1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
|
Return-Path: <luke@dashjr.org>
Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org
[172.17.192.35])
by mail.linuxfoundation.org (Postfix) with ESMTPS id A65DA1102
for <bitcoin-dev@lists.linuxfoundation.org>;
Tue, 15 Sep 2015 04:04:35 +0000 (UTC)
X-Greylist: from auto-whitelisted by SQLgrey-1.7.6
Received: from zinan.dashjr.org (zinan.dashjr.org [192.3.11.21])
by smtp1.linuxfoundation.org (Postfix) with ESMTP id 48DC8136
for <bitcoin-dev@lists.linuxfoundation.org>;
Tue, 15 Sep 2015 04:04:35 +0000 (UTC)
Received: from ishibashi.localnet (unknown
[IPv6:2001:470:5:265:61b6:56a6:b03d:28d6])
(Authenticated sender: luke-jr)
by zinan.dashjr.org (Postfix) with ESMTPSA id 0D7EB10801D0;
Tue, 15 Sep 2015 04:03:51 +0000 (UTC)
X-Hashcash: 1:25:150915:bitcoin-dev@lists.linuxfoundation.org::3q83k9EM/N3jPnET:aXtj8
X-Hashcash: 1:25:150915:arthur@bitcoin-fr.io::8/NgUB4sc1cJB8/z:arJ2d
From: Luke Dashjr <luke@dashjr.org>
To: bitcoin-dev@lists.linuxfoundation.org,
"Arthur - bitcoin-fr.io" <arthur@bitcoin-fr.io>
Date: Tue, 15 Sep 2015 04:03:40 +0000
User-Agent: KMail/1.13.7 (Linux/4.1.6-gentoo; KDE/4.14.8; x86_64; ; )
References: <c5f5105e2d5b9cc1873f84cb0b172285@rainloop.aaawop.com>
In-Reply-To: <c5f5105e2d5b9cc1873f84cb0b172285@rainloop.aaawop.com>
X-PGP-Key-Fingerprint: E463 A93F 5F31 17EE DE6C 7316 BD02 9424 21F4 889F
X-PGP-Key-ID: BD02942421F4889F
X-PGP-Keyserver: hkp://pgp.mit.edu
MIME-Version: 1.0
Content-Type: Text/Plain;
charset="iso-8859-15"
Content-Transfer-Encoding: 7bit
Message-Id: <201509150403.40909.luke@dashjr.org>
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,T_RP_MATCHES_RCVD
autolearn=ham version=3.3.1
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on
smtp1.linux-foundation.org
Subject: Re: [bitcoin-dev] URI scheme for signing and verifying messages
X-BeenThere: bitcoin-dev@lists.linuxfoundation.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Bitcoin Development Discussion <bitcoin-dev.lists.linuxfoundation.org>
List-Unsubscribe: <https://lists.linuxfoundation.org/mailman/options/bitcoin-dev>,
<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=unsubscribe>
List-Archive: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/>
List-Post: <mailto:bitcoin-dev@lists.linuxfoundation.org>
List-Help: <mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=help>
List-Subscribe: <https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev>,
<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=subscribe>
X-List-Received-Date: Tue, 15 Sep 2015 04:04:35 -0000
On Monday, September 14, 2015 6:57:01 PM Arthur - bitcoin-fr.io via bitcoin-
dev wrote:
> Hi,I realized that there isn't any way to ask for a signature (or to verify
> a message) as easily you can do when requesting a payment using a bitcoin
> URI scheme (BIP0021).I think a URI scheme to use the signing tools in
> bitcoin core might be useful, and with a proper consensus it could become
> available in most bitcoin clients who already support message
> signing/verifying and payment url (or QRCode) and enable new uses of
> bitcoin signatures.A way to gain proper consensus is going through a BIP,
> so that's why I'm here: to present my idea publicly before going any
> further (draft BIP and reference implementation).Some thoughts - like
> BIP0021: "Bitcoin clients MUST NOT act on URIs without getting the user's
> authorization." so signing requires the user to manually approve the
> process - it could use the same URI scheme than BIP0021 with an additional
> parameter (ex: signaction=) or use another one like BIP121 (ex: btcsig:)PS
> : I'll also post a topic in "Development & Technical Discussion" section
> on Bitcointalk --Arthur Bouquet
I think probably the whole signed message thing needs to be rethought. The
most common "uses" today seem to be insecure cases that it doesn't actually
work in: people trying to prove ownership of bitcoins and/or that they sent
bitcoins (current signed messages can do neither). Ideally, whatever the new
method is should also avoid using the same key as for signing transactions,
since the public key is technically private information. Furthermore, since
addresses are semi-deprecated (by the payment protocol), I'm not sure it
makes sense to do this without designing an entire authentication system,
which may be rather complex.
Luke
|
