Re: [Bitcoin-development] ECDH in the payment protocol

[Peter Todd <pete@petertodd.org>]

[-- Attachment #1: Type: text/plain, Size: 2133 bytes --]

On Fri, May 09, 2014 at 05:50:33PM +0200, Pieter Wuille wrote:
> I believe stealth addresses and the payment protocol both have their
> use cases, and that they don't overlap.
> 
> If you do not want to communicate with the receiver, you typically do
> not want them to know who is paying or for what (otherwise you're
> already talking to them in some way, right?). That's perfect for
> things like anonymous donations.
> 
> In pretty much every other case, communicating directly with the
> receiver has benefits. Negotiation of the transaction details,
> messages associated with the transaction, refund information, no need
> to scan the blockchain for incoming transaction... and the ability to
> cancel if either party doesn't agree.
> 
> Instead of adding stealth functionality to the payment protocol as a
> last resort, I'd rather see the payment protocol improve its
> atomicity. Either you want the data channel sender->receiver, or you
> don't. If it isn't available and you want it, things should fail. If
> you don't want it, you shouldn't try to use it in the first place.

I don't think we're going to find that's practical unfortunately due to
change. Every payment I make ties up txouts, so if we try to base the
atomicity of payments on whether or not the payee decides to broadcast
the transaction the payor is stuck with txouts that they can't use until
the payee makes up their mind. That leads to lots and lots of nasty edge
cases.

OTOH if we base the atomicity of payment on whether or not a specific
txout exists everything those edge cases don't exist. Yes, that might
force us to expose transaction fees to the user, but after all it's the
user who has control over those fees.

A separate issue is IsStandard() rules, and a near-term project for me
is to write a much relaxed version of them based on soft-fork safe
whitelisting/blacklisting of opcodes, version numbers, mutability etc.
We can definitely get to the point where those rules will change very
little.

-- 
'peter'[:-1]@petertodd.org
00000000000000006d5945d2dddece39487c36673e56a292b619b1929ff3b40f

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 685 bytes --]