summaryrefslogtreecommitdiff
path: root/ee/81f492ab2f0f84a8e99ce9a6dba693559d892c
blob: db587eabd34d6e17cfe96828f5fd285fd55250da (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
Received: from sog-mx-4.v43.ch3.sourceforge.com ([172.29.43.194]
	helo=mx.sourceforge.net)
	by sfs-ml-2.v29.ch3.sourceforge.com with esmtp (Exim 4.76)
	(envelope-from <etotheipi@gmail.com>) id 1W2oKU-00052C-BK
	for bitcoin-development@lists.sourceforge.net;
	Mon, 13 Jan 2014 20:41:50 +0000
Received-SPF: pass (sog-mx-4.v43.ch3.sourceforge.com: domain of gmail.com
	designates 209.85.128.46 as permitted sender)
	client-ip=209.85.128.46; envelope-from=etotheipi@gmail.com;
	helo=mail-qe0-f46.google.com; 
Received: from mail-qe0-f46.google.com ([209.85.128.46])
	by sog-mx-4.v43.ch3.sourceforge.com with esmtps (TLSv1:RC4-SHA:128)
	(Exim 4.76) id 1W2oKT-0002WR-4w
	for bitcoin-development@lists.sourceforge.net;
	Mon, 13 Jan 2014 20:41:50 +0000
Received: by mail-qe0-f46.google.com with SMTP id 8so1275521qea.19
	for <bitcoin-development@lists.sourceforge.net>;
	Mon, 13 Jan 2014 12:41:43 -0800 (PST)
X-Received: by 10.224.40.131 with SMTP id k3mr33228188qae.23.1389645703685;
	Mon, 13 Jan 2014 12:41:43 -0800 (PST)
Received: from [192.168.1.85] (c-76-111-96-126.hsd1.md.comcast.net.
	[76.111.96.126])
	by mx.google.com with ESMTPSA id e11sm15587395qej.1.2014.01.13.12.41.42
	for <multiple recipients>
	(version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128);
	Mon, 13 Jan 2014 12:41:43 -0800 (PST)
Message-ID: <52D44F86.1040407@gmail.com>
Date: Mon, 13 Jan 2014 15:41:42 -0500
From: Alan Reiner <etotheipi@gmail.com>
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
	rv:24.0) Gecko/20100101 Thunderbird/24.2.0
MIME-Version: 1.0
To: Peter Todd <pete@petertodd.org>
References: <20140106120338.GA14918@savin>
	<op.w9c5o7vgyldrnw@laptop-air.hsd1.ca.comcast.net>
	<20140110102037.GB25749@savin>
	<op.w9kkxcityldrnw@laptop-air.hsd1.ca.comcast.net>
	<CABsx9T2G=yqSUGr0+Ju5-z9P++uS20AwLC+c3DnFMHtcQjQK6w@mail.gmail.com>
	<CAAS2fgTz0TaGhym_35V3N2-vHVzU9BeuV8q+QJjwh5bg77FEZg@mail.gmail.com>
	<20140113194049.GJ38964@giles.gnomon.org.uk>
	<CANAnSg30V01B_3LCJ09sTwcsYa4_WOg3sKd-=p6COZS6w0b-uA@mail.gmail.com>
	<52D4458C.6010909@gmail.com> <20140113201407.GB7941@petertodd.org>
In-Reply-To: <20140113201407.GB7941@petertodd.org>
X-Enigmail-Version: 1.6
Content-Type: multipart/alternative;
	boundary="------------040708000104080603000009"
X-Spam-Score: -0.6 (/)
X-Spam-Report: Spam Filtering performed by mx.sourceforge.net.
	See http://spamassassin.org/tag/ for more details.
	-1.5 SPF_CHECK_PASS SPF reports sender host as permitted sender for
	sender-domain
	0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
	(etotheipi[at]gmail.com)
	-0.0 SPF_PASS               SPF: sender matches SPF record
	1.0 HTML_MESSAGE           BODY: HTML included in message
	-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
	author's domain
	0.1 DKIM_SIGNED            Message has a DKIM or DK signature,
	not necessarily valid
	-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
X-Headers-End: 1W2oKT-0002WR-4w
Cc: bitcoin-development@lists.sourceforge.net
Subject: Re: [Bitcoin-development] Stealth Addresses
X-BeenThere: bitcoin-development@lists.sourceforge.net
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: <bitcoin-development.lists.sourceforge.net>
List-Unsubscribe: <https://lists.sourceforge.net/lists/listinfo/bitcoin-development>,
	<mailto:bitcoin-development-request@lists.sourceforge.net?subject=unsubscribe>
List-Archive: <http://sourceforge.net/mailarchive/forum.php?forum_name=bitcoin-development>
List-Post: <mailto:bitcoin-development@lists.sourceforge.net>
List-Help: <mailto:bitcoin-development-request@lists.sourceforge.net?subject=help>
List-Subscribe: <https://lists.sourceforge.net/lists/listinfo/bitcoin-development>,
	<mailto:bitcoin-development-request@lists.sourceforge.net?subject=subscribe>
X-List-Received-Date: Mon, 13 Jan 2014 20:41:50 -0000

This is a multi-part message in MIME format.
--------------040708000104080603000009
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit


