://gist.github.com/RubenSomsen/21c477c90c942acf45f8e8f5c1ad4fae

And my personal opinion can be found in the comments:
https://gist.github.com/RubenSomsen/21c477c90c942acf45f8e8f5c1ad4fae?permal=
ink_comment_id=3D4197284#gistcomment-4197284


Improving BIP47

BIP47 requires a notification transaction prior to making payments. This
transaction takes up on-chain space and can easily leak privacy if not
handled with extreme caution. In practice this is quite hard.

The discussion revolved around whether we can a.) minimize the on-chain
space required and b.) outsource the notification transaction so the link
between the sender and recipient is no longer apparent on-chain.


BIP47 space requirements

As currently implemented, BIP47 (V1/V2)[2] requires an input key for
blinding, the blinded sender payment code in an op_return, and the
recipient key in an output.

The first question that came up was whether it is necessary for the
recipient to learn the payment code of the sender. The benefit is that this
enables the recipient to send a notification transaction and subsequent
payment to the sender, but in practice this never happens. It therefore
seems acceptable to forego this requirement, as this potentially saves
space. The minimum notification payload that seems required is a fresh
sender key and a static recipient key.

The sender key should ideally be deterministically derived from the sender
xpub based on the recipient key. If the user checks all the keys that were
registered with the recipient prior to notification, it can statelessly
find out whether the sender key was already previously registered. This
step can be skipped, which is easier for light clients, but means the
notification transaction will have to be resent if the user ever forgets
they already sent a notification (such as when restoring from backup).


Outsourcing the notification

The next part of the discussion revolved around the idea of putting
multiple notifications in a single transaction that can be outsourced to a
third party in order to break the sender/recipient link. This third party
could be paid over the Lightning Network for their services.

One idea was to use the taproot annex to insert the notification payload as
(discounted) witness data. One downside with this approach is that it
requires custom software for the recipient to notice the notification,
since it's not tied to an easily noticeable output. The middle ground
solution would be to put the sender keys there but still create an output
for each recipient key.


Allowing collisions

One interesting point that came up was that you could represent the
recipient key using e.g. only 4 bytes (provided you put it in the annex).
This leaves a window of 1 in ~4.3 billion for a collision, but the extra
work that needs to be performed when it does happen is negligible
(essentially expecting a payment while there is none). This would reduce
the payload from 64 bytes to 36 bytes of witness data.

While this did not come up in the discussion, it should be noted that using
the annex makes the transaction non-standard[3]. It could either be
standardized as the first use case for the annex, or perhaps an alternative
method[4] should be considered.


[0] Pizza Day Prague 2022: https://www.pizzaday.cz

[1] Silent Payments:
https://gist.github.com/RubenSomsen/c43b79517e7cb701ebf77eec6dbb46b8

[2] BIP47: https://github.com/bitcoin/bips/blob/master/bip-0047.mediawiki

[3] Annex non-standard:
https://github.com/bitcoin/bitcoin/pull/17977/files#diff-ea6d307faa4ec9dfa5=
abcf6858bc19603079f2b8e110e1d62da4df98f4bdb9c0R250

[4] Using p2wsh:
https://gist.github.com/RubenSomsen/21c477c90c942acf45f8e8f5c1ad4fae?permal=
ink_comment_id=3D4189419#gistcomment-4189419

