Reusable payment codes

https://github.com/justusranvier/rfc/blob/payment_code/bips/bip-pc01.mediawiki

This link contains an RFC for a new type of Bitcoin address called a "payment code"

Payment codes are SPV-friendly alternatives to DarkWallet-style stealth addresses which provide useful features such as positively identifying senders to recipients and automatically providing for transaction refunds.

Payment codes can be publicly advertised and associated with a real-life identity without causing a loss of financial privacy.

Compared to stealth addresses, payment codes require less blockchain data storage.

Payment codes require 65 bytes of OP_RETURN data per sender-recipient pair, while stealth addresses require 40 bytes per transaction.

On Fri, Apr 24, 2015 at 8:00 PM, Justus Ranvier <justus.ranvier@monetas•net> wrote:

> https://github.com/justusranvier/rfc/blob/payment_code/bips/bip-pc01.mediawiki
>
> This link contains an RFC for a new type of Bitcoin address called a
> "payment code"
>
> Payment codes are SPV-friendly alternatives to DarkWallet-style stealth
> addresses which provide useful features such as positively identifying
> senders to recipients and automatically providing for transaction refunds.

So this requires making dust payments to a constantly reused address in order to (ab)use the blockchain as a messaging layer.

Indeed, this is more SPV compatible; but it seems likely to me that _in practice_ it would almost completely undermine the privacy the idea hoped to provide; because you'd have an observable linkage to a highly reused address.

It would also more than double the data sent for the application where 'stealth addresses' are most important: one-time anonymous donations (in other contexts; you have two way communication between the participants, and so you can just given them a one off address without singling in the public network.)

> Alice selects the first exposed public key of the first input of the transaction

So this creates strong "binding" that we would really strongly like to avoid in the network; basically what this says is that "You can only pay to person X if you use scheme Y for your own Bitcoins"-- who says any of your inputs have a ECDH pubkey at all? Of if they do, who says its one that you have access to the private key for for use in this scheme (e.g. it could be in a HSM that only signs according to a policy). We should avoid creating txout features that restrict what kind of scriptPubkey the sender can use, or otherwise we'll never be able to deploy new signature features. (We can see how long P2SH took to gain adoption because some wallets refused to implement sending to it, even though doing so was trivial).

This kind of binding was intentionally designed out of the stealth address proposal; I think this scheme can be made to work without any increase in size by reusing the payment code as the ephemeral public key (or actually being substantially smaller e.g. use the shared secret as the chain code, but I should give it more thought)

Also, SPV wallets do not need to have access to the public keys being spent by a particular transaction they learn about; providing that access is fundamentally expensive and pushes things back towards centralization.

> in uncompressed DER format

This is fundamentally more expensive to compute; please don't specify "uncompressed".

This appears incompatible with multisignature; which is unfortunate.

I do very much like the fact that this scheme establishes a shared chain once and then doesn't need to reestablish; this was one of the improvements I wanted for the stealth address.

I'm disappointed that there isn't any thought given to solving the scanning privacy without forcing non-private pure-overhead messaging transactions on heavily reused addresses. Are you aware of the IBE approach that allows someone to request a third party scan for them with block by block control over their delegation of scanning?

On Fri, Apr 24, 2015 at 10:58 PM, Gregory Maxwell <gmaxwell@gmail•com> wrote:

> So this requires making dust payments to a constantly reused address
> in order to (ab)use the blockchain as a messaging layer.
>
> Indeed, this is more SPV compatible; but it seems likely to me that
> _in practice_ it would almost completely undermine the privacy the
> idea hoped to provide; because you'd have an observable linkage to a
> highly reused address.
>

I agree that the output associated with notification transactions would require special handling to avoid privacy leaks. At a minimum they'd require mixing or being donated to miners as a transaction fee.

>
> It would also more than double the data sent for the application where
> 'stealth addresses' are most important: one-time anonymous donations
> (in other contexts; you have two way communication between the
> participants, and so you can just given them a one off address without
> singling in the public network.)
>

Communication is only one way, except for the case in which the recipient wants to send a refund. Assuming no refund and only a single anonymous donation in the lifetime of the sender's identity, payment codes would require 65 bytes vs 40 bytes for stealth addresses.

As soon as the sender sends more than one donation to the same recipient, payment codes show an space advantage over stealth addresses.

This kind of binding was intentionally designed out of the stealth

>

address proposal; I think this scheme can be made to work without any

> increase in size by reusing the payment code as the ephemeral public
> key (or actually being substantially smaller e.g. use the shared
> secret as the chain code, but I should give it more thought)
>

With 97 byte standard OP_RETURN values the ephemeral public key could be appended to the chain code, but that's undesirable for other reasons.

This is fundamentally more expensive to compute; please don't specify

> "uncompressed".
>

Taking the SHA512 of something less than 512 bits seemed wrong.

> This appears incompatible with multisignature; which is unfortunate.
>

I agree. I could not find a straightforward way to express a multisignature payment code in less than 80 bytes.

