Received-SPF: pass (sog-mx-2.v43.ch3.sourceforge.com: domain of gmail.com
	designates 209.85.214.180 as permitted sender)
	client-ip=209.85.214.180; envelope-from=mh.in.england@gmail.com;
	helo=mail-ob0-f180.google.com; 
MIME-Version: 1.0
Sender: mh.in.england@gmail.com
In-Reply-To: <op.xb2352ezyldrnw@laptop-air>
References: <op.xb05iptvyldrnw@laptop-air>
	<op.xb2352ezyldrnw@laptop-air>
Date: Sun, 2 Mar 2014 09:44:21 +0100
Message-ID: <CANEZrP22SF4bD2pA3MyNmAojUmtZ20r=eL2Lgt=Fa4ZJyG=5SA@mail.gmail.com>
From: Mike Hearn <mike@plan99.net>
To: Jeremy Spilman <jeremy@taplink.co>
Content-Type: multipart/alternative; boundary=047d7b41783168435d04f39bad8b
Cc: Bitcoin Dev <bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] Payment Protocol Hash Comments
Precedence: list

--047d7b41783168435d04f39bad8b
Content-Type: text/plain; charset=UTF-8

SHA-1 support is there for PHP developers. Apparently it can't do SHA-2.
On 2 Mar 2014 08:53, "Jeremy Spilman" <jeremy@taplink.co> wrote:

>  From BIP70:
>
>    If pki_type is "x509+sha256", then the Payment message is hashed using
> the
>    SHA256 algorithm to produce the message digest that is signed. If
> pki_type
>    is "x509+sha1", then the SHA1 algorithm is used.
>
> A couple minor comments;
>
>   - I think it meant to say the field to be hashed is 'PaymentRequest' not
> 'Payment' message -- probably got renamed at some point and this is an old
> reference calling it by its original name.
>
>   - Could be a bit more explicit about the hashing, e.g. 'copy the
> PaymentRequest, set the signature field to the empty string, serialize to
> a byte[] and hash.
>
>   - SHA1 is retiring, any particular reason to even have it in there at
> all?
>
>   - Should there any way for the end-user to see details like the pki_type
> and the certificate chain, like browser do?
>
>
> Thanks,
> Jeremy
>
>
>
> ------------------------------------------------------------------------------
> Flow-based real-time traffic analytics software. Cisco certified tool.
> Monitor traffic, SLAs, QoS, Medianet, WAAS etc. with NetFlow Analyzer
> Customize your own dashboards, set traffic alerts and generate reports.
> Network behavioral analysis & security monitoring. All-in-one tool.
>
> http://pubads.g.doubleclick.net/gampad/clk?id=126839071&iu=/4140/ostg.clktrk
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>

--047d7b41783168435d04f39bad8b
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<p dir=3D"ltr">SHA-1 support is there for PHP developers. Apparently it can=
&#39;t do SHA-2.</p>
<div class=3D"gmail_quote">On 2 Mar 2014 08:53, &quot;Jeremy Spilman&quot; =
&lt;<a href=3D"mailto:jeremy@taplink.co">jeremy@taplink.co</a>&gt; wrote:<b=
r type=3D"attribution"><blockquote class=3D"gmail_quote" style=3D"margin:0 =
0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
=C2=A0From BIP70:<br>
<br>
=C2=A0 =C2=A0If pki_type is &quot;x509+sha256&quot;, then the Payment messa=
ge is hashed using<br>
the<br>
=C2=A0 =C2=A0SHA256 algorithm to produce the message digest that is signed.=
 If<br>
pki_type<br>
=C2=A0 =C2=A0is &quot;x509+sha1&quot;, then the SHA1 algorithm is used.<br>
<br>
A couple minor comments;<br>
<br>
=C2=A0 - I think it meant to say the field to be hashed is &#39;PaymentRequ=
est&#39; not<br>
&#39;Payment&#39; message -- probably got renamed at some point and this is=
 an old<br>
reference calling it by its original name.<br>
<br>
=C2=A0 - Could be a bit more explicit about the hashing, e.g. &#39;copy the=
<br>
PaymentRequest, set the signature field to the empty string, serialize to<b=
r>
a byte[] and hash.<br>
<br>
=C2=A0 - SHA1 is retiring, any particular reason to even have it in there a=
t all?<br>
<br>
=C2=A0 - Should there any way for the end-user to see details like the pki_=
type<br>
and the certificate chain, like browser do?<br>
<br>
<br>
Thanks,<br>
Jeremy<br>
<br>
<br>
---------------------------------------------------------------------------=
---<br>
Flow-based real-time traffic analytics software. Cisco certified tool.<br>
Monitor traffic, SLAs, QoS, Medianet, WAAS etc. with NetFlow Analyzer<br>
Customize your own dashboards, set traffic alerts and generate reports.<br>
Network behavioral analysis &amp; security monitoring. All-in-one tool.<br>
<a href=3D"http://pubads.g.doubleclick.net/gampad/clk?id=3D126839071&amp;iu=
=3D/4140/ostg.clktrk" target=3D"_blank">http://pubads.g.doubleclick.net/gam=
pad/clk?id=3D126839071&amp;iu=3D/4140/ostg.clktrk</a><br>
_______________________________________________<br>
Bitcoin-development mailing list<br>
<a href=3D"mailto:Bitcoin-development@lists.sourceforge.net">Bitcoin-develo=
pment@lists.sourceforge.net</a><br>
<a href=3D"https://lists.sourceforge.net/lists/listinfo/bitcoin-development=
" target=3D"_blank">https://lists.sourceforge.net/lists/listinfo/bitcoin-de=
velopment</a><br>
</blockquote></div>

--047d7b41783168435d04f39bad8b--