From: Richard Moore <me@ricmoo.com>
Content-Type: multipart/alternative;
	boundary="Apple-Mail=_8B2BBFF4-DD92-44F9-95EA-85512F14B54E"
Message-Id: <71A8E490-14C5-49F1-8E08-75C0A754B5BB@ricmoo.com>
Date: Sat, 12 Sep 2015 01:38:53 -0400
To: bitcoin-dev@lists.linuxfoundation.org
Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2104\))
Subject: [bitcoin-dev] Stealth Address Idea (special-less)
Precedence: list


--Apple-Mail=_8B2BBFF4-DD92-44F9-95EA-85512F14B54E
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

Hey all,

I am throwing out an idea I=E2=80=99ve been toying with, for feedback =
and if it seems like an idea worth pursuing, possibly a BIP number.

The goal is to make straight forward stealth address that are SPV =
friendly and easy to support in software without too much special goop.

I=E2=80=99ve got working code at =
https://github.com/ricmoo/sandbox/tree/master/stealth, and here are some =
example transactions on the block chain:

Target Public Key: =
029ed06e396761c24416cf7323ed4f1cb29763ee9e2b0fccae347d6a2a3eaecbf5
Target Public Key [tentative] Encoding (this is what you would give =
away): 59KkSZsVE7vErdqo8m5gtNoez44CbdwJQ5cSM1AAARzN19vkJ6NU

Revocable Payment made: =
b4ad20cad4cc2fcbbec09bc071dfe8c4a4b1e8e57d1e56bf51947445cfc6c7af
Irrevocable Payment made: =
f600643a1d32152117be0d9c652a86dc6182d2dab3be53340739395f524cd95c
Cleared out all funds from stealth address: =
58eb0fdab108c7add74835466251ffe5c51c7f4cec149f06daf0435d43d9ce55


Idea overview:

There are 2 modes of operation, revocable and irrevocable payments. =
Revocable payments result in both parties knowing the private key, =
allowing for a certain level of plausible deniability when the funds are =
swept, as to whether the funds were actually sent or were revoked=E2=80=A6=
 You could imagine WikiLeaks stating they will not claim donations for =
1-3 months after receiving them; if the funds are claimed after 1.5 =
months, did the sender actually send funds? The other option is =
irrevocable, where only the receiver can claim the funds (allowing them =
to leave them in that address until they need to be spent).

The basic idea is (the above code above gets into the nitty gritty), to =
send to targetPublicKey:
Given the UTXO set of inputs into a transaction, choose one at random, =
senderUtxo
Use ECDH(targetPublicKey, senderUtxo.privateKey) as sharedSecret
For revocable payments, you are done; use sharedSecret as your =
privateKey, compute the address
For irrevocable payments, create a sharedPrivateKey from the bytes of =
sharedSecret, use ECC addition (or would multiplication make more sense? =
advantages?) on the public key of sharedPrivateKey and the =
targetPublicKey. The receiver can then use ECC addition (or =
multiplication) on the sharedPrivateKey and the targetPrivateKey to =
generate the coresponding privateKey.

The SPV-able part, is lightly discussed in the top of stealth.js, but I =
haven=E2=80=99t played with bloom filters enough and the idea is still =
all too fresh in my head; the general idea is to make a 1-of-2 multisig =
where the first is the resulting stealth address, and the second is =
something (anything) that looks like a valid public key, but will match =
a bloom filter (given a tweak that is generated deterministically from =
the targetPublicKey) and matches the targetPublicKey. Again, I need much =
more feedback on this.