> I'm disappointed that there isn't any thought given to solving the
> scanning privacy without forcing non-private pure-overhead messaging
> transactions on heavily reused addresses. Are you aware of the IBE
> approach that allows someone to request a third party scan for them
> with block by block control over their delegation of scanning?
>

I suspect this is a case where we just can't have all the features we want.

In this proposal I optimized for non-reliance on third party services and a guaranteed ability to recover spendable funds from a seed backup.

Gaining those two features resulted in some tradeoffs as you noted, but I think there are enough benefits to make them worthwhile.

In particular, payment codes could be the basis for a Heartbleed-free payment protocol that can positively identify customers and automatically provide refund capabilities in a merchant-customer relationship. A merchant only requires one payment code which they can safely use for all their customers, meaning they only ever need to associate 65 bytes with their identity to allow customers to make sure they are paying the right entity.

Exchanges could restrict bitcoin withdrawals to a single payment code known to be associated with their identified customer. This would make thefts easier (without involving address reuse as in locking withdrawals to a single P2PKH address).

In some jurisdictions the ability to prove that withdrawals are sent to a positively-identified party, rather than arbitrary third parties, might move some Bitcoin businesses out of money transmitter territory into less onerous regulatory situations.

I have pushed an updated version of the proposal which incorporates some of the received feedback and adds a note about the consequences of sharing a payment code-enabled walled on multiple devices:

https://github.com/justusranvier/rfc/blob/payment_code/bips/bip-pc01.mediawiki

https://github.com/justusranvier/rfc/commit/8c4d3429012eb15847c4ae68f212c8b2dcd1b521

On Sat, Apr 25, 2015 at 12:21 AM, Justus Ranvier <justus.ranvier@monetas•net

> wrote:

>
>
> On Fri, Apr 24, 2015 at 10:58 PM, Gregory Maxwell <gmaxwell@gmail•com>
> wrote:
>
>> So this requires making dust payments to a constantly reused address
>> in order to (ab)use the blockchain as a messaging layer.
>>
>> Indeed, this is more SPV compatible; but it seems likely to me that
>> _in practice_ it would almost completely undermine the privacy the
>> idea hoped to provide; because you'd have an observable linkage to a
>> highly reused address.
>>
>
> I agree that the output associated with notification transactions would
> require special handling to avoid privacy leaks. At a minimum they'd
> require mixing or being donated to miners as a transaction fee.
>
>
>>
>> It would also more than double the data sent for the application where
>> 'stealth addresses' are most important: one-time anonymous donations
>> (in other contexts; you have two way communication between the
>> participants, and so you can just given them a one off address without
>> singling in the public network.)
>>
>
> Communication is only one way, except for the case in which the recipient
> wants to send a refund. Assuming no refund and only a single anonymous
> donation in the lifetime of the sender's identity, payment codes would
> require 65 bytes vs 40 bytes for stealth addresses.
>
> As soon as the sender sends more than one donation to the same recipient,
> payment codes show an space advantage over stealth addresses.
>
> This kind of binding was intentionally designed out of the stealth
>>
> address proposal;  I think this scheme can be made to work without any
>> increase in size by reusing the payment code as the ephemeral public
>> key (or actually being substantially smaller e.g. use the shared
>> secret as the chain code, but I should give it more thought)
>>
>
> With 97 byte standard OP_RETURN values the ephemeral public
> key could be appended to the chain code, but that's undesirable for other
> reasons.
>
> This is fundamentally more expensive to compute; please don't specify
>> "uncompressed".
>>
>
> Taking the SHA512 of something less than 512 bits seemed wrong.
>
>
>> This appears incompatible with multisignature; which is unfortunate.
>>
>
> I agree. I could not find a straightforward way to express a
> multisignature payment code in less than 80 bytes.
>
>
>> I'm disappointed that there isn't any thought given to solving the
>> scanning privacy without forcing non-private pure-overhead messaging
>> transactions on heavily reused addresses. Are you aware of the IBE
>> approach that allows someone to request a third party scan for them
>> with block by block control over their delegation of scanning?
>>
>
> I suspect this is a case where we just can't have all the features we want.
>
> In this proposal I optimized for non-reliance on third party services and
> a guaranteed ability to recover spendable funds from a seed backup.
>
> Gaining those two features resulted in some tradeoffs as you noted, but I
> think there are enough benefits to make them worthwhile.
>
> In particular, payment codes could be the basis for a Heartbleed-free
> payment protocol that can positively identify customers and automatically
> provide refund capabilities in a merchant-customer relationship. A merchant
> only requires one payment code which they can safely use for all their
> customers, meaning they only ever need to associate 65 bytes with their
> identity to allow customers to make sure they are paying the right entity.
>
> Exchanges could restrict bitcoin withdrawals to a single payment code
> known to be associated with their identified customer. This would make
> thefts easier (without involving address reuse as in locking withdrawals to
> a single P2PKH address).
>
> In some jurisdictions the ability to prove that withdrawals are sent to a
> positively-identified party, rather than arbitrary third parties, might
> move some Bitcoin businesses out of money transmitter territory into less
> onerous regulatory situations.
>
>

Taking the hash of the secret would then require an extra step to make sure the hash is valid for secp256k1.

