Date: Fri, 21 Mar 2014 11:59:06 +0100
From: Adam Back <adam@cypherspace.org>
To: Andreas Schildbach <andreas@schildbach.de>
Message-ID: <20140321105906.GA1725@netbook.cypherspace.org>
References: <lc5hmg$1jh$1@ger.gmane.org> <leuunm$tjk$1@ger.gmane.org>
	<CANEZrP3nQfvDArKTRgje0Cus4G2JD_zpxSjA3fXfxM2TNAP80Q@mail.gmail.com>
	<CALDj+BafD+6KTNcYDBEu5gNPzYozSkiC-JCxrY-PzXL2DYBRsw@mail.gmail.com>
	<CAJHLa0N4J_Z907+D0ENSNKfNAW2N=7Jf4JzSCO=SU558GtGTzA@mail.gmail.com>
	<lge7nk$3mf$2@ger.gmane.org>
	<CANEZrP0J849oDvMWjf8LWi0xj44Q8DaUwDip5_smVBMNgeQ3mw@mail.gmail.com>
	<20140320121221.GA25052@netbook.cypherspace.org>
	<lgh438$tnn$1@ger.gmane.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Disposition: inline
In-Reply-To: <lgh438$tnn$1@ger.gmane.org>
User-Agent: Mutt/1.5.21 (2010-09-15)
Cc: bitcoin-development@lists.sourceforge.net
Subject: Re: [Bitcoin-development] Payment Protocol for Face-to-face Payments
Precedence: list

Maybe its time to explore raw ECDSA signed message based certs.

btw I dont think its quite 4kB.  eg bitpay's looks to be about 1.5kB in der
format.  And they contain a 2048-bit RSA server key, and 2048-bit RSA
signatures (256byte each right there = 512bytes).  And even 2048 is weaker
than 256-bit ECDSA.

Adam

On Fri, Mar 21, 2014 at 11:25:59AM +0100, Andreas Schildbach wrote:
>On 03/20/2014 01:12 PM, Adam Back wrote:
>
>> Whats a sensible limit on practical/convenient QR code size?
>
>Technically 3 KB. In my experience codes above 1.5 KB become impossible
>to scan (ZXing scanner, 3 years ago). You will want to stay below 500
>bytes for convenient scanning. That said, I'm convinced there is a lot
>of room for scanning improvements.
>
>> How much of the payment protocol message size comes from use of x509?
>
>As said in the OP, a minimal PR uses 50 bytes. X.509 seems to put about
>4000 bytes on top of that.
>
>As you can see, we have quite some room for improvements to PR payload
>(PaymentDetails). X.509 certification will probably not be possible via
>QR, at least not until specialized CA's will issue space-efficient certs
>(using ECDSA?).