Thanks,
RicMoo

=
.=C2=B7=C2=B4=C2=AF`=C2=B7.=C2=B8=C2=B8.=C2=B7=C2=B4=C2=AF`=C2=B7.=C2=B8=C2=
=B8.=C2=B7=C2=B4=C2=AF`=C2=B7.=C2=B8=C2=B8.=C2=B7=C2=B4=C2=AF`=C2=B7.=C2=B8=
=C2=B8.=C2=B7=C2=B4=C2=AF`=C2=B7.=C2=B8><(((=C2=BA>

Richard Moore ~ Founder
Genetic Mistakes Software inc.
phone: (778) 882-6125
email: ricmoo@geneticmistakes.com <mailto:ricmoo@geneticmistakes.com>
www: http://GeneticMistakes.com <http://geneticmistakes.com/>

--Apple-Mail=_8B2BBFF4-DD92-44F9-95EA-85512F14B54E
Content-Transfer-Encoding: quoted-printable
Content-Type: text/html;
	charset=utf-8

<html><head><meta http-equiv=3D"Content-Type" content=3D"text/html =
charset=3Dutf-8"></head><body style=3D"word-wrap: break-word; =
-webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" =
class=3D""><div class=3D""><span style=3D"font-size: 13px; line-height: =
17px;" class=3D"">Hey all,</span></div><div style=3D"font-size: 13px; =
line-height: 17px;" class=3D""><br class=3D""></div><div =
style=3D"font-size: 13px; line-height: 17px;" class=3D"">I am throwing =
out an idea I=E2=80=99ve been toying with, for feedback and if it seems =
like an idea worth pursuing, possibly a BIP number.</div><div =
style=3D"font-size: 13px; line-height: 17px;" class=3D""><br =
class=3D""></div><div style=3D"font-size: 13px; line-height: 17px;" =
class=3D"">The goal is to make straight forward stealth address that are =
SPV friendly and easy to support in software without too much special =
goop.</div><div style=3D"font-size: 13px; line-height: 17px;" =
class=3D""><br class=3D""></div><div style=3D"font-size: 13px; =
line-height: 17px;" class=3D"">I=E2=80=99ve got working code at <a =
href=3D"https://github.com/ricmoo/sandbox/tree/master/stealth" =
class=3D"">https://github.com/ricmoo/sandbox/tree/master/stealth</a>, =
and here are some example transactions on the block chain:</div><div =
style=3D"font-size: 13px; line-height: 17px;" class=3D""><br =
class=3D""></div><div style=3D"font-size: 13px; line-height: 17px;" =
class=3D"">Target Public =
Key:&nbsp;029ed06e396761c24416cf7323ed4f1cb29763ee9e2b0fccae347d6a2a3eaecb=
f5</div><div style=3D"font-size: 13px; line-height: 17px;" =
class=3D"">Target Public Key [tentative] Encoding (this is what you =
would give =
away):&nbsp;59KkSZsVE7vErdqo8m5gtNoez44CbdwJQ5cSM1AAARzN19vkJ6NU</div><div=
 style=3D"font-size: 13px; line-height: 17px;" class=3D""><br =
class=3D""></div><div style=3D"font-size: 13px; line-height: 17px;" =
class=3D"">Revocable Payment =
made:&nbsp;b4ad20cad4cc2fcbbec09bc071dfe8c4a4b1e8e57d1e56bf51947445cfc6c7a=
f</div><div style=3D"font-size: 13px; line-height: 17px;" =
class=3D"">Irrevocable Payment =
made:&nbsp;f600643a1d32152117be0d9c652a86dc6182d2dab3be53340739395f524cd95=
c</div><div style=3D"font-size: 13px; line-height: 17px;" =
class=3D"">Cleared out all funds from stealth address: =
58eb0fdab108c7add74835466251ffe5c51c7f4cec149f06daf0435d43d9ce55</div><div=
 style=3D"font-size: 13px; line-height: 17px;" class=3D""><br =
class=3D""></div><div style=3D"font-size: 13px; line-height: 17px;" =
class=3D""><br class=3D""></div><div style=3D"font-size: 13px; =
line-height: 17px;" class=3D"">Idea overview:</div><div =
style=3D"font-size: 13px; line-height: 17px;" class=3D""><br =
class=3D""></div><div style=3D"font-size: 13px; line-height: 17px;" =
class=3D"">There are 2 modes of operation, revocable and irrevocable =
payments. Revocable payments result in both parties knowing the private =
