[bitcoin-dev] [Bitcoin-development] Reusable payment codes

[Luke Dashjr via bitcoin-dev]

This link contains an RFC for a new type of Bitcoin address called a
"payment code"

Sorry for the late review. I'm concerned with the "notification address"
requirement, which entails address reuse and blockchain spam. Since it entails
address reuse, the recipient is forced to either leave them unspent forever
(bloating the UTXO set), or spend it which potentially compromises the private
key, and (combined with the payment code) possibly as much as the entire
wallet.

Instead, I suggest making it a single zero-value OP_RETURN output with two
pushes: 1) a hash of the recipient's payment code, and 2) the encrypted
payment code. This can be searched with standard bloom filters, or indexed
with whatever other optimised algorithms are desired. At the same time, it
never uses any space in the UTXO set, and never needs to be
spent/mixed/dusted.

Luke

[Justus Ranvier via bitcoin-dev]

Post by Luke Dashjr via bitcoin-dev
Sorry for the late review. I'm concerned with the "notification address"
requirement, which entails address reuse and blockchain spam. Since it entails
address reuse, the recipient is forced to either leave them unspent forever
(bloating the UTXO set), or spend it which potentially compromises the private
key, and (combined with the payment code) possibly as much as the entire
wallet.
Instead, I suggest making it a single zero-value OP_RETURN output with two
pushes: 1) a hash of the recipient's payment code, and 2) the encrypted
payment code. This can be searched with standard bloom filters, or indexed
with whatever other optimised algorithms are desired. At the same time, it
never uses any space in the UTXO set, and never needs to be
spent/mixed/dusted.

The notification transaction portion is my least-favorite portion of the
spec, but I don't see any alternatives that provide an unambiguous
improvement, including your suggestion.

One of the most highly-weighted goals of this proposal is to be usable
on as many mobile/light wallets as possible.

I know for sure that all existing platforms for balance querying index
by address. Support for bloom filters or other querying methods is less
comprehensive, meaning the set of wallets that can support payment codes
would be smaller.

[Luke Dashjr via bitcoin-dev]

Post by Justus Ranvier via bitcoin-dev

Post by Luke Dashjr via bitcoin-dev
Sorry for the late review. I'm concerned with the "notification address"
requirement, which entails address reuse and blockchain spam. Since it
entails address reuse, the recipient is forced to either leave them
unspent forever (bloating the UTXO set), or spend it which potentially
compromises the private key, and (combined with the payment code)
possibly as much as the entire wallet.
Instead, I suggest making it a single zero-value OP_RETURN output with
two pushes: 1) a hash of the recipient's payment code, and 2) the
encrypted payment code. This can be searched with standard bloom
filters, or indexed with whatever other optimised algorithms are
desired. At the same time, it never uses any space in the UTXO set, and
never needs to be
spent/mixed/dusted.

The notification transaction portion is my least-favorite portion of the
spec, but I don't see any alternatives that provide an unambiguous
improvement, including your suggestion.
One of the most highly-weighted goals of this proposal is to be usable
on as many mobile/light wallets as possible.
I know for sure that all existing platforms for balance querying index
by address. Support for bloom filters or other querying methods is less
comprehensive, meaning the set of wallets that can support payment codes
would be smaller.

No, they just need to improve their software, and only to support receiving
with payment codes (not sending to them). BIPs should in general not be
designed around current software, especially in this case where there is no
benefit to doing so (since it requires software upgrades anyway).

Luke

[Justus Ranvier via bitcoin-dev]

Post by Luke Dashjr via bitcoin-dev
BIPs should in general not be
designed around current software

I strongly disagree with this statement.

There is a version byte in the payment code specification for a reason.

Version 1 payment codes are designed to be deployable by wallet
implementers today, without requiring them to wait on any network-level
changes whatsoever, which includes IsStandard() redefinitions, or
yet-to-be-invented-and-deployed filtering schemes.

As far as I know, multi-push OP_RETURN outputs are not standard
transactions and so wallet users can not rely on transactions containing
them to be relayed through the network, therefore any improvement to the
protocol which requires that feature is not appropriate for version 1.

When additional capabilities are deployed in the network such that
Bitcoin users can rely on their existence, that would be a great time to
specify a version 2 payment code that uses those features and encourage
users to upgrade (which should be a fairly smooth process since their
actual keys don't need to change).

[Luke Dashjr via bitcoin-dev]

Post by Justus Ranvier via bitcoin-dev
I strongly disagree with this statement.

Well, I strongly disagree with adopting the BIP as it stands.

Post by Justus Ranvier via bitcoin-dev
Version 1 payment codes are designed to be deployable by wallet
implementers today, without requiring them to wait on any network-level
changes whatsoever, which includes IsStandard() redefinitions, or
yet-to-be-invented-and-deployed filtering schemes.

No, those are not network-level changes. They are mere software changes that
can be deployed along with the rest of the proposal.

Post by Justus Ranvier via bitcoin-dev
As far as I know, multi-push OP_RETURN outputs are not standard
transactions and so wallet users can not rely on transactions containing
them to be relayed through the network, therefore any improvement to the
protocol which requires that feature is not appropriate for version 1.

