[Bitcoin-development] Proposal to change payment protocol signing

[Bitcoin-development] Proposal to change payment protocol signing

[Gavin Andresen]

[-- Attachment #1: Type: text/plain, Size: 833 bytes --]

There is a discussion about clarifying how BIP70 signs payment requests
here:
  https://github.com/bitcoin/bips/pull/41

The issue is what to do with the signature field before signing. The code
Mike and I initially wrote does this:

    request.set_signature(string(""));

(sets signature to the empty string)

I think that is a mistake; it should be:

   request.clear_signature();

(clears signature field, so it is not serialized at all).

So: if you are implementing, or have implemented, the payment protocol,
please chime in. I'd like to change the spec and the reference
implementation NOW, while BIP70 is still a 'Draft'.

Because this type of "hey, I'm implementing your standard and it doesn't
work the way I think it should" mistake is exactly why BIPs take a while
before being declared 'Final.'


-- 
--
Gavin Andresen

[-- Attachment #2: Type: text/html, Size: 1225 bytes --]

Re: [Bitcoin-development] Proposal to change payment protocol signing

[Mike Hearn]

[-- Attachment #1: Type: text/plain, Size: 486 bytes --]

Who cares what it is? Setting to an empty byte array is fine, IMO. The
payment protocol is already rolling out. It's implemented in several
wallets, BitPay implements it, Coinbase is implementing it, etc.

-100000 for changing such a basic thing at this point. It'd cause chaos for
the early adopters, punishing them instead of rewarding them. It'd
seriously hurt adoption of the payment protocol when it's at its most
vulnerable. We should mark BIP 70 as accepted and be done with it.

[-- Attachment #2: Type: text/html, Size: 572 bytes --]

Re: [Bitcoin-development] Proposal to change payment protocol signing

[Ryan X. Charles]

[-- Attachment #1: Type: text/plain, Size: 1351 bytes --]

Agreed with Mike. It doesn't really matter what the signature field is
set to. Changing the standard now is too hard with too little benefit.

On 4/28/14, 12:14 PM, Mike Hearn wrote:
> Who cares what it is? Setting to an empty byte array is fine, IMO. The
> payment protocol is already rolling out. It's implemented in several
> wallets, BitPay implements it, Coinbase is implementing it, etc.
> 
> -100000 for changing such a basic thing at this point. It'd cause chaos
> for the early adopters, punishing them instead of rewarding them. It'd
> seriously hurt adoption of the payment protocol when it's at its most
> vulnerable. We should mark BIP 70 as accepted and be done with it. 
> 
> 
> 
> ------------------------------------------------------------------------------
> "Accelerate Dev Cycles with Automated Cross-Browser Testing - For FREE
> Instantly run your Selenium tests across 300+ browser/OS combos.  Get 
> unparalleled scalability from the best Selenium testing platform available.
> Simple to use. Nothing to install. Get started now for free."
> http://p.sf.net/sfu/SauceLabs
> 
> 
> 
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
> 

-- 
Ryan X. Charles
Software Engineer, BitPay

[-- Attachment #2: 0xA11B4DDE.asc --]
[-- Type: application/pgp-keys, Size: 5627 bytes --]

Re: [Bitcoin-development] Proposal to change payment protocol signing

[Jouke Hofman]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

We have BIP70 already in use (over a hundred paid requests).

Could you elaborate on why this needs changing?



On 28-04-14 14:39, Gavin Andresen wrote:
> There is a discussion about clarifying how BIP70 signs payment
> requests here: https://github.com/bitcoin/bips/pull/41
> 
> The issue is what to do with the signature field before signing.
> The code Mike and I initially wrote does this:
> 
> request.set_signature(string(""));
> 
> (sets signature to the empty string)
> 
> I think that is a mistake; it should be:
> 
> request.clear_signature();
> 
> (clears signature field, so it is not serialized at all).
> 
> So: if you are implementing, or have implemented, the payment
> protocol, please chime in. I'd like to change the spec and the
> reference implementation NOW, while BIP70 is still a 'Draft'.
> 
> Because this type of "hey, I'm implementing your standard and it
> doesn't work the way I think it should" mistake is exactly why BIPs
> take a while before being declared 'Final.'
> 
> 
> 
> 
> ------------------------------------------------------------------------------
>
> 
"Accelerate Dev Cycles with Automated Cross-Browser Testing - For FREE
> Instantly run your Selenium tests across 300+ browser/OS combos.
> Get unparalleled scalability from the best Selenium testing
> platform available. Simple to use. Nothing to install. Get started
> now for free." http://p.sf.net/sfu/SauceLabs
> 
> 
> 
> _______________________________________________ Bitcoin-development
> mailing list Bitcoin-development@lists.sourceforge.net 
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
> 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQEcBAEBAgAGBQJTX9bcAAoJELhWickZBkAlKqcH/RVFAr6vGgDjJvYah46StMHy
ZhKwpV1oqFCslOts6MyO+bZp9uDRlmYtnAy02CTPmlico3IyK85/+CGCGEdyiGo1
AEI2Ixr5FJs9t8uAVLyUKwOQddUFEJuZuiKXd1Wl9GqfG/z8gwdSxd08Wrq57lSH
JdwUnWOG1xBwyhgm7stqFoXgTrrnFNcE97vwsk6QMIzJG/v0suw7Lp42q7bKYaA/
J9xWSQ1cRKSPdsmu4K45oxXriqUmiqz3EouaTSQqC80OO7y8sfa96DqiHR83Vy3w
KUna5enjGqhhberWCokg3x5lCiH/IfLPrgK23iib4cg6Vm70jSQ2S2Xh/NuoDaM=
=JA5K
-----END PGP SIGNATURE-----

Re: [Bitcoin-development] Proposal to change payment protocol signing

[Gavin]

Consensus is the spec should be clarified to match current behavior, so it won't change.

--
Gavin Andresen


> On Apr 29, 2014, at 9:44 AM, Jouke Hofman <jouke@bitonic.nl> wrote:
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> We have BIP70 already in use (over a hundred paid requests).
> 
> Could you elaborate on why this needs changing?
> 
> 
> 
>> On 28-04-14 14:39, Gavin Andresen wrote:
>> There is a discussion about clarifying how BIP70 signs payment
>> requests here: https://github.com/bitcoin/bips/pull/41
>> 
>> The issue is what to do with the signature field before signing.
>> The code Mike and I initially wrote does this:
>> 
>> request.set_signature(string(""));
>> 
>> (sets signature to the empty string)
>> 
>> I think that is a mistake; it should be:
>> 
>> request.clear_signature();
>> 
>> (clears signature field, so it is not serialized at all).
>> 
>> So: if you are implementing, or have implemented, the payment
>> protocol, please chime in. I'd like to change the spec and the
>> reference implementation NOW, while BIP70 is still a 'Draft'.
>> 
>> Because this type of "hey, I'm implementing your standard and it
>> doesn't work the way I think it should" mistake is exactly why BIPs
>> take a while before being declared 'Final.'
>> 
>> 
>> 
>> 
>> ---------------------------------------