Received-SPF: pass (sog-mx-1.v43.ch3.sourceforge.com: domain of m.gmane.org
	designates 80.91.229.3 as permitted sender)
	client-ip=80.91.229.3;
	envelope-from=gcbd-bitcoin-development@m.gmane.org;
	helo=plane.gmane.org; 
To: bitcoin-development@lists.sourceforge.net
From: Andreas Schildbach <andreas@schildbach.de>
Date: Mon, 15 Sep 2014 09:12:03 +0200
Message-ID: <lv63g3$q13$1@ger.gmane.org>
References: <mailman.341412.1410515709.2178.bitcoin-development@lists.sourceforge.net>	<A4CC413B-D5A5-423C-9D56-463FCDBDDE08@coinqy.com>	<luuk5f$i8o$1@ger.gmane.org>	<CANEZrP1iTfZxY915hzoAEApz1+wd_S9j5RCwVJCNFqQ_+DNTSQ@mail.gmail.com>	<luv0dp$qms$1@ger.gmane.org>	<CANOOu=8RJgUW+=regOcqa9udiLr=nK=4fiZoW0fj2UU2GCjH3w@mail.gmail.com>	<CANOOu=-yhKK-db+VtoJbWH8H_rwrNHqXM1J12SketBXeLL6L1Q@mail.gmail.com>	<CANEZrP2adsaM8dtA94JV+5qThDNrT8m+X45-q_DecT42i5L=jg@mail.gmail.com>
	<CANEZrP2D9RbMVHS12PnEjXiz7TjjGFDvybOs6+kCb-aZKwXy-A@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: 8bit
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
	rv:31.0) Gecko/20100101 Thunderbird/31.1.1
In-Reply-To: <CANEZrP2D9RbMVHS12PnEjXiz7TjjGFDvybOs6+kCb-aZKwXy-A@mail.gmail.com>
Subject: Re: [Bitcoin-development] BIP72 amendment proposal
Precedence: list

I agree that this would be another way of achieving the same goal. I'd
be fine with that if there is a majority.

However, I also see downsides of this approach:

1. It's more complicated. It touches more BIPs, and although signing is
terribly difficult its still more difficult than just hashing. E.g.
signing the payment request twice (ECC + X.509) poses the question in
which order you sign, and which signature fields to null for signing.

2. Isn't it discouraged to disclose the public key you're going to
receive coins on? (not sure about that)

3. Unlike an hash we can just re-assign to different objects (see my
proposal) I think we cannot easily do the same with a signature. It's
probably not very important to have this option, but still it should be
considered.

4. I'm afraid of the idea of re-purposing the BIP21 address. Someone
might send money to it although it isn't meant to receive money any more
(service is already using an advanced BIP70 usecase). A clear separation
into two parameters would prevent such mistakes, and as soon as the
address can go away the URL needn't be longer than it used to be.

5. A hash can be checked without knowing a secret. Are we excluding
stateless devices (e.g. proxies, smartwatches)?


Generally about the URL length discussion:

Currently we have address, amount and r, and it works well. In future we
would have h and r.

So all we need to do is make sure h not longer than address+amount. I
think this is already the case with untruncated SHA256 hashes. But I'd
be fine with truncating to maybe 192 bits to save a few characters.


On 09/12/2014 06:31 PM, Mike Hearn wrote:
> Putting aside the question of necessity for a moment, a more efficient
> approach to this would be;
> 
>  1. Add another marker param like &s to the end of the URL
>  2. Add another field to PaymentRequest that contains an ECC signature
>     calculated using the public key that hashes to the address in the URI
>  3. Upgraded wallets look for the additional param and if it's there,
>     expect to find the PaymentDetails signed with the address key. PKI
>     signing of course is still useful to provide an actual identity for
>     receipts, display on hardware wallets, dispute mediation etc.
> 
> This adds only a few characters to a normal backwards-compatible QR
> code, and is not hard to implement.
> 
> 
> On Fri, Sep 12, 2014 at 5:37 PM, Mike Hearn <mike@plan99.net
> <mailto:mike@plan99.net>> wrote:
> 
>         That way we leave up to implementers to experiment with different
>         lengths and figure out what the optimum is
> 
> 
>     Ah, that's a good suggestion if we do go this way. 
> 
> 
> 
> 
> ------------------------------------------------------------------------------
> Want excitement?
> Manually upgrade your production database.
> When you want reliability, choose Perforce
> Perforce version control. Predictably reliable.
> http://pubads.g.doubleclick.net/gampad/clk?id=157508191&iu=/4140/ostg.clktrk
> 
> 
> 
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>