Message-ID: <55AD0669.4040002@electrum.org>
Date: Mon, 20 Jul 2015 16:32:09 +0200
From: Thomas Voegtlin <thomasv@electrum.org>
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
	rv:31.0) Gecko/20100101 Thunderbird/31.7.0
MIME-Version: 1.0
CC: bitcoin-dev@lists.linuxfoundation.org
References: <CA+w+GKQbOMz5nb_SnLB6Xb0FYzNZ_rEj5nbNjm2jY0+L8JJGAA@mail.gmail.com>	<55A4AF62.4090607@electrum.org>	<CA+w+GKRCPEUezaTb46pzuDNxKNgi_KdTW2dOn9hsHwgD159czw@mail.gmail.com>	<55AB8785.4080201@electrum.org>
	<CA+w+GKTtkYUst0UJa6364LqBRqWYrA+fOKed973mQCQS4ze=4Q@mail.gmail.com>
In-Reply-To: <CA+w+GKTtkYUst0UJa6364LqBRqWYrA+fOKed973mQCQS4ze=4Q@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [bitcoin-dev] Proposal: extend bip70 with OpenAlias
Precedence: list

hi Mike,

I hope you had a good trip!


> To get more specific, DNSSEC uses RSA 1024 bit. This causes two problem=
s:
>=20
>    1. A DNSSEC proof is large, bytes wise. Even a single RSA signature
>    won't fit nicely in a QR code, I think.
>=20
>    2. 1024 bit is the absolute minimum strength you can get away with,
>    really. DNSSEC assumes frequent key rotations to try and help, which
>    complicates things.
>=20
> So I'm not sure using DNSSEC fixes the usability problem we want to fix=
.
>=20

In my previous post, I was suggesting to *not* include the proof in the
request, because the payer can download it independently. Only the final
signature is needed. What makes DNSSEC interesting is not the size of
the proof, but rather the fact that you can request it easily, and in a
canonical way.

A typical lightweight payment request, serialized with EC signature and
without the proof, would be about 150 bytes long.


> I will do a separate reply to break out some thoughts on replacing QR c=
odes.
>=20
> Would it be possible to create the same kind of "lightweight payment
>> requests" using SSL certificates? Probably, if the final signing key i=
s
>> a EC key, and if the payment request does not include the whole chain =
of
>> certificates.
>=20
>=20
> Given that the pre-existing value of the PKI is much lower for individu=
als
> than for companies/websites, where they all have certs already, buildin=
g a
> Bitcoin-specific or entirely new/independent PKI for people is not so
> unthinkable, I agree.
>=20
> In theory such a cert could be as minimal as:
>=20
> <ECC signature>thomasv@electrum.org
>=20
> so literally just a signature + a UTF-8 string, and that's it! You don'=
t
> need anything more if you're willing to sacrifice extensibility,
> revocability, etc.

Again, we don't have to sacrifice revocability, if the proof is
downloaded separately.

>=20
> The pubkey of the CA would be obtained by running the pubkey recovery
> algorithm on the signature, and then checked against a table of trusted
> pubkeys.
>=20