Using the x value directly avoids the need for that check.

On Fri, Apr 24, 2015 at 10:35 PM, Patrick Mccorry (PGR) < patrick.mccorry@newcastle•ac•uk> wrote:

>  When computing the diffie Hellman secret - why do you choose the x
> co-ordinate instead of the hash of the secret which is standard practice
> for stealth addresses
>
> Sent from my iPhone
>
> On 24 Apr 2015, at 21:27, Justus Ranvier <justus.ranvier@monetas•net>
> wrote:
>
>   -----BEGIN PGP SIGNED MESSAGE-----
>
> Hash: SHA1
>
>
>
> https://github.com/justusranvier/rfc/blob/payment_code/bips/bip-pc01.mediawiki
>
>
>  This link contains an RFC for a new type of Bitcoin address called a
> "payment code"
>
>
>  Payment codes are SPV-friendly alternatives to DarkWallet-style stealth
> addresses which provide useful features such as positively identifying
> senders to recipients and automatically providing for transaction refunds.
>
>
>  Payment codes can be publicly advertised and associated with a real-life
> identity without causing a loss of financial privacy.
>
>
>  Compared to stealth addresses, payment codes require less blockchain
> data storage.
>
>
>  Payment codes require 65 bytes of OP_RETURN data per sender-recipient
> pair, while stealth addresses require 40 bytes per transaction.
>
>
>  -----BEGIN PGP SIGNATURE-----
>
> Version: GnuPG v1
>
>
>  iQIcBAEBAgAGBQJVOqCRAAoJECpf2nDq2eYjluEP/RVJk+miDIihY4ilIvUbKvMd
>
> JLLqHr7Q1dlZyMIG/UqVWdoP5hzg/16B+q2iAB9jXozPnrDp0mggBh6rIGroevAa
>
> Kqfrs+Rrog1w9auhd67LWORDqav6YIrjTJIxdLxe11IEiq5rWbHPNUEDMzdEmHbz
>
> QfTH7KWAP2BasO5ETXcfu6BcccrXZ3XOKLON2h3NGD/cEDizY+uT2k3QN54z+KxG
>
> NB9scKbzVvsJwkyBrgbV+As9H3k6PnFsojYgAaE9gkp7D2+ahjzUiOH5rv6TbbYR
>
> o2X5MOiTY2/YZEqZPG7IR03ZAgeLVCvXXysjPOfzUKbmTF4w849sm8BuhixzDXHo
>
> 2V/HHKoGclIohcODBCWi0tVQXshZt4QkCNJBW5o3nL6Nn2YOp6hmw8YKAHnw3E7h
>
> /wIgk5f+NOLl/iIxoAxAdavEj5P6N4ic+OB6MAjnhEilWfBvCIpqWLGNvrtOhEa9
>
> EnPHcgb4ILBu4OionJhsNpJ/O95C0OEypMm25MIS+rQcV4Uxe5IOS2OuT/GreLET
>
> n/7Y0mJbqYbLBjVsfS+DNjvsgyJl5AxhcMrdVyXJjSYVcCoRhcoX5Ceidd+YkbHI
>
> OMs5f63tM1Rgi/WY4Ct80SD5EbULZuu8j1KJ9HPGuMt081JSBH+L5isiKuazPeO+
>
> SGApMBd4Q89fKzL2djae
>
> =Dypr
>
> -----END PGP SIGNATURE-----
>
>
> ------------------------------------------------------------------------------
> One dashboard for servers and applications across Physical-Virtual-Cloud
> Widest out-of-the-box monitoring support with 50+ applications
> Performance metrics, stats and reports that give you Actionable Insights
> Deep dive visibility with transaction tracing using APM Insight.
> http://ad.doubleclick.net/ddm/clk/290420510;117567292;y
>
>  _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development@lists•sourceforge•net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>
>

On Sat, Apr 25, 2015 at 3:30 AM, Gregory Maxwell <gmaxwell@gmail•com> wrote:

> On Sat, Apr 25, 2015 at 12:22 AM, Justus Ranvier
> <justus.ranvier@monetas•net> wrote:
> > Taking the hash of the secret would then require an extra step to make
> sure
> > the hash is valid for secp256k1.
>
> The x value may not be a valid member of the group, effectively the
> same as with a hash. Its also very unequally distributed, as only
> about half the possible values are points on the curve.

ack

> > With 97 byte standard OP_RETURN values the ephemeral public
> > key could be appended to the chain code, but that's undesirable for
> other reasons.
>
> Can you elaborate?  Storing a ~33 byte (deterministically generated)
> ephemeral key should be all that is required. Everything else,
> including the chain code could be derived from it. What reason do you
> have to include additional data?
>

The goal of the notification transaction is to send the same payment code to every recipient, but obscure the identity of the sender of the notification transaction from third party blockchain observers.

