📅 Original date posted:2015-02-05
📝 Original message:On 02/05/2015 03:36 PM, MⒶrtin HⒶboⓋštiak wrote:
>> A BIP-70 signed payment request in the initial broadcast can resolve the
>> integrity issues, but because of the public nature of the broadcast
>> coupled with strong public identity, the privacy compromise is much
>> worse. Now transactions are cryptographically tainted.
>>
>> This is also the problem with BIP-70 over the web. TLS and other
>> security precautions aside, an interloper on the communication, desktop,
>> datacenter, etc., can capture payment requests and strongly correlate
>> transactions to identities in an automated manner. The payment request
>> must be kept private between the parties, and that's hard to do.
>
> What about using encryption with forward secrecy? Merchant would
> generate signed request containing public ECDH part, buyer would send
> back transaction encrypted with ECDH and his public ECDH part. If
> receiving address/amount is meant to be private, use commit protocol
> (see ZRTP/RedPhone) and short authentication phrase (which is hard to
> spoof thanks to commit protocol - see RedPhone)?
Hi Martin,
The problem is that you need to verify the ownership of the public key.
A MITM can substitute the key. If you don't have verifiable identity
associated with the public key (PKI/WoT), you need a shared secret (such
as a secret phrase). But the problem is then establishing that secret
over a public channel.
You can bootstrap a private session over the untrusted network using a
trusted public key (PKI/WoT). But the presumption is that you are
already doing this over the web (using TLS). That process is subject to
attack at the CA. WoT is not subject to a CA attack, because it's
decentralized. But it's also not sufficiently deployed for some scenarios.
e
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 473 bytes
Desc: OpenPGP digital signature
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20150205/60dece7d/attachment.sig>;
Eric Voskuil [ARCHIVE] /
npub1sg…ppx3c
2023-06-07 15:29:46
in reply to nevent1q…q7m7
Author Public Key
npub1sgs97fe0n9wehe6zw7drcxdz4cy9yt9pfqjv8gasz5jlk4zezc0quppx3cPublished at
2023-06-07 15:29:46Event JSON
{
"id": "e1b47a8788844896bf7e88ac093f6866eb218ab8802200b0225a49dfc24c9eed",
"pubkey": "82205f272f995d9be742779a3c19a2ae08522ca14824c3a3b01525fb5459161e",
"created_at": 1686151786,
"kind": 1,
"tags": [
[
"e",
"5faa01afc6e1169d2a086249776b02fde5bfa851fa5197990b9cbcbf92c53f4a",
"",
"root"
],
[
"e",
"68f44291f2538fb58e3555a9deff8ca6b2a94ea6bdfc3a6119477229e44b4aca",
"",
"reply"
],
[
"p",
"8e86fc16ba0a39c10614cf22b657d2bd0244999b590ae5f82344a361ed4121f2"
]
],
"content": "📅 Original date posted:2015-02-05\n📝 Original message:On 02/05/2015 03:36 PM, MⒶrtin HⒶboⓋštiak wrote:\n\u003e\u003e A BIP-70 signed payment request in the initial broadcast can resolve the\n\u003e\u003e integrity issues, but because of the public nature of the broadcast\n\u003e\u003e coupled with strong public identity, the privacy compromise is much\n\u003e\u003e worse. Now transactions are cryptographically tainted.\n\u003e\u003e\n\u003e\u003e This is also the problem with BIP-70 over the web. TLS and other\n\u003e\u003e security precautions aside, an interloper on the communication, desktop,\n\u003e\u003e datacenter, etc., can capture payment requests and strongly correlate\n\u003e\u003e transactions to identities in an automated manner. The payment request\n\u003e\u003e must be kept private between the parties, and that's hard to do.\n\u003e \n\u003e What about using encryption with forward secrecy? Merchant would\n\u003e generate signed request containing public ECDH part, buyer would send\n\u003e back transaction encrypted with ECDH and his public ECDH part. If\n\u003e receiving address/amount is meant to be private, use commit protocol\n\u003e (see ZRTP/RedPhone) and short authentication phrase (which is hard to\n\u003e spoof thanks to commit protocol - see RedPhone)?\n\nHi Martin,\n\nThe problem is that you need to verify the ownership of the public key.\nA MITM can substitute the key. If you don't have verifiable identity\nassociated with the public key (PKI/WoT), you need a shared secret (such\nas a secret phrase). But the problem is then establishing that secret\nover a public channel.\n\nYou can bootstrap a private session over the untrusted network using a\ntrusted public key (PKI/WoT). But the presumption is that you are\nalready doing this over the web (using TLS). That process is subject to\nattack at the CA. WoT is not subject to a CA attack, because it's\ndecentralized. But it's also not sufficiently deployed for some scenarios.\n\ne\n\n-------------- next part --------------\nA non-text attachment was scrubbed...\nName: signature.asc\nType: application/pgp-signature\nSize: 473 bytes\nDesc: OpenPGP digital signature\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20150205/60dece7d/attachment.sig\u003e",
"sig": "99c21c0bc75c5faac253080b5e63bb7b5d9e56d4cafe41aed3356050fa8557e14b1f24a518b1d63afe29e0ea9dfabceae126f9afcdafe9236d5b08fc3f486ff0"
}