📅 Original date posted:2023-08-13
🗒️ Summary of this message: The sender is concerned about the security of sharing the secret key in the payment URI and suggests using a different method. Another person raises the issue of potential security risks when posting payment URIs in public.
📝 Original message:
On August 10, 2023 5:37:54 AM HST, AdamISZ via bitcoin-dev <bitcoin-dev at lists.linuxfoundation.org> wrote:
>Hi Dan,
>A couple more more thoughts:
>
>> Out of band, the receiver of the payment, shares a bitcoin URI with the sender including a <code>pj=</code> query parameter describing the relay subdirectory endpoint and <code>psk=</code> parameter with base64 encoded 256-bit secret key.
>
>You're sending the symmetric secret key out of band; but isn't this obscuring the question of securely sharing the secret key? Did you consider DH-ing this as other protocols do? At the very least I would claim that it's likely that implementers might be sloppy here; at the most I would claim this is just insecure full stop.
Hi Dan,
After reading Adam's comments above and re-reading your draft BIP where it says the secret key is also used as the session identifier and that outputs can be modified, I'm wondering about the security of posting payment URIs anywhere someone can see them.
For example, if Alice posts her BIP21 URI for Bob to pay where Eve can see it, such as in a shared chatroom or via email or any cleartext protocol that gets relayed, can Eve establish her own session to the relay and frontrun Alice on receiving Bob's PSBT, modify the returned PSBT to include her (Eve's) output, and submit it for Bob to sign and broadcast?
The way BItcoin users currently use BIP21 URIs and QR-encoded BIP21 URIs, posting them where evesdroppers can see them poses a privacy risk but not a risk of loss of funds, so many users don't treat them as especially hazardous material. I don't think it would be practical to change that expectation, and I think a protocol where evesdropping didn't create a risk of funds loss would be much better than one where that risk was created.
(Apologies to Adam is this is exactly what he was saying with more subtly.)
-Dave
David A. Harding [ARCHIVE] /
npub16d…x4wrd
2023-08-13 14:32:58
in reply to nevent1q…sfs3
Author Public Key
npub16dt55fpq3a8r6zpphd9xngxr46zzqs75gna9cj5vf8pknyv2d7equx4wrdPublished at
2023-08-13 14:32:58Event JSON
{
"id": "7f7fc8c11c1504da3e55d153e171afb7d3c6f81b5e1b41d567711c050616761f",
"pubkey": "d3574a24208f4e3d0821bb4a69a0c3ae842043d444fa5c4a8c49c369918a6fb2",
"created_at": 1691937178,
"kind": 1,
"tags": [
[
"e",
"571e85bbe337f54205cf5b3b2d7d465fa3d96627ea0c0fbacf74900a7074a361",
"",
"root"
],
[
"e",
"769f786b9495ecc50148bef905272b17a4093bd8042a21a7082260f4b67167c4",
"",
"reply"
],
[
"p",
"9b3cb9066a41d6c59c090531827defe6138e14f8b94a7802a8a183aa309a4e2b"
]
],
"content": "📅 Original date posted:2023-08-13\n🗒️ Summary of this message: The sender is concerned about the security of sharing the secret key in the payment URI and suggests using a different method. Another person raises the issue of potential security risks when posting payment URIs in public.\n📝 Original message:\nOn August 10, 2023 5:37:54 AM HST, AdamISZ via bitcoin-dev \u003cbitcoin-dev at lists.linuxfoundation.org\u003e wrote:\n\u003eHi Dan,\n\u003eA couple more more thoughts:\n\u003e\n\u003e\u003e Out of band, the receiver of the payment, shares a bitcoin URI with the sender including a \u003ccode\u003epj=\u003c/code\u003e query parameter describing the relay subdirectory endpoint and \u003ccode\u003epsk=\u003c/code\u003e parameter with base64 encoded 256-bit secret key.\n\u003e\n\u003eYou're sending the symmetric secret key out of band; but isn't this obscuring the question of securely sharing the secret key? Did you consider DH-ing this as other protocols do? At the very least I would claim that it's likely that implementers might be sloppy here; at the most I would claim this is just insecure full stop.\n\nHi Dan,\n\nAfter reading Adam's comments above and re-reading your draft BIP where it says the secret key is also used as the session identifier and that outputs can be modified, I'm wondering about the security of posting payment URIs anywhere someone can see them.\n\nFor example, if Alice posts her BIP21 URI for Bob to pay where Eve can see it, such as in a shared chatroom or via email or any cleartext protocol that gets relayed, can Eve establish her own session to the relay and frontrun Alice on receiving Bob's PSBT, modify the returned PSBT to include her (Eve's) output, and submit it for Bob to sign and broadcast?\n\nThe way BItcoin users currently use BIP21 URIs and QR-encoded BIP21 URIs, posting them where evesdroppers can see them poses a privacy risk but not a risk of loss of funds, so many users don't treat them as especially hazardous material. I don't think it would be practical to change that expectation, and I think a protocol where evesdropping didn't create a risk of funds loss would be much better than one where that risk was created.\n\n(Apologies to Adam is this is exactly what he was saying with more subtly.)\n\n-Dave",
"sig": "250f07fd6b3ba20de494e6932dc17fd2cf5439011033199787efddfc71beccd149afb6b5caeb560a1b63ab4a63d823bb71f06391d58f1b06cf3fae9a43614542"
}