The shared secret is used for that purpose, and the sender's public key used for ECDH can't be one derived from the payment code since the recipient doesn't yet know the payment code.

The notification transaction needs to communicate the 65 byte payment code along with one ephemeral public key used for ECDH. If that ephemeral key is not located in a signature script, it has to be somewhere else (such as in the same OP_RETURN output as the payment code.)

> > Taking the SHA512 of something less than 512 bits seemed wrong.
>
> Why should it?  Adding the Y does not increase the entropy at all.  As
> an aside, I think this can be reformulated to only need 256 bits of
> output, and then the need for yet-another-hash-function could be
> avoided in some cases.
>

Already fixed in https://github.com/justusranvier/rfc/commit/8c4d3429012eb15847c4ae68f212c8b2dcd1b521 but it would be good to get confirmation of whether the way I fixed it is valid.

> In this proposal I optimized for non-reliance on third party services
>
> The requirement for inputs is a guaranteed dependency on third party
> services; so if thats whats being optimized for here it must go (well,
> I think it must go for the reason of avoiding blocking users from
> using other schemes to control their coins too..).
>

I'm not sure what you mean by "the requirement for inputs is a guaranteed dependency on third party services"

At the proposal currently stands, an SPV wallet will have no trouble sending or receiving notification transactions without access to a third party service. The recipient just needs to see the transactions associated with its notification address.

The point about restricting the types of scripts used as inputs is valid, but I think workarounds are available. If nothing else, the sender can make a suitable input using it's own (suitably mixed) coins first.

> I agree. I could not find a straightforward way to express a
> multisignature payment code in less than 80 bytes.
>
> A prior stealth address proposal here handled them fine with only a
> single ephemeral point in the op_return. It does result in a longer
> address (is that what you're referring to with '80 bytes'?)
>

I considered defining an additional path level for deterministic m-of-n multisig and adding a few bytes to the payment code to express those parameters, but thought it would be too limiting since it would preclude multisig with truly independent keys. It is a thing that could be done, however.

> Exchanges could restrict bitcoin withdrawals to a single payment code
> known to be associated with their identified customer.
> > In some jurisdictions the ability to prove that withdrawals are sent to
> a positively-identified party, rather than arbitrary third parties, might
> move some Bitcoin businesses out of money transmitter territory into less
> onerous regulatory situations.
>
> But this mandates horrible key management practices, reliance on a
> single "hardcoded" private key which you cannot change; even if it
> might be compromised or lost to the wind. It's less horrible than
> sticking to a single address because it doesn't wedge privacy, I
> agree; but care should be taken that a tortured dance for confused
> regulatory cargo-cult reasons doesn't mandate people not engage in
> sound practices like periodic key rotation. :)
>

Cold storage is still available (if admittedly less convenient than in traditional wallets).

I would expect exchanges in practice to allow for payment codes to be changed, just with non-trivial waiting periods and plenty of human overview. It would be an infrequent event compared to the frequency of withdrawals.

Various schemes which use public key authentication instead of passwords for web site authentication could be used to continually verify that the user hasn't lost access to the key.

Could you maybe write a short bit of text comparing this approach to extending BIP70 and combining it with a simple Subspace style store-and-forward network?

Payment codes establish the identity of the payer and allow for simpler methods for identifying the payee, and automatically provide the payee with the information they need to send a refund.

If merchants and customers were using payment codes, they would not need the BIP70 equivalents.

I think the best way to explain payment codes is that they add the missing "from address" to transactions which users want, but we've had to tell them they can't have.

A payment code behaves much more like an email address than a traditional Bitcoin address.

On Sun, Apr 26, 2015 at 2:58 PM, Mike Hearn <mike@plan99•net> wrote:

> Could you maybe write a short bit of text comparing this approach to
> extending BIP70 and combining it with a simple Subspace style
> store-and-forward network?
>

Hi Justus:

CC'ing mailing list because more bloom filter and HD wallet experts there can chime in for some of these thoughts. I refined some ideas we went over earlier.

Here are some critiques/worries about the payment codes.

With identities explicitly tied to a payment code, bloom filter clients can have identities tied to them.

1. There will be a 1:1 relationship between a payment code owner and their identity. Presumably the payment code would be strongly and publicly tied to the identity. This makes the notification address strongly tied to the user. An SPV client connecting to a full node who has a list of notification address can tie an identity to a bloom filter and connecting IP.

2. The client can use a bloom filter with a higher false positive rate. An active attacker can counter that by sending several payment codes to an individual user. The user would then add to their bloom filter all the shared addresses between them and the attacker. Even with a high false positive filter, always matching all the attacker's payment codes would strongly tie the user to the filter.

Here are some data savings and privacy addition ideas:

65 bytes -> 0 bytes extra.

