On 01/13/2014 03:14 PM, Peter Todd wrote:
> On Mon, Jan 13, 2014 at 02:59:08PM -0500, Alan Reiner wrote:
>> How is this different from the proposal I have made?
>>
>> You distribute the root public key (but not chaincode!) of a BIP32
>> branch.  You can put your root key on a business card if you want.  Then
>> when someone wants to pay you, you simply give them the multiplier and
>> root key (they already have the root key, but should verify).  The
>> multiplier does not reveal the chaincode, thus keeping it private, but
>> it does allow them to confirm that the final address they are paying is
>> derived from that root key they know belongs to you ("Please pay address
>> X; oh btw, X=rootKey*mult").
>>
>> You can /choose/ to reveal that a given payment address is linked to
>> your root key without any compromise of privacy.  Or you can choose to
>> ignore it and just give them a bare address the old way and still
>> maintain privacy.  What advantages does "stealth addresses" have over
>> this scheme?  You could extend it using some kind of deterministic
>> sub-branching and/or ECDH to create multiple payment addresses without
>> querying the payee.
>
> Basically stealth addresses *are* your scheme, using the blockchain as a
> low or even no overhead communication channel for the payor to give the
> payee that multiplier without bidirectional communication.
>
> In the business card example I can't easily take your business card and
> just send you some money without that transaction being linked to public
> information. (your business card)

It's not public.  When I say "please pay me" I also say "use this multiplier".  The multiplier isn't published, and it's not publicly discoverable without my wallet (or access to my email).  The address remains private between you and me.  As you said, it could be discoverable if the email is discoverable, but I'm not seeing how how critical that really is.

There's a lot of complexity around this constraint (possibly involving new/secondary private keys, extra outputs, relying on change outputs, and/or using 3rd parties to help look for transactions).  I'm not convinced that what is being gained is really worth that extra complexity.

By contrast, what I proposed, that does require sending sending the payer a multiplier once, is easy to implement in any BIP 32 wallet, doesn't require any special address formats, and achieves 98% of the same benefits without any special computation.   I guess I'm just not convinced that it's really necessary for people to be able to send others payments without contacting them (and/or hiding the evidence a payment was made even if they communications were discovered).

-Alan