From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id 8C868C7F for ; Tue, 11 Sep 2018 04:42:14 +0000 (UTC) X-Greylist: from auto-whitelisted by SQLgrey-1.7.6 Received: from mo.garage.hdemail.jp (mo.garage.hdemail.jp [46.51.242.127]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id 6AA9863D for ; Tue, 11 Sep 2018 04:42:13 +0000 (UTC) Received: from ip-10-217-1-36.ap-northeast-1.compute.internal (localhost.localdomain [127.0.0.1]) by mo.garage.hdemail.jp (hde-mf-postfix) with SMTP id ED65714C0EE for ; Tue, 11 Sep 2018 13:42:11 +0900 (JST) (envelope-from karljohan-alm@garage.co.jp) X-Received: from unknown (HELO mo.garage.hdemail.jp) (127.0.0.1) by 0 with SMTP; 11 Sep 2018 13:42:11 +0900 X-Received: from mo.garage.hdemail.jp (localhost.localdomain [127.0.0.1]) by mo.garage.hdemail.jp (hde-ma-postfix) with ESMTP id 6DF8F4C086 for ; Tue, 11 Sep 2018 13:42:11 +0900 (JST) (envelope-from karljohan-alm@garage.co.jp) Received: from gw31.oz.hdemail.jp (ip-10-126-11-99.ap-northeast-1.compute.internal [10.126.11.99]) by mo.garage.hdemail.jp (hde-mf-postfix) with ESMTP id ED50414C0EE for ; Tue, 11 Sep 2018 13:42:10 +0900 (JST) (envelope-from karljohan-alm@garage.co.jp) X-Received: from mail-qk1-f197.google.com (lb06.oz.hdemail.jp [54.238.50.28]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by gw31.oz.hdemail.jp (Postfix) with ESMTP id 88693148C140 for ; Tue, 11 Sep 2018 13:42:10 +0900 (JST) X-Received: by mail-qk1-f197.google.com with SMTP id 3-v6so19807212qkj.13 for ; Mon, 10 Sep 2018 21:42:10 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=Ww9cy7eS/xN8RE9j+EC1B1BjRwosdAAfC5398SN/khE=; b=jqDv3hORwjMQHqZ4ah+6p3StjBSlabNGD1k+Et6qibSq2DFFu0Loe8qm0e/n1G9E1t ga5OsVjlTufTq92q1on6KYl1Cygj/AAsKPr5OVjRAlTLGI7G98krgFlDn89MN5QTRjxX 2Z7/t2HzddcH483fm+8+RDBQ5wCu13TctiExjqE8VIDhVIgu/Fuc2whiZJT5/4dwQBwd y9TVtATwasX64w5yPiUHnsYd/fTSENASMoGM7UGRIf4zdoq6BliC6QIXUUtaa/xXY6Eh X9GFudJXVjo0x6nmmxif4QRF/hiKFsQYrzNFo4qeCl5z7V6CZXuSVgJFrdKkjnPkOY+g +X/Q== X-Gm-Message-State: APzg51Cv1vbcyXL+dyJ5ato1yAQZexanji67NF/lxzRmetOg6pqBU1dB YdCJMfzdfYTimZkcGTX53MfDALSTcoL3+t3mstUESxU7DXmqyWINQQuSZyHFWrFaZo3a/xv8MWm a6g0kh8NYwjLMpg0YlzVPTZxck72UUTE+85ihgM+xxUtht4FB0Azi5n5l9xvjoc3TmAOfHhSoqj djqoUc+oLjfY361VfCM8bBRnKxmYtGl5YVAR/jdoAo6D5fJD0XJMHBfi3N4ODJJmA5wYLbhoP2K Hv8wTZtJJIJnc34jO74TPv44KnIh1hRhI3lpqsw2lJVtrGsK8cX5Xh/cbs4khORaPKUKoZFrFoR kSHzFxmI4AenczSoWnYDa+cYQVM= X-Received: by 2002:a37:4ecb:: with SMTP id c194-v6mr17383889qkb.345.1536640929000; Mon, 10 Sep 2018 21:42:09 -0700 (PDT) X-Google-Smtp-Source: ANB0VdbyoeAvBXf+iwOuxMLi8Y4OYNKv1lfWiOhyJyFsPlpjBx1I/RSUeRGSCc6BukFi7880M1cmalvfKhUcUkYD53w= X-Received: by 2002:a37:4ecb:: with SMTP id c194-v6mr17383874qkb.345.1536640928645; Mon, 10 Sep 2018 21:42:08 -0700 (PDT) MIME-Version: 1.0 From: Karl-Johan Alm Date: Tue, 11 Sep 2018 13:41:57 +0900 Message-ID: To: Bitcoin Protocol Discussion Content-Type: text/plain; charset="UTF-8" X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org X-Mailman-Approved-At: Wed, 12 Sep 2018 13:41:35 +0000 Subject: [bitcoin-dev] RFC: BIP 322: Generic Signed Message Format X-BeenThere: bitcoin-dev@lists.linuxfoundation.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Bitcoin Protocol Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Sep 2018 04:42:14 -0000 Hi. [note: BIP number was assigned to PR before this email was sent; I did not self-assign the BIP number] Below is a proposal to extend the existing sign/verifymessage format to a more generalized variant relying on the script verification mechanism in Bitcoin itself for message signing/verification, based on the original discussion (https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2018-March/015818.html) . PR is here: https://github.com/bitcoin/bips/pull/725 A formatted version of this text can be seen here: https://github.com/kallewoof/bips/blob/bip-generic-signmessage/bip-generic-signmessage.mediawiki Note: I am not sure how to best deal with CLTV/CSV stuff here, ultimately. Note 2: I have received suggestions from several people to use a Bitcoin transaction instead. If someone could explain why this is beneficial, it would be very helpful. I'm not against it, just feels like the whole transaction part is unnecessary complexity/overhead. --- 
  BIP: 322
  Layer: Applications
  Title: Generic Signed Message Format
  Author: Karl-Johan Alm 
  Comments-Summary: No comments yet.