key, allowing for a certain level of plausible deniability when the =
funds are swept, as to whether the funds were actually sent or were =
revoked=E2=80=A6 You could imagine WikiLeaks stating they will not claim =
donations for 1-3 months after receiving them; if the funds are claimed =
after 1.5 months, did the sender actually send funds? The other option =
is irrevocable, where only the receiver can claim the funds (allowing =
them to leave them in that address until they need to be =
spent).</div><div style=3D"font-size: 13px; line-height: 17px;" =
class=3D""><br class=3D""></div><div style=3D"font-size: 13px; =
line-height: 17px;" class=3D"">The basic idea is (the above code above =
gets into the nitty gritty), to send to targetPublicKey:</div><div =
style=3D"font-size: 13px; line-height: 17px;" class=3D""><ul =
class=3D"Apple-dash-list"><li class=3D"">Given the UTXO set of inputs =
into a transaction, choose one at random, senderUtxo</li><li =
class=3D"">Use ECDH(targetPublicKey, senderUtxo.privateKey) as =
sharedSecret</li><li class=3D"">For revocable payments, you are done; =
use sharedSecret as your privateKey, compute the address</li><li =
class=3D"">For irrevocable payments, create a sharedPrivateKey from the =
bytes of sharedSecret, use ECC addition (or would multiplication make =
more sense? advantages?) on the public key of sharedPrivateKey and the =
targetPublicKey. The receiver can then use ECC addition (or =
multiplication) on the sharedPrivateKey and the targetPrivateKey to =
generate the coresponding privateKey.</li></ul></div><div =
style=3D"font-size: 13px; line-height: 17px;" class=3D""><br =
class=3D""></div><div style=3D"font-size: 13px; line-height: 17px;" =
class=3D"">The SPV-able part, is lightly discussed in the top of =
stealth.js, but I haven=E2=80=99t played with bloom filters enough and =
the idea is still all too fresh in my head; the general idea is to make =
a 1-of-2 multisig where the first is the resulting stealth address, and =
the second is something (anything) that looks like a valid public key, =
but will match a bloom filter (given a tweak that is generated =
deterministically from the targetPublicKey) and matches the =
targetPublicKey. Again, I need much more feedback on this.</div><div =
style=3D"font-size: 13px; line-height: 17px;" class=3D""><br =
class=3D""></div><div style=3D"font-size: 13px; line-height: 17px;" =
class=3D"">Thanks,</div><div style=3D"font-size: 13px; line-height: =
17px;" class=3D"">RicMoo</div><div style=3D"font-size: 13px; =
line-height: 17px;" class=3D""><br class=3D""></div><div =
apple-content-edited=3D"true" class=3D"">
<span class=3D"Apple-style-span" style=3D"border-collapse: separate; =
border-spacing: =
0px;">.=C2=B7=C2=B4=C2=AF`=C2=B7.=C2=B8=C2=B8.=C2=B7=C2=B4=C2=AF`=C2=B7.=C2=
=B8=C2=B8.=C2=B7=C2=B4=C2=AF`=C2=B7.=C2=B8=C2=B8.=C2=B7=C2=B4=C2=AF`=C2=B7=
.=C2=B8=C2=B8.=C2=B7=C2=B4=C2=AF`=C2=B7.=C2=B8&gt;&lt;(((=C2=BA&gt;<br =
class=3D""><br class=3D"">Richard Moore ~ Founder<br class=3D"">Genetic =
Mistakes Software inc.<br class=3D"">phone: (778) 882-6125<br =
class=3D"">email:&nbsp;<a href=3D"mailto:ricmoo@geneticmistakes.com" =
class=3D"">ricmoo@geneticmistakes.com</a><br class=3D"">www:&nbsp;<a =
href=3D"http://GeneticMistakes.com/" =
class=3D"">http://GeneticMistakes.com</a></span>
</div>
<br class=3D""></body></html>=

--Apple-Mail=_8B2BBFF4-DD92-44F9-95EA-85512F14B54E--