From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from sog-mx-4.v43.ch3.sourceforge.com ([172.29.43.194] helo=mx.sourceforge.net) by sfs-ml-4.v29.ch3.sourceforge.com with esmtp (Exim 4.76) (envelope-from ) id 1YJWP6-0003hq-3Q for bitcoin-development@lists.sourceforge.net; Fri, 06 Feb 2015 00:04:12 +0000 Received-SPF: pass (sog-mx-4.v43.ch3.sourceforge.com: domain of gmail.com designates 209.85.216.174 as permitted sender) client-ip=209.85.216.174; envelope-from=martin.habovstiak@gmail.com; helo=mail-qc0-f174.google.com; Received: from mail-qc0-f174.google.com ([209.85.216.174]) by sog-mx-4.v43.ch3.sourceforge.com with esmtps (TLSv1:RC4-SHA:128) (Exim 4.76) id 1YJWP3-000161-Kj for bitcoin-development@lists.sourceforge.net; Fri, 06 Feb 2015 00:04:12 +0000 Received: by mail-qc0-f174.google.com with SMTP id s11so9292011qcv.5 for ; Thu, 05 Feb 2015 16:04:04 -0800 (PST) MIME-Version: 1.0 X-Received: by 10.224.98.143 with SMTP id q15mr1797450qan.29.1423181044227; Thu, 05 Feb 2015 16:04:04 -0800 (PST) Received: by 10.140.19.18 with HTTP; Thu, 5 Feb 2015 16:04:04 -0800 (PST) In-Reply-To: <54D400F0.9090406@voskuil.org> References: <54D3D636.1030308@voskuil.org> <279489A5-1E46-48A2-8F58-1A25821D4D96@gmail.com> <6AEDF3C4-DEE0-4E31-83D0-4FD92B125452@voskuil.org> <54D3FB4A.9010105@voskuil.org> <54D400F0.9090406@voskuil.org> Date: Fri, 6 Feb 2015 01:04:04 +0100 Message-ID: From: =?UTF-8?B?TeKStnJ0aW4gSOKStmJv4pOLxaF0aWFr?= To: Eric Voskuil Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: -1.6 (-) X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. -1.5 SPF_CHECK_PASS SPF reports sender host as permitted sender for sender-domain 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider (martin.habovstiak[at]gmail.com) -0.0 SPF_PASS SPF: sender matches SPF record -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature X-Headers-End: 1YJWP3-000161-Kj Cc: Bitcoin Dev , Paul Puey Subject: Re: [Bitcoin-development] Proposal for P2P Wireless (Bluetooth LE) transfer of Payment URI X-BeenThere: bitcoin-development@lists.sourceforge.net X-Mailman-Version: 2.1.9 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 06 Feb 2015 00:04:12 -0000 That's exactly what I though when seeing the RedPhone code, but after I studied the commit protocol I realized it's actually secure and convenient way to do it. You should do that too. :) Shortly, how it works: The initiator of the connection sends commit message containing the hash of his temporary public ECDH part, second party sends back their public ECDH part and then initiator sends his public ECDH part in open. All three messages are hashed together and the first two bytes are used to select two words from a shared dictionary which are displayed on the screen of both the initiator and the second party. The parties communicate those two words and verify they match. If an attacker wants to do MITM, he has a chance of choosing right public parts 1:65536. There is no way to brute-force it, since that would be noticed immediately. If instead of two words based on the first two bytes, four words from BIP39 wordlist were chosen, it would provide entropy of 44 bits which I believe should be enough even for paranoid people. How this would work in Bitcoin payment scenario: user's phone broadcasts his name, merchant inputs amount and selects the name from the list, commit message is sent (and then the remaining two messages), merchant spells four words he sees on the screen and buyer confirms transaction after verifying that words match. 2015-02-06 0:46 GMT+01:00 Eric Voskuil : > On 02/05/2015 03:36 PM, M=E2=92=B6rtin H=E2=92=B6bo=E2=93=8B=C5=A1tiak wr= ote: >>> A BIP-70 signed payment request in the initial broadcast can resolve th= e >>> integrity issues, but because of the public nature of the broadcast >>> coupled with strong public identity, the privacy compromise is much >>> worse. Now transactions are cryptographically tainted. >>> >>> This is also the problem with BIP-70 over the web. TLS and other >>> security precautions aside, an interloper on the communication, desktop= , >>> datacenter, etc., can capture payment requests and strongly correlate >>> transactions to identities in an automated manner. The payment request >>> must be kept private between the parties, and that's hard to do. >> >> What about using encryption with forward secrecy? Merchant would >> generate signed request containing public ECDH part, buyer would send >> back transaction encrypted with ECDH and his public ECDH part. If >> receiving address/amount is meant to be private, use commit protocol >> (see ZRTP/RedPhone) and short authentication phrase (which is hard to >> spoof thanks to commit protocol - see RedPhone)? > > Hi Martin, > > The problem is that you need to verify the ownership of the public key. > A MITM can substitute the key. If you don't have verifiable identity > associated with the public key (PKI/WoT), you need a shared secret (such > as a secret phrase). But the problem is then establishing that secret > over a public channel. > > You can bootstrap a private session over the untrusted network using a > trusted public key (PKI/WoT). But the presumption is that you are > already doing this over the web (using TLS). That process is subject to > attack at the CA. WoT is not subject to a CA attack, because it's > decentralized. But it's also not sufficiently deployed for some scenarios= . > > e >