Received-SPF: pass (sog-mx-2.v43.ch3.sourceforge.com: domain of petertodd.org
	designates 62.13.148.101 as permitted sender)
	client-ip=62.13.148.101; envelope-from=pete@petertodd.org;
	helo=outmail148101.authsmtp.com; 
Date: Wed, 6 Aug 2014 23:33:09 +0000
From: Peter Todd <pete@petertodd.org>
To: Bitcoin Dev <bitcoin-development@lists.sourceforge.net>
Message-ID: <20140806233309.GB9272@localhost.localdomain>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="f2QGlHpHGjS2mn6Y"
Content-Disposition: inline
User-Agent: Mutt/1.5.21 (2010-09-15)
Subject: [Bitcoin-development] Payment ID #'s for Stealth Addresses
Precedence: list


--f2QGlHpHGjS2mn6Y
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Real-world experience with stealth address implementations used by
Cryptonote/Monero/etc. have shown that being able to attach a number of
some kind to each stealth-sent txout is valuable. For instance an
exchange with many customers can use such #'s to disambiguate payments
and credit the correct customer's account. Similarly an informal
person-to-person transaction can attach a number short enough to be
communicated verbally or on paper. Finally multiple payments with the
same ID # can be merged together in wallet UI's, allowing
merge-avoidance to be conveniently used with stealth addresses.

To avoid accidental collision such payment #'s should be at least
64-bits; to avoid privacy loss the encoded size should be the same for
all users. Thus we pick 64-bits or 8-bytes. In addition for the purposes
of CoinJoin and multiple outputs it would be desirable for all
stealth-using outputs the option of sharing a single 33-byte ephemeral
pubkey. Thus our OP_RETURN output becomes:

    OP_RETURN <ephemeral pubkey> <payment ID 1> {<ID 2> ... <ID n>}

Of course, this can't be accomodated within the existing 40-byte, one
OP_RETURN per tx, IsStandard() rules, something which is already causing
issues w/ Dark Wallet when users try to send to multiple stealth
addresses at once, and when multiple stealth sends are CoinJoin'd
together.

1) "Merge avoidance", Dec 11th 2013, Mike Hearn,
    https://medium.com/@octskyward/merge-avoidance-7f95a386692f


--f2QGlHpHGjS2mn6Y
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----

iQEcBAEBCgAGBQJT4rsrAAoJEH+rEUJn5PoEABQH/37VgBgyjzeEcOlIw58R+NlM
S7xm2/Z6twLylVByINopLoGJu5nQMUO8MARg/4jmFXCsPNcznMNHlsA/EdwU+tce
sBdHA5q++dmzhFy2XpyLt7S3zeLqH7j9lzrvCq7JLth+iawVqmH0clT8NZLgppuJ
3Az3RMunLZPAA4BeQpeQHhm6cDCFFuL4CNdNFpCIqbglyOsBLlx0+cuQDT24XNnG
0UIs+Ewttw5QQ28e6uy7p9J7mzo5lViRi6TYbA2FQSmUfDVltr7S5wJtjN6LIBgO
neBVk57wHSejUyknCYPv/3PjD5rcc/tlU7nC/6EBd+DyF8836JKdzP51A0iUJo0=
=Jk/r
-----END PGP SIGNATURE-----

--f2QGlHpHGjS2mn6Y--