1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
|
Received: from sog-mx-4.v43.ch3.sourceforge.com ([172.29.43.194]
helo=mx.sourceforge.net)
by sfs-ml-1.v29.ch3.sourceforge.com with esmtp (Exim 4.76)
(envelope-from <pete@petertodd.org>) id 1W2ntt-00013y-Pg
for bitcoin-development@lists.sourceforge.net;
Mon, 13 Jan 2014 20:14:21 +0000
Received-SPF: pass (sog-mx-4.v43.ch3.sourceforge.com: domain of petertodd.org
designates 62.13.148.154 as permitted sender)
client-ip=62.13.148.154; envelope-from=pete@petertodd.org;
helo=outmail148154.authsmtp.co.uk;
Received: from outmail148154.authsmtp.co.uk ([62.13.148.154])
by sog-mx-4.v43.ch3.sourceforge.com with esmtp (Exim 4.76)
id 1W2nts-0001Hn-FU for bitcoin-development@lists.sourceforge.net;
Mon, 13 Jan 2014 20:14:21 +0000
Received: from mail-c235.authsmtp.com (mail-c235.authsmtp.com [62.13.128.235])
by punt15.authsmtp.com (8.14.2/8.14.2/) with ESMTP id s0DKEBNc000722;
Mon, 13 Jan 2014 20:14:11 GMT
Received: from petertodd.org (petertodd.org [174.129.28.249])
(authenticated bits=128)
by mail.authsmtp.com (8.14.2/8.14.2/) with ESMTP id s0DKE8VB030920
(version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NO);
Mon, 13 Jan 2014 20:14:10 GMT
Date: Mon, 13 Jan 2014 15:14:08 -0500
From: Peter Todd <pete@petertodd.org>
To: Alan Reiner <etotheipi@gmail.com>
Message-ID: <20140113201407.GB7941@petertodd.org>
References: <20140106120338.GA14918@savin>
<op.w9c5o7vgyldrnw@laptop-air.hsd1.ca.comcast.net>
<20140110102037.GB25749@savin>
<op.w9kkxcityldrnw@laptop-air.hsd1.ca.comcast.net>
<CABsx9T2G=yqSUGr0+Ju5-z9P++uS20AwLC+c3DnFMHtcQjQK6w@mail.gmail.com>
<CAAS2fgTz0TaGhym_35V3N2-vHVzU9BeuV8q+QJjwh5bg77FEZg@mail.gmail.com>
<20140113194049.GJ38964@giles.gnomon.org.uk>
<CANAnSg30V01B_3LCJ09sTwcsYa4_WOg3sKd-=p6COZS6w0b-uA@mail.gmail.com>
<52D4458C.6010909@gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
protocol="application/pgp-signature"; boundary="8P1HSweYDcXXzwPJ"
Content-Disposition: inline
In-Reply-To: <52D4458C.6010909@gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
X-Server-Quench: 43dc8a18-7c8f-11e3-b802-002590a15da7
X-AuthReport-Spam: If SPAM / abuse - report it at:
http://www.authsmtp.com/abuse
X-AuthRoute: OCd2Yg0TA1ZNQRgX IjsJECJaVQIpKltL GxAVKBZePFsRUQkR
aAdMdwEUElQaAgsB AmIbWVReUVl7WGI7 ag1VcwRfa1RMVxto
VEFWR1pVCwQmQhx1 fWsWNGtydAVPen4+ ZEVjWHEVWEcuJk4s
Q0ZJEj4OM3phaTUc TRJQdwFJcANIexZF O1F6ACIKLwdSbGoL
NQ4vNDcwO3BTJTpY RgYVKF8UXXNDJSIx ThQeHX0GEUEfSj4o IgdO
X-Authentic-SMTP: 61633532353630.1023:706
X-AuthFastPath: 0 (Was 255)
X-AuthSMTP-Origin: 174.129.28.249/587
X-AuthVirus-Status: No virus detected - but ensure you scan with your own
anti-virus system.
X-Spam-Score: -1.5 (-)
X-Spam-Report: Spam Filtering performed by mx.sourceforge.net.
See http://spamassassin.org/tag/ for more details.