1. Can you choose only even or odd DER encoding? That would save you 1 byte. This would probably throw out 50% of possible addresses though. 2. Can the chain code be fixed or derived from the x value? Could the chain value be the x value itself? (The main question is can a deterministic public seed be represented as a single 32 bit number? Maybe the chain code can be a constant. Maybe it is ok since subsequent pubkeys are derived from this. I only know enough crypto to be dangerous.) That would save you 32 bytes. Someone who understands HD wallets would be better to look at this one. it would probably be a non-standard derivation.

That leaves you with 32 bytes to communicate to bootstrap the channel.

3: Since you are already looking at the pubkey of the transaction sending the notification transaction, then you are assuming control of the sending mechanism. If you can be sure to use a disposable bitcoin address to send the notification, then 1 more savings might be possible. Also assuming the above two points are possible.

Can you encode the "x value" into the signature's R value? This would basically make this transaction look like a standard bitcoin transaction and gets rid of the op_return completely.

I still like the idea of a common meeting point, a la bitmessage. The receiver of the payment code would trial-decode all payment codes sent to a common pre-specified dead drop address (perhaps a charity address). "to send me money, first donate to this charity of my choice." This trades off more work on the receivers part to get some privacy as to the number of people interacting with that receiver.

-cheers -Brian Deery

On 04/27/2015 02:53 PM, Brian Deery wrote:

> 1. There will be a 1:1 relationship between a payment code owner
> and their identity.  Presumably the payment code would be strongly
> and publicly tied to the identity.  This makes the notification
> address strongly tied to the user.  An SPV client connecting to a
> full node who has a list of notification address can tie an
> identity to a bloom filter and connecting IP.

SPV clients that connect exclusively to hidden services through Tor could mitigate this, especially if those clients broadcast their transactions through different peers than the ones they use for checking their balance.

Maybe they should even go the opposite way in terms of the false positive rate.

A client could create a filter that *only* matches their notification address and use that filter with a selected peer.

All the rest of their addresses would be contained in a different filter that is never sent to the same full node which is watching their notification address.

> 2. The client can use a bloom filter with a higher false positive
> rate.  An active attacker can counter that by sending several
> payment codes to an individual user.  The user would then add to
> their bloom filter all the shared addresses between them and the
> attacker.  Even with a high false positive filter, always matching
> all the attacker's payment codes would strongly tie the user to the
> filter.

I'm not sure this problem is solvable in general.

Any entity which has sent bitcoins to a known user could use that knowledge to attempt to find their bloom filter (if they use one).

I think that for SPV to have any privacy at all clients need to get a lot smarter about how they use bloom filters overall, such as by connecting to more than one peer, only putting a subset of their addresses in a single filter, and temporally varying the addresses which they watch.

- --
Justus Ranvier                   | Monetas <http://monetas.net/>
<mailto:justus@monetas.net>      | Public key ID : C3F7BB2638450DB5
                                 | BM-2cTepVtZ6AyJAs2Y8LpcvZB8KbdaWLwKqc

>
> 1. There will be a 1:1 relationship between a payment code owner and their
> identity.
>

Bear in mind, the spec defines "identity" to mean:

     *Identity is a particular extended public/private key pair. *

So that's not quite what is meant normally by identity. It's not a government / real name identity or an email address or phone number kind of identity.

On 04/27/2015 04:46 PM, Mike Hearn wrote:

> So that's not quite what is meant normally by identity. It's not a
> government / real name identity or an email address or phone number
> kind of identity.

I expect that mappings would begin to develop between payment codes and government / real name identities, at least as far as that businesses which are required to collect that kind of information would associate it with the payment code(s) known to be used by their customers for their own use.

I proposed payment codes in this form because I'd rather see that kind of mapping be limited to the application layer and kept away from the blockchain/network layer.

Even if it makes certain kind of application-layer distasteful behavior easier, it's a good trade if doing so can simultaneously provide resistance to graph analysis and make transaction-level censorship more difficult.

- --
Justus Ranvier                   | Monetas <http://monetas.net/>
<mailto:justus@monetas.net>      | Public key ID : C3F7BB2638450DB5
                                 | BM-2cTepVtZ6AyJAs2Y8LpcvZB8KbdaWLwKqc

The notification transactions are a pain point when it comes to privacy, and yet they must exist in order to to ensure that nobody can lose their money as long as they back up their wallet seed.

They could be treated as a backup, however, that clients would not normally rely upon

On 04/27/2015 02:53 PM, Brian Deery wrote:

> 1. There will be a 1:1 relationship between a payment code owner
> and their identity.  Presumably the payment code would be strongly
> and publicly tied to the identity.  This makes the notification
> address strongly tied to the user.  An SPV client connecting to a
> full node who has a list of notification address can tie an
> identity to a bloom filter and connecting IP.

I've updated the proposal to provide for alternate methods of notification that can be used *in addition to* notification transactions.

This frees the sender from constantly monitoring an address known to be associated with their identity, although they should check it periodically since not all senders will be capable of using every type of alternate notification method.