"Standard" means defined in a BIP. To date, there are no standard
transactions using OP_RETURN period. IsStandard is a node policy that should
have no influence on future BIPs.

Post by Justus Ranvier via bitcoin-dev
When additional capabilities are deployed in the network such that
Bitcoin users can rely on their existence, that would be a great time to
specify a version 2 payment code that uses those features and encourage
users to upgrade (which should be a fairly smooth process since their
actual keys don't need to change).

Such changes should not be made until there is a standard for them.

Luke

[Justus Ranvier via bitcoin-dev]

Post by Luke Dashjr via bitcoin-dev
Well, I strongly disagree with adopting the BIP as it stands.

That's fine. Nobody is required to adopt an informational BIP if they do
not wish to do so.

Post by Luke Dashjr via bitcoin-dev
No, those are not network-level changes. They are mere software changes that
can be deployed along with the rest of the proposal.

They are "mere software changes" outside the control of the users and
wallet developers who may wish to use and implement payment codes, so
are indistinguishable from a network-level change.

Post by Luke Dashjr via bitcoin-dev
"Standard" means defined in a BIP. To date, there are no standard
transactions using OP_RETURN period. IsStandard is a node policy that should
have no influence on future BIPs.

Since Bitcoin Core 0.11, 80 byte OP_RETURN transactions are standard, so
that's what payment codes use:

https://github.com/bitcoin/bitcoin/commit/fcf646c

Whether or not it "should" have an influence, it is an absolute fact
that Bitcoin users are affected by it.

A user whose transactions are not relayed or mined doesn't care about
the politics surrounding node policy.

Designing standards without putting the needs of its intended users
first is a great way to see the standard fail.

Post by Luke Dashjr via bitcoin-dev
Such changes should not be made until there is a standard for them.

Have you ever heard the term "permissionless innovation" by chance?
Particularly in reference to Bitcoin?

If you don't like payment codes, then don't use them.

[Peter Todd via bitcoin-dev]

Post by Justus Ranvier via bitcoin-dev

Post by Luke Dashjr via bitcoin-dev
BIPs should in general not be
designed around current software

I strongly disagree with this statement.
There is a version byte in the payment code specification for a reason.
Version 1 payment codes are designed to be deployable by wallet
implementers today, without requiring them to wait on any network-level
changes whatsoever, which includes IsStandard() redefinitions, or
yet-to-be-invented-and-deployed filtering schemes.
As far as I know, multi-push OP_RETURN outputs are not standard
transactions and so wallet users can not rely on transactions containing
them to be relayed through the network, therefore any improvement to the
protocol which requires that feature is not appropriate for version 1.

FWIW multi-push OP_RETURN outputs will be standard in v0.12.0:

https://github.com/bitcoin/bitcoin/pull/6424

[Justus Ranvier via bitcoin-dev]

Post by Peter Todd via bitcoin-dev
https://github.com/bitcoin/bitcoin/pull/6424

As I said before, once the prerequisites for a better notification
method are usable in the network, I'd love to define a version 2 payment
code that uses such an better notification system.

In the meantime. every block mined shows very consistent 70% address reuse.

Anything that can bring that number down is a good thing. Even if
version 1 payment codes could only potentially drop that number from 70%
to 30% instead of to 0%, they'd still be worth using while we wait for
version 2.

[Kristov Atlas via bitcoin-dev]

The consequence of previous ECDH address proposals "not designing around
current software" is a sustained ~70% of transactions reusing addresses, as
you saw in my Reddit post recently.

If you have a fear that an inferior proposal will gain popularity, you can
always propose a superior one. If it's *actually* superior, it will win out.

On Thu, Oct 22, 2015 at 4:43 PM, Luke Dashjr via bitcoin-dev <

Post by Luke Dashjr via bitcoin-dev

Post by Justus Ranvier via bitcoin-dev

Post by Luke Dashjr via bitcoin-dev
Sorry for the late review. I'm concerned with the "notification

address"

Post by Justus Ranvier via bitcoin-dev

Post by Luke Dashjr via bitcoin-dev
requirement, which entails address reuse and blockchain spam. Since it
entails address reuse, the recipient is forced to either leave them
unspent forever (bloating the UTXO set), or spend it which potentially
compromises the private key, and (combined with the payment code)
possibly as much as the entire wallet.
Instead, I suggest making it a single zero-value OP_RETURN output with
two pushes: 1) a hash of the recipient's payment code, and 2) the
encrypted payment code. This can be searched with standard bloom
filters, or indexed with whatever other optimised algorithms are
desired. At the same time, it never uses any space in the UTXO set, and
never needs to be
spent/mixed/dusted.

The notification transaction portion is my least-favorite portion of the
spec, but I don't see any alternatives that provide an unambiguous
improvement, including your suggestion.
One of the most highly-weighted goals of this proposal is to be usable
on as many mobile/light wallets as possible.
I know for sure that all existing platforms for balance querying index
by address. Support for bloom filters or other querying methods is less
comprehensive, meaning the set of wallets that can support payment codes
would be smaller.

No, they just need to improve their software, and only to support receiving
with payment codes (not sending to them). BIPs should in general not be
designed around current software, especially in this case where there is no
benefit to doing so (since it requires software upgrades anyway).
Luke
_______________________________________________
bitcoin-dev mailing list
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev