1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
|
Return-Path: <gmaxwell@gmail.com>
Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org
[172.17.192.35])
by mail.linuxfoundation.org (Postfix) with ESMTPS id 8CA63481
for <bitcoin-dev@lists.linuxfoundation.org>;
Tue, 15 Aug 2017 05:12:13 +0000 (UTC)
X-Greylist: whitelisted by SQLgrey-1.7.6
Received: from mail-ua0-f178.google.com (mail-ua0-f178.google.com
[209.85.217.178])
by smtp1.linuxfoundation.org (Postfix) with ESMTPS id 6CA3E147
for <bitcoin-dev@lists.linuxfoundation.org>;
Tue, 15 Aug 2017 05:12:13 +0000 (UTC)
Received: by mail-ua0-f178.google.com with SMTP id d29so44004315uai.2
for <bitcoin-dev@lists.linuxfoundation.org>;
Mon, 14 Aug 2017 22:12:13 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025;
h=mime-version:sender:in-reply-to:references:from:date:message-id
:subject:to; bh=KSnIK9IkIr3QSlXEoWhecSosYzbEM+yqs8eUV1kf6Ww=;
b=De6xPG8Krvc6Udiag8UcIXFohITtY/btqxFrwCF77odpFbUAf5/AxCl7OVJA1ViFjx
RfPGXlsel/X9SeEDweuxvgMDYmJANT2rn9G0OlI6Uls+S6XKVFnOREW7rmEI1nZ4CdeI
UWyfOKNb0E2wfny/lxpNd2QIgAQNImmd1UixatY4iOA92PW4yIJiC76feqK3LYwPpGYm
UJq1f6SJ8jyxKg3GNqgvD5EHhTTwCd8r6jp0GPYPchU7CbnVpnAqwTWSHTucCKFI0wFY
Z7Kl6LT3jVYynZUYxMAEmrVoSZFvP7RSZFg/RfKFPL4Jad86chhpj2c1vM/NBylwRXwh
TpPw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20161025;
h=x-gm-message-state:mime-version:sender:in-reply-to:references:from
:date:message-id:subject:to;
bh=KSnIK9IkIr3QSlXEoWhecSosYzbEM+yqs8eUV1kf6Ww=;
b=P/CGe/L4I25gcVuKQr9ddRpWZb/b4LbkTR+WIUcta5fTO8CPfGBEfb6PJsBhaQ3RRo
fU7TtSi0LZ3tYTAhN+vUpeyFpCTaY3jWLR8IflSB2cqpRf+13s+qMK4DOOPMf2jsrWob
i5LNTE7hkpUBX/8/CDa5QuejcGvTie57wPEEgnJ0wVldTO5TffHCik5GhGP9qWRZAtZ2
TvctWNcwb5Ccx6Z6S2i71mABTn8jneiZSz7KSWINQF+2mYLmG7dGenoiS67snUmgVBY2
lxsM3z39Llc198iQXhphffO92TrAul008t6xDrGAI/QMJDvLdPMOnP0VQeOHG3BcC9K3
AdFg==
X-Gm-Message-State: AHYfb5g9gi/6g+/mfaOb0pEYuNt8UDohGRWNisVjNa6/rwufyG/nlUeK
HXPyobaTSEfnQJIf4f3UF/IWvkcQfQ==
X-Received: by 10.159.32.97 with SMTP id 88mr18932008uam.102.1502773932552;
Mon, 14 Aug 2017 22:12:12 -0700 (PDT)
MIME-Version: 1.0
Sender: gmaxwell@gmail.com
Received: by 10.103.47.133 with HTTP; Mon, 14 Aug 2017 22:12:11 -0700 (PDT)
In-Reply-To: <CAE3EOfgJdrO29GCftwORcq0087X0Y74gYtuMWvO1EWEkrT-7rg@mail.gmail.com>
References: <CAE3EOfgJdrO29GCftwORcq0087X0Y74gYtuMWvO1EWEkrT-7rg@mail.gmail.com>
From: Gregory Maxwell <greg@xiph.org>
Date: Tue, 15 Aug 2017 05:12:11 +0000
X-Google-Sender-Auth: QgVxnJPVu9TjVGOZB7KthnvF0k8
Message-ID: <CAAS2fgSbK=Hf7nViHScLezCAUdKkFT1MxEM4VZhZxoj990O8PQ@mail.gmail.com>
To: omar shibli <omarshib@gmail.com>,
Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: text/plain; charset="UTF-8"
Subject: Re: [bitcoin-dev] BIP proposal, Pay to Contract BIP43 Application
X-BeenThere: bitcoin-dev@lists.linuxfoundation.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Bitcoin Protocol Discussion <bitcoin-dev.lists.linuxfoundation.org>
List-Unsubscribe: <https://lists.linuxfoundation.org/mailman/options/bitcoin-dev>,
<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=unsubscribe>
List-Archive: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/>
List-Post: <mailto:bitcoin-dev@lists.linuxfoundation.org>
List-Help: <mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=help>
List-Subscribe: <https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev>,
<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=subscribe>
X-List-Received-Date: Tue, 15 Aug 2017 05:12:13 -0000
This construction appears to me to be completely insecure.
Say my pubkey (the result of the derivation path) is P.
We agree to contract C1. A payment is made to P + G*H(C1).
But in secret, I constructed contract C2 and pubkey Q and set P = Q + G*H(C2).
Now I can take that payment (paid to Q + G*(C1) + G*H(C2)) and assert
it was in act a payment to P' + G*H(C2). (P' is simply Q + G*H(C1))
I don't see anything in the proposal that addresses this. Am I missing it?
The applications are also not clear to me, and it doesn't appear to
address durability issues (how do you avoid losing your funds if you
lose the exact contract?).
On Mon, Aug 14, 2017 at 6:05 AM, omar shibli via bitcoin-dev
<bitcoin-dev@lists.linuxfoundation.org> wrote:
> Hey all,
>
> A lot of us familiar with the pay to contract protocol, and how it uses
> cleverly the homomorphic property of elliptic curve encryption system to
> achieve it.
> Unfortunately, there is no standard specification on how to conduct such
> transactions in the cyberspace.
>
> We have developed a basic trade finance application that relies on the
> original idea described in the Homomorphic Payment Addresses and the
> Pay-to-Contract Protocol paper, yet we have generalized it and made it BIP43
> complaint.
>
> We would like to share our method, and get your feedback about it, hopefully
> this effort will result into a standard for the benefit of the community.
>
> Abstract idea:
>
> We define the following levels in BIP32 path.
> m / purpose' / coin_type' / contract_id' / *
>
> contract_id is is an arbitrary number within the valid range of indices.
>
> Then we define, contract base as following prefix:
> m / purpose' / coin_type' / contract_id'
>
> contract commitment address is computed as follows:
> hash document using cryptographic hash function of your choice (e.g. blake2)
> map hash to partial derivation path
> Convert hash to binary array.
> Partition the array into parts, each part length should be 16.
> Convert each part to integer in decimal format.
> Convert each integer to string.
> Join all strings with slash `/`.
> compute child public key by chaining the derivation path from step 2 with
> contract base:
> m/<contract_base>/<hash_derivation_path>
> compute address
> Example:
>
> master private extended key:
> xprv9s21ZrQH143K2JF8RafpqtKiTbsbaxEeUaMnNHsm5o6wCW3z8ySyH4UxFVSfZ8n7ESu7fgir8imbZKLYVBxFPND1pniTZ81vKfd45EHKX73
> coin type: 0
> contract id: 7777777
>
> contract base computation :
>
> derivation path:
> m/999'/0'/7777777'
> contract base public extended key:
> xpub6CMCS9rY5GKdkWWyoeXEbmJmxGgDcbihofyARxucufdw7k3oc1JNnniiD5H2HynKBwhaem4KnPTue6s9R2tcroqkHv7vpLFBgbKRDwM5WEE
>
> Contract content:
> foo
>
> Contract sha256 signature:
> 2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae
>
> Contract partial derivation path:
> 11302/46187/26879/50831/63899/17724/7472/16692/4930/11632/25731/49056/63882/24200/25190/59310
>
> Contract commitment pub key path:
> m/999'/0'/7777777'/11302/46187/26879/50831/63899/17724/7472/16692/4930/11632/25731/49056/63882/24200/25190/59310
> or
> <contract_base_extended_pub_key>/11302/46187/26879/50831/63899/17724/7472/16692/4930/11632/25731/49056/63882/24200/25190/59310
>
> Contract commitment pub key:
> xpub6iQVNpbZxdf9QJC8mGmz7cd3Cswt2itcQofZbKmyka5jdvQKQCqYSDFj8KCmRm4GBvcQW8gaFmDGAfDyz887msEGqxb6Pz4YUdEH8gFuaiS
>
> Contract commitment address:
> 17yTyx1gXPPkEUN1Q6Tg3gPFTK4dhvmM5R
>
>
> You can find the full BIP draft in the following link:
> https://github.com/commerceblock/pay-to-contract-protocol-specification/blob/master/bip-draft.mediawiki
>
>
> Regards,
> Omar
>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>
|