--0000000000002a942505e129268a
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>This discussion took place at Pizza Day Prague 2022[0=
] after a brief discussion on Silent Payments[1]. The main points have been=
 summarized below.<br></div><div><br>The discussion was mainly between Alek=
os Filini, Martin Habov=C5=A1tiak, and myself, as well as Daniela Brozzoni,=
 Eric Sirion, Pavol Rusnak, Salvatore Ingala, and others.</div><div><br></d=
iv><div>Also available as a gist:<div><a href=3D"https://gist.github.com/Ru=
benSomsen/21c477c90c942acf45f8e8f5c1ad4fae">https://gist.github.com/RubenSo=
msen/21c477c90c942acf45f8e8f5c1ad4fae</a></div><div><br></div><div>And my p=
ersonal opinion can be found in the comments:</div><div><a href=3D"https://=
gist.github.com/RubenSomsen/21c477c90c942acf45f8e8f5c1ad4fae?permalink_comm=
ent_id=3D4197284#gistcomment-4197284">https://gist.github.com/RubenSomsen/2=
1c477c90c942acf45f8e8f5c1ad4fae?permalink_comment_id=3D4197284#gistcomment-=
4197284</a><br></div><br><br>Improving BIP47<br><br>BIP47 requires a notifi=
cation transaction prior to making payments. This transaction takes up on-c=
hain space and can easily leak privacy if not handled with extreme caution.=
 In practice this is quite hard.<br><br>The discussion revolved around whet=
her we can a.) minimize the on-chain space required and b.) outsource the n=
otification transaction so the link between the sender and recipient is no =
longer apparent on-chain.<br><br><br>BIP47 space requirements</div><div><br=
>As currently implemented, BIP47 (V1/V2)[2] requires an input key for blind=
ing, the blinded sender payment code in an op_return, and the recipient key=
 in an output.<br><br>The first question that came up was whether it is nec=
essary for the recipient to learn the payment code of the sender. The benef=
it is that this enables the recipient to send a notification transaction an=
d subsequent payment to the sender, but in practice this never happens. It =
therefore seems acceptable to forego this requirement, as this potentially =
saves space. The minimum notification payload that seems required is a fres=
h sender key and a static recipient key.<br><br>The sender key should ideal=
ly be deterministically derived from the sender xpub based on the recipient=
 key. If the user checks all the keys that were registered with the recipie=
nt prior to notification, it can statelessly find out whether the sender ke=
y was already previously registered. This step can be skipped, which is eas=
ier for light clients, but means the notification transaction will have to =
be resent if the user ever forgets they already sent a notification (such a=
s when restoring from backup).<br><br><br>Outsourcing the notification</div=
><div><br>The next part of the discussion revolved around the idea of putti=
ng multiple notifications in a single transaction that can be outsourced to=
 a third party in order to break the sender/recipient link. This third part=
y could be paid over the Lightning Network for their services.<br><br>One i=
dea was to use the taproot annex to insert the notification payload as (dis=
counted) witness data. One downside with this approach is that it requires =
custom software for the recipient to notice the notification, since it&#39;=
s not tied to an easily noticeable output. The middle ground solution would=
 be to put the sender keys there but still create an output for each recipi=
ent key.<br><br><br>Allowing collisions</div><div><br>One interesting point=
 that came up was that you could represent the recipient key using e.g. onl=
y 4 bytes (provided you put it in the annex). This leaves a window of 1 in =
~4.3 billion for a collision, but the extra work that needs to be performed=
 when it does happen is negligible (essentially expecting a payment while t=
here is none). This would reduce the payload from 64 bytes to 36 bytes of w=
itness data.<br><br>While this did not come up in the discussion, it should=
 be noted that using the annex makes the transaction non-standard[3]. It co=
uld either be standardized as the first use case for the annex, or perhaps =
an alternative method[4] should be considered.<br></div><div><br></div><div=
><br></div><div>[0] Pizza Day Prague 2022: <a href=3D"https://www.pizzaday.=
cz">https://www.pizzaday.cz</a></div><div><br></div><div>[1] Silent Payment=
s: <a href=3D"https://gist.github.com/RubenSomsen/c43b79517e7cb701ebf77eec6=
dbb46b8">https://gist.github.com/RubenSomsen/c43b79517e7cb701ebf77eec6dbb46=
b8</a></div><div><br></div><div>[2] BIP47:=C2=A0<a href=3D"https://github.c=
om/bitcoin/bips/blob/master/bip-0047.mediawiki">https://github.com/bitcoin/=
bips/blob/master/bip-0047.mediawiki</a></div><div><br></div><div>[3] Annex =
non-standard:=C2=A0<a href=3D"https://github.com/bitcoin/bitcoin/pull/17977=
/files#diff-ea6d307faa4ec9dfa5abcf6858bc19603079f2b8e110e1d62da4df98f4bdb9c=
0R250">https://github.com/bitcoin/bitcoin/pull/17977/files#diff-ea6d307faa4=
ec9dfa5abcf6858bc19603079f2b8e110e1d62da4df98f4bdb9c0R250</a></div><div><br=
></div><div>[4] Using p2wsh:=C2=A0<a href=3D"https://gist.github.com/RubenS=
omsen/21c477c90c942acf45f8e8f5c1ad4fae?permalink_comment_id=3D4189419#gistc=
omment-4189419">https://gist.github.com/RubenSomsen/21c477c90c942acf45f8e8f=
5c1ad4fae?permalink_comment_id=3D4189419#gistcomment-4189419</a></div><div>=
<br></div></div>

--0000000000002a942505e129268a--