Hello,
I've made a proposal for a standardized ecies scheme for bitcoin
communication. To address gmaxwell's criticism, I'd like to also
follow up with a proposed change to BIP44, such that a structured
wallet would also include a series of identity keys, both addresses
which will be used for signing, and public keys which would be used
as destinations for encrypted messages.
If anyone is familiar with ECIES and would be interested, there is a
working implementation at http://memwallet.info/btcmssgs.html,
which also includes this whitepaper:
Abstract This document describes a scheme for sending signed encrypted
messages using bitcoin public and private keys. Motivation PGP and
Bitmessage and other secure communications channels exist. This standard
allows for secure messaging using a bitcoin wallet alone, without the need
for other software. This standard allows the owner of an address to
conveniently prove ownership to the holder of another address privately
without the need for separate secure communications channels. Specification:
Message Format In the rest of this text we will assume the public key
cryptography used in Bitcoin. The || operator is concatenation. All
operations are defined over binary, and not text conversion of the data.
When serializing public keys the compressed encoding is always used, even
if the input parameters are passed as uncompressed. Bitcoin addresses are
always serialized from compressed public keys, and for mainnet. (directives
to use testnet or uncompressed keys ignored) String literals are
represented as if for the C programming language in native UTF-8. No
assumptions are made about the payload message format, it may even be
binary. Caveat Decryptor. Plain unformatted text message payloads are
recommended to use utf-8.
- CompactSize format is a variable size little endian length field
serialization format, know as a bitcoin "Variable length integer"
- CompactSizePrefix(X) = CompactSize(X) || X
- QTHASH(x) = SHA256((SHA256( CompactSizePrefix("Bitcoin Signed
Message:\n") || CompactSizePrefix(x) )
This standard assumes the reader is familiar with the bitcoin compact
signature format, which is a 65 byte signature which allows the verifier to
recover the public key associated with the signature, eliminating the need
to send it with the message. Once consequence of this format is that
signatures of tampered messages will nearly always result in some public
key, but it will not be the same as the orignial signing key. The address
of the sender will be provided to enable validation of the signature. The
format is a 1 byte recid, followed by ECDSA R then S values.
- CompactSign( PrivateKey, 32 byte QT Hash ) == 65 byte message
- CompactVerify( 65 byte message, 32 bytes Hash ) public key counterpart
of (PrivateKey)
- ECIES with HMAC_SHA256 for mac, PBKDF2 for KDF
- PBKDF2 is used with 2048 iterations, salt=( "Bitcoin Secure Message"
|| ecies_nonce_publickey )
- AES is used with 256 bit keys, and CFB mode, with a 128 bit feedback
buffer. No padding or envelope, simply a pure byte cipher
- compact_signed_message = 0x01 || CompactSizePrefix(M) ||
Sender_Address || Signature
- compact_unsigned_message = 0x00 || CompactSizePrefix(M)
- Secure message format: ECIES( compact_signed_message or
compact_unsigned_message )
Summary of the functions defined:
- eM = SendMessage( M, Signing_Key, Dest_Pub )
- M,Sender_Address = ReceiveMessage( eM, Decrypting_Key ) It is
acceptable for deterministic nonces to be used for signatures, however
nonces generated for ECIES must be high quality random bytes. (excepting
unit test vectors)
Message Sending Inputs:
- The message to send "M" (treat as precise binary bytes, no space
stripping or normalization)
- The bitcoin private key "Signing_Key" to be used to sign the message
- The bitcoin public key "Dest_Pub" to be used as the destination of the
message Algorithm Calculations:
- Calculate the QTHASH(M) to obtain "M_hash", 32 bytes of data
- if signing Sign with CompactSign(Signing_Key,M_hash) to obtain
"Signature", 65 bytes of data ** Calculate the compressed address of
Signing_Key to obtain "Sender_Address" 21 bytes of data ** Serialize 0x01
|| CompactSizePrefix(M) || Sender_Address || Signature to obtain
"Signed_Message"
- if not signing, instead Serialize 0x00 || CompactSizePrefix(M) to
obtain "Unsigned_Message"
- Generate 32 random bytes "ecies_nonce_bytes"
- Generate a bitcoin private key from ecies_nonce_bytes, "Nonce_Key" 32
bytes of data (retry if invalid)
- Derive the compressed public key of Nonce_Key, "Nonce_Pub", 33 bytes
of data
- ECMultiply Dest_Pub by Nonce_Key to obtain the point
"Shared_Secret_Point"
- Serialize Shared_Secret_Point as a compressed point "Shared_Secret"
- Derive "KeyingBytes" = PBKDF2( Shared_Secret ) to get 80 bytes of data
- Directly Derive "AES256_Key" from the first 32 byte