I defined a Bitmessage notification method as an example; more can be added if required.

https://github.com/justusranvier/rfc/blob/payment_code/bips/bip-pc01.mediawiki

This is very well done.

Have you seen this discussion that I started regarding BIP 63?

https://bitcointalk.org/index.php?topic=1083961.0

I have no response from Peter Todd back on it other than "my time is better spent focusing on more fundemental issues" and "I've also got no-one interested in funding stealth address development right now," when several people (myself included) offered to send donations to see the BIP (63) advance, no donation address was posted, so... waiting for him to act on that.

I'm definitely supportive of seeing what you've written up here as Reusable payment codes move to draft in https://github.com/bitcoin/bips When you can, please write up something on bitcointalk as well.

On 04/24/2015 01:00 PM, Justus Ranvier wrote:

> Hash: SHA1
>
>
> https://github.com/justusranvier/rfc/blob/payment_code/bips/bip-pc01.m

ediawiki

>
>
>
> This link contains an RFC for a new type of Bitcoin address called
> a "payment code"
>
>
> Payment codes are SPV-friendly alternatives to DarkWallet-style
> stealth addresses which provide useful features such as positively
> identifying senders to recipients and automatically providing for
> transaction refunds.
>
>
> Payment codes can be publicly advertised and associated with a
> real-life identity without causing a loss of financial privacy.
>
>
> Compared to stealth addresses, payment codes require less
> blockchain data storage.
>
>
> Payment codes require 65 bytes of OP_RETURN data per
> sender-recipient pair, while stealth addresses require 40 bytes per
> transaction.
>
>
>
>
>
> ----------------------------------------------------------------------

- --------

>
>

One dashboard for servers and applications across Physical-Virtual-Cloud

> Widest out-of-the-box monitoring support with 50+ applications
> Performance metrics, stats and reports that give you Actionable
> Insights Deep dive visibility with transaction tracing using APM
> Insight. http://ad.doubleclick.net/ddm/clk/290420510;117567292;y
>
>
>
> _______________________________________________ Bitcoin-development
> mailing list Bitcoin-development@lists•sourceforge•net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>

- -- http://abis.io ~ "a protocol concept to enable decentralization and expansion of a giving economy, and a new social good" https://keybase.io/odinn

On Tue, Jun 16, 2015 at 09:26:07AM -0700, odinn wrote:

> This is very well done.
>
> Have you seen this discussion that I started regarding BIP 63?
>
> https://bitcointalk.org/index.php?topic=1083961.0
>
> I have no response from Peter Todd back on it other than "my time is
> better spent focusing on more fundemental issues" and "I've also got
> no-one interested in funding stealth address development right now,"
> when several people (myself included) offered to send donations to see
> the BIP (63) advance, no donation address was posted, so... waiting
> for him to act on that.

Sorry, but I'm looking at the huge amount of work that I'll likely have responding to the blocksize issue, so I think I'm inclined to shelve work on BIP63 for now.

Feel free to take it up; a (>=2)-part standard describing the resuable codes aspect, and separately how the ephemeral key is transmitted to the recipient makes sense to me.

Peter, my response below

On 06/16/2015 10:46 AM, Peter Todd wrote:

> On Tue, Jun 16, 2015 at 09:26:07AM -0700, odinn wrote:
>> This is very well done.
>>
>> Have you seen this discussion that I started regarding BIP 63?
>>
>> https://bitcointalk.org/index.php?topic=1083961.0
>>
>> I have no response from Peter Todd back on it other than "my time is
>> better spent focusing on more fundemental issues" and "I've also got
>> no-one interested in funding stealth address development right now,"
>> when several people (myself included) offered to send donations to se

e

>> the BIP (63) advance, no donation address was posted, so... waiting
>> for him to act on that.
>
> Sorry, but I'm looking at the huge amount of work that I'll likely hav

e

> responding to the blocksize issue, so I think I'm inclined to shelve
> work on BIP63 for now.

I seriously find this pretty sad... you said that paying rent was an issue and your time was better spent on "more fundamental issues..." but the very least you could do is post a donation address... Is there someone who was working with you closely on the concept who could take it up since you are not going to be working on it?

>
> Feel free to take it up; a (>=2)-part standard describing the resuable
> codes aspect, and separately how the ephemeral key is transmitted to t

he

> recipient makes sense to me.
>

I don't want to camp on Justus's thread on reusable payment codes ~ but on the subject of BIP 63, it just did make sense to mention... so if someone does have interest in working on it... please go to https://bitcointalk.org/index.php?topic=1083961.0 and reply there.

- -- http://abis.io ~ "a protocol concept to enable decentralization and expansion of a giving economy, and a new social good" https://keybase.io/odinn

On Friday, April 24, 2015 8:00:46 PM Justus Ranvier wrote:

> This link contains an RFC for a new type of Bitcoin address called a
> "payment code"

Sorry for the late review. I'm concerned with the "notification address" requirement, which entails address reuse and blockchain spam. Since it entails address reuse, the recipient is forced to either leave them unspent forever (bloating the UTXO set), or spend it which potentially compromises the private key, and (combined with the payment code) possibly as much as the entire wallet.

