Re: [Bitcoin-development] Bait for reusable addresses

[Adam Back <adam@cypherspace.org>]

I think prefix has analysis side effects.  There are (at least) 4 things
that link payments: the graph of payment flows, timing, precise amounts, IP
addresses, but with prefix a 5th: the prefix allows public elmination of
candidates connections, I think that may make network flow analysis even
more effective than it has been.

So SPV can be tuned as Mike just said, and as Greg pointed out somewhere
bloom is more private than prefix because its a wallet to node connection,
not a node broadcast, and Mike mentioned embedded Tor in another post to
boost node-capture issues with hostile network.

So reusable addresses are cool for full node recipients (0-bit prefix) or
trusted server offload (your own desktop, VPS, or trusted service provider
node, and solve real problems for the use case of static and donation
addresses particularly with this second delegatable key for no-funds at risk
search (which is even good as Jeremey said for your own node, in a offline
wallet use case).

Now while it would be clearly a very nice win if reusable addresses could be
made SPV-like in network characteristics and privacy, but we dont have a
plausible mechanism yet IMO.  Close as we got was Greg's enhancement of
my/your "bloom bait"/"prefix" concept to make multiple candidate baits to
provide some ambiguity (still allows elimination, just slightly less of it).

If we can find some efficient crypto to solve that last one, we could even
adopt them generally if it was efficient enough without needing interactive
one-use address release.

Maybe we should ask some math/theoretical crypto people if there is anything
like public key watermarking or something that could solve this problem
efficiently.

For the related but different case of transaction level authenticity I like
Alan's server derived but communicated scalar & base to allow the client to
do at least TOFU.

Payment protocol may add another level of identity framework on top of TOFU
addresses (at a lower level than the payment messages defined now), and
without then needing a batch upload of offline signed secondary address
sigature that Mike described a while back, at least in person, maybe online
somewhere (an add on with similar purpose and effect to Alan's TOFU, but
then with revocation, identity and certification for merchants).

I have not talked about payment protocols main app level function I think we
all understand and agree on the purpose and use of the server and optional
client certs in that.  People may wish to add other cert types later (eg
PGP, SSH etc) but this version covers the common merchant tech, and allows
client-side certs to be experimented with for identity also (eg imagine as a
way to enrol with regulated entities like exchanges.)

Tell me if I am misunderstanding anything :)

Adam

On Fri, Jan 24, 2014 at 12:26:19PM +0000, Mike Hearn wrote:
>     brittleness. The real world experience is that users, or to be exact
>     wallet authors, turn down SPV privacy parameters until bloom filters
>     have almost no privacy in exchange for little bandwidth usage.
>
>   That's not fundamental though, it just reflects that the only
>   implementation of this is used on a wide range of devices and doesn't
>   yet have any notion of bandwidth modes or monitoring. It can and will
>   be resolved at some point.Â