-1.5 SPF_CHECK_PASS SPF reports sender host as permitted sender for
sender-domain
-0.0 SPF_PASS SPF: sender matches SPF record
X-Headers-End: 1W2nts-0001Hn-FU
Cc: bitcoin-development@lists.sourceforge.net
Subject: Re: [Bitcoin-development] Stealth Addresses
X-BeenThere: bitcoin-development@lists.sourceforge.net
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: <bitcoin-development.lists.sourceforge.net>
List-Unsubscribe: <https://lists.sourceforge.net/lists/listinfo/bitcoin-development>,
<mailto:bitcoin-development-request@lists.sourceforge.net?subject=unsubscribe>
List-Archive: <http://sourceforge.net/mailarchive/forum.php?forum_name=bitcoin-development>
List-Post: <mailto:bitcoin-development@lists.sourceforge.net>
List-Help: <mailto:bitcoin-development-request@lists.sourceforge.net?subject=help>
List-Subscribe: <https://lists.sourceforge.net/lists/listinfo/bitcoin-development>,
<mailto:bitcoin-development-request@lists.sourceforge.net?subject=subscribe>
X-List-Received-Date: Mon, 13 Jan 2014 20:14:22 -0000
--8P1HSweYDcXXzwPJ
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
On Mon, Jan 13, 2014 at 02:59:08PM -0500, Alan Reiner wrote:
> How is this different from the proposal I have made?
>=20
> You distribute the root public key (but not chaincode!) of a BIP32
> branch. You can put your root key on a business card if you want. Then
> when someone wants to pay you, you simply give them the multiplier and
> root key (they already have the root key, but should verify). The
> multiplier does not reveal the chaincode, thus keeping it private, but
> it does allow them to confirm that the final address they are paying is
> derived from that root key they know belongs to you ("Please pay address
> X; oh btw, X=3DrootKey*mult").
>=20
> You can /choose/ to reveal that a given payment address is linked to
> your root key without any compromise of privacy. Or you can choose to
> ignore it and just give them a bare address the old way and still
> maintain privacy. What advantages does "stealth addresses" have over
> this scheme? You could extend it using some kind of deterministic
> sub-branching and/or ECDH to create multiple payment addresses without
> querying the payee.=20
Basically stealth addresses *are* your scheme, using the blockchain as a
low or even no overhead communication channel for the payor to give the
payee that multiplier without bidirectional communication.
In the business card example I can't easily take your business card and
just send you some money without that transaction being linked to public
information. (your business card)
> I had planned to implement this system and push for people to accept it
> because I don't see any downsides to it. It can easily be integrated
> into a WoT (with signed root keys), or CA system piggybacking on SSL.
WoT is a perfect example of the problem: if you put BIP32 branch payment
info into my OpenPGP key I can't pay you securely and reliably without
making the transaction public. The best I can do is pick a nonce and pay
X=3DrootKey*nonce, communicating to you the nonce later - this isn't
reliable because if I or you lose the nonce the funds are lost.
With stealth addresses the user experience can be as simple as you
telling me on the phone "hey! send me that 0.234 BTC you owe me!", me
clicking on "Send to Alan Reiner (verified by PGP)" (perhaps again on my
off-line second factor device for a multi-sig wallet) and tellling you
"OK, sent".
Even if your phone has been wiretapped, the attacker still didn't learn
exactly what transaction was actually used to make the payment - a big
advantage over per-tx nonce stuff.
--=20
'peter'[:-1]@petertodd.org
00000000000000023d5a8bbe131414328a6c50a2741933ba03775afd3c3db395
--8P1HSweYDcXXzwPJ
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQEcBAEBCAAGBQJS1EkPAAoJEBmcgzuo5/CFUMAIANDvoWtXdbFgtfsxrGnobWM/
J9T2YVjTJa0xeg2dt0efDMwkoYRNGTuQWm4dCxHv9b58qP3JY1UK5FxQjYzzQMUR
fjFKadW0eEyMLCY064IsXTxnGjUBJK/L35LAhbUJ3oSis7zs9FUhzh+lLRLzKNUK
znLAHZdnDxcrMtSL1DciCL3Wc9pXJ48s9G66wsfS6yTAOmayaxFJRC9rb+lTUreu
IZ8kuInaw5Qm7aQV+Trid4e+YtxLzClQgtl2ExQJXlOTIgNcvxwal1cz6AYDYjIM
VGKYfI3hSxahBe2RwiOkaWZaXiWC8fNIf0f7o6neRyXi6fiPaiCRaAKw9GZpOzE=
=d/Sz
-----END PGP SIGNATURE-----
--8P1HSweYDcXXzwPJ--
|