On 01/13/2014 03:14 PM, Peter Todd wrote:
> On Mon, Jan 13, 2014 at 02:59:08PM -0500, Alan Reiner wrote:
>> How is this different from the proposal I have made?
>>
>> You distribute the root public key (but not chaincode!) of a BIP32
>> branch.  You can put your root key on a business card if you want.  Then
>> when someone wants to pay you, you simply give them the multiplier and
>> root key (they already have the root key, but should verify).  The
>> multiplier does not reveal the chaincode, thus keeping it private, but
>> it does allow them to confirm that the final address they are paying is
>> derived from that root key they know belongs to you ("Please pay address
>> X; oh btw, X=rootKey*mult").
>>
>> You can /choose/ to reveal that a given payment address is linked to
>> your root key without any compromise of privacy.  Or you can choose to
>> ignore it and just give them a bare address the old way and still
>> maintain privacy.  What advantages does "stealth addresses" have over
>> this scheme?  You could extend it using some kind of deterministic
>> sub-branching and/or ECDH to create multiple payment addresses without
>> querying the payee.
>
> Basically stealth addresses *are* your scheme, using the blockchain as a
> low or even no overhead communication channel for the payor to give the
> payee that multiplier without bidirectional communication.
>
> In the business card example I can't easily take your business card and
> just send you some money without that transaction being linked to public
> information. (your business card)

It's not public.  When I say "please pay me" I also say "use this
multiplier".  The multiplier isn't published, and it's not publicly
discoverable without my wallet (or access to my email).  The address
remains private between you and me.  As you said, it could be
discoverable if the email is discoverable, but I'm not seeing how how
critical that really is.

There's a lot of complexity around this constraint (possibly involving
new/secondary private keys, extra outputs, relying on change outputs,
and/or using 3rd parties to help look for transactions).  I'm not
convinced that what is being gained is really worth that extra complexity.

By contrast, what I proposed, that does require sending sending the
payer a multiplier once, is easy to implement in any BIP 32 wallet,
doesn't require any special address formats, and achieves 98% of the
same benefits without any special computation.   I guess I'm just not
convinced that it's really necessary for people to be able to send
others payments without contacting them (and/or hiding the evidence a
payment was made even if they communications were discovered).

-Alan




--------------040708000104080603000009
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

<html>
  <head>
    <meta content="text/html; charset=ISO-8859-1"
      http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <br>
    On 01/13/2014 03:14 PM, Peter Todd wrote:<br>
    <span style="white-space: pre;">&gt; On Mon, Jan 13, 2014 at
      02:59:08PM -0500, Alan Reiner wrote:<br>
      &gt;&gt; How is this different from the proposal I have made?<br>
      &gt;&gt;<br>
      &gt;&gt; You distribute the root public key (but not chaincode!)
      of a BIP32<br>
      &gt;&gt; branch.&nbsp; You can put your root key on a business card if
      you want.&nbsp; Then<br>
      &gt;&gt; when someone wants to pay you, you simply give them the
      multiplier and<br>
      &gt;&gt; root key (they already have the root key, but should
      verify).&nbsp; The<br>
      &gt;&gt; multiplier does not reveal the chaincode, thus keeping it
      private, but<br>
      &gt;&gt; it does allow them to confirm that the final address they
      are paying is<br>
      &gt;&gt; derived from that root key they know belongs to you
      ("Please pay address<br>
      &gt;&gt; X; oh btw, X=rootKey*mult").<br>
      &gt;&gt;<br>
      &gt;&gt; You can /choose/ to reveal that a given payment address
      is linked to<br>
      &gt;&gt; your root key without any compromise of privacy.&nbsp; Or you
      can choose to<br>
      &gt;&gt; ignore it and just give them a bare address the old way
      and still<br>
      &gt;&gt; maintain privacy.&nbsp; What advantages does "stealth
      addresses" have over<br>
      &gt;&gt; this scheme?&nbsp; You could extend it using some kind of
      deterministic<br>
      &gt;&gt; sub-branching and/or ECDH to create multiple payment
      addresses without<br>
      &gt;&gt; querying the payee. <br>
      &gt;<br>
      &gt; Basically stealth addresses *are* your scheme, using the
      blockchain as a<br>
      &gt; low or even no overhead communication channel for the payor
      to give the<br>
      &gt; payee that multiplier without bidirectional communication.<br>
      &gt;<br>
      &gt; In the business card example I can't easily take your
      business card and<br>
      &gt; just send you some money without that transaction being
      linked to public<br>
      &gt; information. (your business card)</span><br>
    <br>
    It's not public.&nbsp; When I say "please pay me" I also say "use this
    multiplier".&nbsp; The multiplier isn't published, and it's not publicly
    discoverable without my wallet (or access to my email).&nbsp; The address
    remains private between you and me.&nbsp; As you said, it could be
    discoverable if the email is discoverable, but I'm not seeing how
    how critical that really is.<br>
    <br>
    There's a lot of complexity around this constraint (possibly
    involving new/secondary private keys, extra outputs, relying on
    change outputs, and/or using 3rd parties to help look for
    transactions).&nbsp; I'm not convinced that what is being gained is
    really worth that extra complexity.<br>
    <br>
    By contrast, what I proposed, that does require sending sending the
    payer a multiplier once, is easy to implement in any BIP 32 wallet,
    doesn't require any special address formats, and achieves 98% of the
    same benefits without any special computation.&nbsp;&nbsp; I guess I'm just
    not convinced that it's really necessary for people to be able to
    send others payments without contacting them (and/or hiding the
    evidence a payment was made even if they communications were
    discovered).<br>
    <br>
    -Alan<br>
    <br>
    <br>
    <br>
  </body>
</html>

--------------040708000104080603000009--