-
Notifications
You must be signed in to change notification settings - Fork 2
Proof of Payment
I've been thinking about how a person can prove that she has made a payment. I came up with an idea I call Proof of Payment (PoP) and I would highly appreciate your comments. Please contact me using the contact details at the end of this page.
There are several scenarios in which it would be useful to prove that you have paid for something. For example:
- A pre-paid hotel room where your PoP functions as a key to the door.
- An online video rental service where you pay for a video and watch it on any device.
- An ad-sign where you pay in advance for e.g. 2-weeks exclusivity. During this period you can upload new content to the sign whenever you like using PoP.
- A lottery where all participants pay to the same address, and the winner of the T-shirt is selected among the transactions to that address. You exchange the T-shirt for a PoP for the winning transaction.
These use cases can be achieved without any personal information (no accounts, no e-mails, etc) being involved.
Desirable properties:
- A PoP should be generated on demand.
- It should only be usable once to avoid issues due to theft.
- It should be able to create a PoP for any payment, regardless of script type (P2SH, P2PKH, etc.).
Current methods of proving a payment, as I know of:
- BIP0070, The PaymentRequest together with the transactions fulfilling the payment makes some sort of proof. However, it does not meet 1 or 2 and it obviously only meets 3 if the payment is made through BIP0070. Also, there's no standard way to request/provide the proof.
- Signing messages, chosen by the entity that the proof is provided to, with the private keys used to sign the transaction. This could meet 1 and 2 but probably not 3. This is not standardized either.
A demo of this is available at http://www.rosenbaum.se:8080. There is one site for prodnet and one site for testnet. Please try it out and tell me what you think. Contact details are at the end of this page.
A proof of payment for a transaction T, PoP(T), is used to prove that one has ownership of the credentials needed to unlock all the inputs of T. It has the exact same structure as a bitcoin transaction with the same inputs and outputs as T and in the same order as in T. There is also one OP_RETURN output with 0 value inserted at index 0. This output must have the following format:
OP_RETURN <version> <txid> <nonce>
| Field | Size [B] | Description |
|---|---|---|
<version> |
2 |
Version, currently 1 |
<txid> |
32 |
The transaction to Prove |
<nonce> |
6 |
Unsigned integer |
If the outputs of T contains an OP_RETURN output, that output must not be included in the PoP. There can only be one OP_RETURN output in a transaction. The value of that OP_RETURN output is instead added to the output at index 0.
An illustration of the PoP data structure and its original payment is shown below.
T
+----------------------------------------------+
|inputs | outputs |
| | Value Script |
+----------------------------------------------+
|input 0 | 0 pay to A |
|input 1 | 2 OP_RETURN <some data> |
|. | 1 pay to B |
|. | 4 pay to C |
|input n | |
| | |
+----------------------------------------------+
PoP(T)
+-----------------------------------------------------+
|inputs | outputs |
| | Value Script |
+-----------------------------------------------------+
|input 0 | 2 OP_RETURN <version> <txid> <nonce> |
|input 1 | 0 pay to A |
|. | 1 pay to B |
|. | 4 pay to C |
|input n | |
| | |
+-----------------------------------------------------+
The PoP is signed using the same signing process that is used for bitcoin transactions. The purpose of the nonce is to make it harder to use a stolen PoP; Once the PoP has reached the destination, that PoP is useless since the server will generate a new nonce for every PoP.
The reason to include all the outputs of T in the outputs of the PoP is that if the PoP, accidently or maliciously, enters the bitcoin p2p network, it would have the same effect as a double spend attempt. If that double spend ends up on the blockchain it will not alter the payments of T.
- A proof of payment request is sent from the server to the
wallet. The request contains:
- a random nonce
- a destination where to send the PoP, for example a https URL
- data hinting the wallet which transaction to create a proof
for. For example:
- txid, if known by the server
- PaymentRequest.PaymentDetails.merchant_data (in case of a BIP0070 payment)
- amount
- label, message or other information from a BIP0021 URL
- The wallet identifies the transaction T, if possible. Otherwise asks the user to select among the ones that fit the hints in 1.iii.
- The wallet creates an unsigned PoP (UPoP) for T, and asks the user to sign it.
- The user confirms
- The UPoP(T) is signed by the wallet, creating PoP(T).
- The PoP is sent to the destination in 1.ii.
- The server receiving the PoP validates it and responds with “valid” or “invalid”.
- The wallet displays the response in some way to the user.
Remarks:
- The method of transferring the PoP request at step 1 is not specified here. Instead that is specified in separate specifications. See [btcpop scheme](btcpop scheme).
- The nonce must be randomly generated by the server for every new PoP request.
The server needs to validate the PoP and reply with “valid” or “invalid”. That process is outlined below:
- Check the format of the PoP. It must pass normal transaction checks, except that the inputs may already be spent.
- Check the PoP output at index 0. It must conform to the OP_RETURN output format outlined above.
- Check that the rest of the outputs exactly corresponds to the outputs of T and that they appear in the same order as in T. An exception to this is that any OP_RETURN outputs of T must not be included in the PoP. All output value from the OP_RETURN must instead be set on to the output at index 0 of the PoP.
- Check that the nonce is the same as the one you requested.
- Check that the inputs of the PoP are exactly the same as in transaction T, and in the same order. The ordering requirement is for clarity and simplicity.
- Check the signatures of all the inputs, as would be done on a normal transaction.
- Check that the txid in the PoP output is the transaction you actually want proof for. If you don’t know what transaction you want proof for, check that the transaction actually pays for the product/service you deliver (in the video rental case, find the transaction among all payments for that specific video).
- If the signatures are valid, the PoP is valid.
- Someone can intercept the PoP-request and change the destination so that the user sends the PoP to the bad actor.
- Someone can intercept the PoP-request and change for example the txid to trick the user to sign a PoP for another transaction than the intended. This can of course be avoided by actually looking at the UPoP before signing it. The bad actor could also set hints for a transaction that the user didn’t make, resulting in a broken service.
- Someone can steal a PoP and try to use the service hoping to get a matching nonce. Probability per try: 1/(2^48). The server should have a mechanism for detecting a brute force attack of this kind, or at least slow down the process by delaying the PoP request by some 100 ms or so.
- Even if a wallet has no funds it might still be valuable as a generator for PoPs. This makes it important to keep the security of the wallet after it has been emptied.
The first two issues are the same as for traditional bitcoin payments. They could be mitigated by using secure connections and possibly also extending BIP0070 to support PoPs.
- Figure out how to make use of, and extend, BIP0070 for the purpose of PoPs
- Define an extension for BIP0021 to support PoP requests (something along the lines of BIP0072) ([done](btcpop scheme))
- Implement a proof-of-concept (done)
- Possibly propose BIPs for the different parts.
I would highly appreciate your feedback on any of the following channels:
- Twitter: @kallerosenbaum
- Email: [email protected]
- Bitcoin: 1P1TQZmJ9C2o8ywG7afEKQmgAnoKPEjhu5