  Comments-URI: https://github.com/bitcoin/bips/wiki/Comments:BIP-0322
  Status: Draft
  Type: Standards Track
  Created: 2018-09-10
  License: CC0-1.0
== Abstract == A standard for interoperable generic signed messages based on the Bitcoin Script format. == Motivation == The current message signing standard only works for P2PKH (1...) addresses. By extending it to use a Bitcoin Script based approach, it could be made more generic without causing a too big burden on implementers, who most likely have access to Bitcoin Script interpreters already. == Specification == A new structure SignatureProof is added, which is a simple serializable scriptSig & witnessProgram container. Two actions "Sign" and "Verify" are defined. === SignatureProof container === {|class="wikitable" style="text-align: center;" |- !Type !Length !Name !Comment |- |Uint32||4||flags||standard flags (1-to-1 with standard flags in Bitcoin Core) |- |VarInt||1-8||msglen||Number of bytes in message string, excluding NUL termination |- |Char*||[msglen]||msg||The message being signed for all subjects, excluding NUL termination |- |Uint8||1||entries||Number of proof entriesWhy support multiple proofs? In particular with proof of funds, it is non-trivial to check a large number of individual proofs (one per UTXO) for duplicates. Software could be written to do so, but it seems more efficient to build this check into the specification itself. |} The above is followed by [entries] number of signature entries: {|class="wikitable" style="text-align: center;" |- !Type !Length !Name !Comment |- |VarInt||1-8||scriptsiglen||Number of bytes in scriptSig data |- |Uint8*||[scriptsiglen]||scriptsig||ScriptSig data |- |VarInt||1-8||witlen||Number of bytes in witness program data |- |Uint8*||[witlen]||wit||Witness program |} In some cases, the scriptsig may be empty (scriptsiglen=0). === Signing === The "Sign" action takes as input a scriptPubKey and a message (e.g. "hello world"). It succeeds or fails. # FAIL if scriptPubKey already exists in scriptPubKeys set, otherwise insert itWhy track duplicates? Because a 3-entry proof is not proving 3 scriptPubKeys unless they are all distinct, or unless they are proving different UTXO:s (see Future Extensions) # Derive the private key privkey for the scriptPubKey, or FAIL # Define the message pre-image as the sequence "Bitcoin Message:" concatenated with the message, encoded in UTF-8 using Normalization Form Compatibility Decomposition (NFKD) # Let sighash = sha256(sha256(scriptPubKey || pre-image)) # Generate a signature sig with privkey=privkey, sighash=sighash Repeat the above operation for each scriptPubKey, retaining the scriptPubKeys set. As noted, if the same scriptPubKey appears more than once, the sign operation must fail. === Verifying === The "Verify" action takes as input a standard flags value, a scriptPubKey, a message, a script sig, and a witness program. It emits one of INCONCLUSIVE, VALID, INVALID, or ERROR. # Return ERROR if scriptPubKey already exists in scriptPubKeys set, otherwise insert it # If one or more of the standard flags are unknown, return INCONCLUSIVE # Define the message pre-image as the sequence "Bitcoin Message:" concatenated with the message, encoded in UTF-8 using Normalization Form Compatibility Decomposition (NFKD). # Let sighash = sha256(sha256(scriptPubKey || pre-image)) # Verify Script with flags=standard flags, scriptSig=script sig, scriptPubKey=scriptPubKey, witness=witness program, and sighash=sighash # Return VALID if verify succeeds, otherwise return INVALID Repeat the above operation for each scriptPubKey, retaining the scriptPubKeys set. As noted, if the same scriptPubKey appears more than once, the verify operation must fail with an ERROR. * If a verification call returns ERROR or INVALID, return ERROR or INVALID immediately, ignoring as yet unverified entries. * After all verifications complete, return INCONCLUSIVE if any verification call returned INCONCLUSIVE. * Return VALID if and only if every verification returned VALID. == Future Extensions == === Proof of Funds === The specification can be extended to handle proof of funds in the following manner: * Let the message be prefixed with "POF:", followed by a newline-terminated stringWhy not just the UTXO data? We want the verifier to be able to challenge the prover with a custom message to sign, or anyone can reuse the POF proof for a set of UTXO:s once they have seen it, and the funds have not yet been spent, followed by [entries] series of hex-encoded transaction ID:vout pairs, separated by a single space (" ") character * Fail if the number of txid:vout pairs is not exactly equal to [entries] * Retain the message as is for all sighash operations (i.e. all sign and verify operations should sign and verify the entire list of UTXO:s)Why use same sighash? The prover is proving that they have a set of UTXO:s at their disposal. Taking a sub-set of the proofs and turning them into a new proof should not be valid. * Add a verification that the txid/vout is a valid UTXO according to a synced up Bitcoin node, and that its corresponding scriptPubKey matches the one given by the proof. Return ERROR if scriptPubKey mismatch, and SPENT error if spent * Extend the scriptPubKeys set check to only fail if the same scriptPubKey and proof-of-funds txid/vout combination is encountered == Compatibility == This specification is not backwards compatible with the legacy signmessage/verifymessage specification. However, legacy addresses (1...) may be used in this implementation without any problems. == Rationale == == Reference implementation == To do. == Acknowledgements == TODO == References == # Original mailing list thread: https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2018-March/015818.html == Copyright == This document is licensed under the Creative Commons CC0 1.0 Universal license. --- -Kalle.