Instead, I suggest making it a single zero-value OP_RETURN output with two pushes: 1) a hash of the recipient's payment code, and 2) the encrypted payment code. This can be searched with standard bloom filters, or indexed with whatever other optimised algorithms are desired. At the same time, it never uses any space in the UTXO set, and never needs to be spent/mixed/dusted.

Luke

On 22/10/15 00:53, Luke Dashjr wrote:

> Sorry for the late review. I'm concerned with the "notification address"
> requirement, which entails address reuse and blockchain spam. Since it entails
> address reuse, the recipient is forced to either leave them unspent forever
> (bloating the UTXO set), or spend it which potentially compromises the private
> key, and (combined with the payment code) possibly as much as the entire
> wallet.
>
> Instead, I suggest making it a single zero-value OP_RETURN output with two
> pushes: 1) a hash of the recipient's payment code, and 2) the encrypted
> payment code. This can be searched with standard bloom filters, or indexed
> with whatever other optimised algorithms are desired. At the same time, it
> never uses any space in the UTXO set, and never needs to be
> spent/mixed/dusted.

The notification transaction portion is my least-favorite portion of the spec, but I don't see any alternatives that provide an unambiguous improvement, including your suggestion.

One of the most highly-weighted goals of this proposal is to be usable on as many mobile/light wallets as possible.

I know for sure that all existing platforms for balance querying index by address. Support for bloom filters or other querying methods is less comprehensive, meaning the set of wallets that can support payment codes would be smaller.

On Thursday, October 22, 2015 2:55:14 PM Justus Ranvier wrote:

> On 22/10/15 00:53, Luke Dashjr wrote:
> > Sorry for the late review. I'm concerned with the "notification address"
> > requirement, which entails address reuse and blockchain spam. Since it
> > entails address reuse, the recipient is forced to either leave them
> > unspent forever (bloating the UTXO set), or spend it which potentially
> > compromises the private key, and (combined with the payment code)
> > possibly as much as the entire wallet.
> >
> > Instead, I suggest making it a single zero-value OP_RETURN output with
> > two pushes: 1) a hash of the recipient's payment code, and 2) the
> > encrypted payment code. This can be searched with standard bloom
> > filters, or indexed with whatever other optimised algorithms are
> > desired. At the same time, it never uses any space in the UTXO set, and
> > never needs to be
> > spent/mixed/dusted.
>
> The notification transaction portion is my least-favorite portion of the
> spec, but I don't see any alternatives that provide an unambiguous
> improvement, including your suggestion.
>
> One of the most highly-weighted goals of this proposal is to be usable
> on as many mobile/light wallets as possible.
>
> I know for sure that all existing platforms for balance querying index
> by address. Support for bloom filters or other querying methods is less
> comprehensive, meaning the set of wallets that can support payment codes
> would be smaller.

No, they just need to improve their software, and only to support receiving with payment codes (not sending to them). BIPs should in general not be designed around current software, especially in this case where there is no benefit to doing so (since it requires software upgrades anyway).

Luke

On 22/10/15 15:43, Luke Dashjr wrote:

> BIPs should in general not be
> designed around current software

I strongly disagree with this statement.

There is a version byte in the payment code specification for a reason.

Version 1 payment codes are designed to be deployable by wallet implementers today, without requiring them to wait on any network-level changes whatsoever, which includes IsStandard() redefinitions, or yet-to-be-invented-and-deployed filtering schemes.

As far as I know, multi-push OP_RETURN outputs are not standard transactions and so wallet users can not rely on transactions containing them to be relayed through the network, therefore any improvement to the protocol which requires that feature is not appropriate for version 1.

When additional capabilities are deployed in the network such that Bitcoin users can rely on their existence, that would be a great time to specify a version 2 payment code that uses those features and encourage users to upgrade (which should be a fairly smooth process since their actual keys don't need to change).

The consequence of previous ECDH address proposals "not designing around current software" is a sustained ~70% of transactions reusing addresses, as you saw in my Reddit post recently.

If you have a fear that an inferior proposal will gain popularity, you can always propose a superior one. If it's *actually* superior, it will win out.

On Thu, Oct 22, 2015 at 4:43 PM, Luke Dashjr via bitcoin-dev < bitcoin-dev@lists•linuxfoundation•org> wrote:

