To: bitcoin-dev@lists.linuxfoundation.org
References: <57B31EBC.1030806@jonasschnelli.ch>
From: Jochen Hoenicke <hoenicke@gmail.com>
Message-ID: <e740b4e0-0597-4f80-2434-70e667b7923c@gmail.com>
Date: Tue, 16 Aug 2016 19:48:27 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
	Thunderbird/45.2.0
MIME-Version: 1.0
In-Reply-To: <57B31EBC.1030806@jonasschnelli.ch>
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature";
	boundary="2fi8orpiGPtbrw8MwaLnOmBxLRpn7uxf7"
Subject: Re: [bitcoin-dev] Hardware Wallet Standard
Precedence: list

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--2fi8orpiGPtbrw8MwaLnOmBxLRpn7uxf7
Content-Type: multipart/mixed; boundary="8wgLWc0SwTfTDeGDWsWVqjewInQutjpFU"
From: Jochen Hoenicke <hoenicke@gmail.com>
To: bitcoin-dev@lists.linuxfoundation.org
Message-ID: <e740b4e0-0597-4f80-2434-70e667b7923c@gmail.com>
Subject: Re: [bitcoin-dev] Hardware Wallet Standard
References: <57B31EBC.1030806@jonasschnelli.ch>
In-Reply-To: <57B31EBC.1030806@jonasschnelli.ch>

--8wgLWc0SwTfTDeGDWsWVqjewInQutjpFU
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable

Hello Jonas,

thanks for your efforts of writing the draft for the standard.

First, this only describes detached signing.  A wallet also needs to
connect with a hardware wallet at some time to learn the xpubs
controlled by the hardware.  Do you plan to have this in a separate
standard or should this also be included here?  Basically one needs one
operation: get xpub for an HD path.

=46rom a first read over the specification I found the following points
missing, that a fully checking hardware wallet needs to know:

- the amount spent by each input (necessary for segwit).
- the full serialized input transactions (without witness informations)
to prove that the amount really matches (this is not necessary for segwit=
)
- the position of the change output and its HD Path (to verify that it
really is a change output).
- For multisig change addresses, there are more extensive checks
necessary:  All inputs must be multisig addresses signed with public
keys derived from the same set of xpubs as the change address and use
the same "m of n" scheme.  So for multisig inputs and multisig change
address the standard should allow to give the parent xpubs of the other
public keys and their derivation paths.

It is also a bit ambiguous what the "inputscript" is especially for p2sh
transactions.  Is this always the scriptPubKey of the transaction output
that is spent by this input? For p2wsh nested in BIP16 p2sh transactions
there are three scripts

    witness:      0 <signature1> <1 <pubkey1> <pubkey2> 2 CHECKMULTISIG>
    scriptSig:    <0 <32-byte-hash>>
                  (0x220020{32-byte-hash})
    scriptPubKey: HASH160 <20-byte-hash> EQUAL
                  (0xA914{20-byte-hash}87)
 (quoted from BIP-141).

In principle one could put witness and scriptSig (with "OP_FALSE" in
places of the signatures) in the raw transaction and make inputscript
always the scriptPubKey of the corresponding output.  Then one also
doesn't need to distinguish between p2pkh or p2sh or p2wpkh or "p2wpkh
nested in bip16 p2sh" transactions.

Regards,
  Jochen


--8wgLWc0SwTfTDeGDWsWVqjewInQutjpFU--

--2fi8orpiGPtbrw8MwaLnOmBxLRpn7uxf7
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iF4EAREIAAYFAlezUgMACgkQ6xfGteURk/VjqgEAiPz/i3THz68bm47vWjYKUHJj
kEicdh6U2tO1t30JsxkA/3X74rvUGxZkMT7o7TDrCUjgF99eiXRaDJjbIqEj56CE
=EkPF
-----END PGP SIGNATURE-----

--2fi8orpiGPtbrw8MwaLnOmBxLRpn7uxf7--