> On Thursday, October 22, 2015 2:55:14 PM Justus Ranvier wrote:
> > On 22/10/15 00:53, Luke Dashjr wrote:
> > > Sorry for the late review. I'm concerned with the "notification
> address"
> > > requirement, which entails address reuse and blockchain spam. Since it
> > > entails address reuse, the recipient is forced to either leave them
> > > unspent forever (bloating the UTXO set), or spend it which potentially
> > > compromises the private key, and (combined with the payment code)
> > > possibly as much as the entire wallet.
> > >
> > > Instead, I suggest making it a single zero-value OP_RETURN output with
> > > two pushes: 1) a hash of the recipient's payment code, and 2) the
> > > encrypted payment code. This can be searched with standard bloom
> > > filters, or indexed with whatever other optimised algorithms are
> > > desired. At the same time, it never uses any space in the UTXO set, and
> > > never needs to be
> > > spent/mixed/dusted.
> >
> > The notification transaction portion is my least-favorite portion of the
> > spec, but I don't see any alternatives that provide an unambiguous
> > improvement, including your suggestion.
> >
> > One of the most highly-weighted goals of this proposal is to be usable
> > on as many mobile/light wallets as possible.
> >
> > I know for sure that all existing platforms for balance querying index
> > by address. Support for bloom filters or other querying methods is less
> > comprehensive, meaning the set of wallets that can support payment codes
> > would be smaller.
>
> No, they just need to improve their software, and only to support receiving
> with payment codes (not sending to them). BIPs should in general not be
> designed around current software, especially in this case where there is no
> benefit to doing so (since it requires software upgrades anyway).
>
> Luke
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists•linuxfoundation•org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>

On Thursday, October 22, 2015 8:58:58 PM Justus Ranvier wrote:

> I strongly disagree with this statement.

Well, I strongly disagree with adopting the BIP as it stands.

> Version 1 payment codes are designed to be deployable by wallet
> implementers today, without requiring them to wait on any network-level
> changes whatsoever, which includes IsStandard() redefinitions, or
> yet-to-be-invented-and-deployed filtering schemes.

No, those are not network-level changes. They are mere software changes that can be deployed along with the rest of the proposal.

> As far as I know, multi-push OP_RETURN outputs are not standard
> transactions and so wallet users can not rely on transactions containing
> them to be relayed through the network, therefore any improvement to the
> protocol which requires that feature is not appropriate for version 1.

"Standard" means defined in a BIP. To date, there are no standard transactions using OP_RETURN period. IsStandard is a node policy that should have no influence on future BIPs.

> When additional capabilities are deployed in the network such that
> Bitcoin users can rely on their existence, that would be a great time to
> specify a version 2 payment code that uses those features and encourage
> users to upgrade (which should be a fairly smooth process since their
> actual keys don't need to change).

Such changes should not be made until there is a standard for them.

Luke

On 22/10/15 16:47, Luke Dashjr wrote:

> Well, I strongly disagree with adopting the BIP as it stands.

That's fine. Nobody is required to adopt an informational BIP if they do not wish to do so.

> No, those are not network-level changes. They are mere software changes that
> can be deployed along with the rest of the proposal.

They are "mere software changes" outside the control of the users and wallet developers who may wish to use and implement payment codes, so are indistinguishable from a network-level change.

> "Standard" means defined in a BIP. To date, there are no standard
> transactions using OP_RETURN period. IsStandard is a node policy that should
> have no influence on future BIPs.

Since Bitcoin Core 0.11, 80 byte OP_RETURN transactions are standard, so that's what payment codes use:

https://github.com/bitcoin/bitcoin/commit/fcf646c

Whether or not it "should" have an influence, it is an absolute fact that Bitcoin users are affected by it.

A user whose transactions are not relayed or mined doesn't care about the politics surrounding node policy.

Designing standards without putting the needs of its intended users first is a great way to see the standard fail.

> Such changes should not be made until there is a standard for them.

Have you ever heard the term "permissionless innovation" by chance? Particularly in reference to Bitcoin?

If you don't like payment codes, then don't use them.

On Thu, Oct 22, 2015 at 03:58:58PM -0500, Justus Ranvier via bitcoin-dev wrote:

> On 22/10/15 15:43, Luke Dashjr wrote:
> > BIPs should in general not be
> > designed around current software
>
> I strongly disagree with this statement.
>
> There is a version byte in the payment code specification for a reason.
>
> Version 1 payment codes are designed to be deployable by wallet
> implementers today, without requiring them to wait on any network-level
> changes whatsoever, which includes IsStandard() redefinitions, or
> yet-to-be-invented-and-deployed filtering schemes.
>
> As far as I know, multi-push OP_RETURN outputs are not standard
> transactions and so wallet users can not rely on transactions containing
> them to be relayed through the network, therefore any improvement to the
> protocol which requires that feature is not appropriate for version 1.

FWIW multi-push OP_RETURN outputs will be standard in v0.12.0:

https://github.com/bitcoin/bitcoin/pull/6424

On 22/10/15 20:22, Peter Todd wrote:

> FWIW multi-push OP_RETURN outputs will be standard in v0.12.0:
>
> https://github.com/bitcoin/bitcoin/pull/6424
>

As I said before, once the prerequisites for a better notification method are usable in the network, I'd love to define a version 2 payment code that uses such an better notification system.

In the meantime. every block mined shows very consistent 70% address reuse.

Anything that can bring that number down is a good thing. Even if version 1 payment codes could only potentially drop that number from 70% to 30% instead of to 0%, they'd still be worth using while we wait for version 2.