6 ms·

An incomplete guide to stealth addresses

116 points by DocFeind 4y ago

crecker 4y ago
Thanks for the article. If you're a newbie and want to learn about stealth address, I'd suggest also https://serhack.me/articles/what-is-stealth-address-technology-monero/ https://serhack.me/articles/what-is-stealth-address-technolo...
- LelouBil 4y ago
  I was looking for an article about this, thanks !
lysergia 4y ago
> Basic stealth addresses can be implemented fairly quickly today, and could be a significant boost to practical user privacy on Ethereum. They do require some work on the wallet side to support them So how easy is it realistically? I hope it's not going to un-ergonomic like PGP where novices are sometimes seeing to be pasting their private key into e-mails and sending things in plaintext which should have been ciphertext, or otherwise leaking info. I imagine you have to be really careful not to mess things up here.
- zaroth 4y ago
  There’s no reason for there to be any sharp edges or foot guns. The “meta-address” published by the receiver has everything in it needed to generate a one time address on the sender side, and it should all “just work” from a sender’s wallet perspective once a standard is reached. There’s nothing a sender can do wrong really unless the wallet code is broken. On the receiver side the private key will never look like an “address” so it would be hard to confuse the two.
- westurner 4y ago
  Oh, there's WKD: Web Key Directory https://wiki.gnupg.org/WKD#How_does_an_email_client_use_WKD.3F https://wiki.gnupg.org/WKD#How_does_an_email_client_use_WKD.... gpg --homedir "$(mktemp -d)" --verbose --locate-keys your.email@example.org https://example.org/.well-known/openpgpkey/hu/0t5sewh54rxz33fwmr8u6dy4bbz8itz2 Is there a pinned certificate for `gpg recv-keys` (that isn't possible with WKD) https://en.wikipedia.org/wiki/Key_server_(cryptographic)#Problems_with_keyservers https://en.wikipedia.org/wiki/Key_server_(cryptographic)#Pro... ? WKD and HKP depend upon TLS and preshared CA certs (PKI or pinned certificates) in all forms AFAIU: # HKP, HTTPS gpg --recv-keys an.email@example.org # WKD gpg --locate-keys your.email@example.org Who is trusted with read/write to all keys on the HTTP pubkey server? W3C DIDs are encodable into QR codes, too. And key hierarchy is optional with DIDs. (Edit) https://www.w3.org/TR/did-core/#did-controller https://www.w3.org/TR/did-core/#did-controller : > DID Controller > A DID controller is an entity that is authorized to make changes to a DID document. The process of authorizing a DID controller is defined by the DID method. > The controller property is OPTIONAL. If present, the value MUST be a string or a set of strings that conform to the rules in 3.1 DID Syntax. The corresponding DID document(s) SHOULD contain verification relationships that explicitly permit the use of certain verification methods for specific purposes. > When a controller property is present in a DID document, its value expresses one or more DIDs. Any verification methods contained in the DID documents for those DIDs SHOULD be accepted as authoritative, such that proofs that satisfy those verification methods are to be considered equivalent to proofs provided by the DID subject. /? "Certificate Transparency" blockchain / dlt ... QKD, ... Web Of Trust and temp keys What does Interledger Protocol say about these an in-band / in-channel signaling around transactions? https://westurner.github.io/hnlog/ https://westurner.github.io/hnlog/ Ctrl-F "SPSP" > https://github.com/interledger/rfcs/blob/master/0009-simple-payment-setup-protocol/0009-simple-payment-setup-protocol.md#relation-to-other-protocols https://github.com/interledger/rfcs/blob/master/0009-simple-... : > Relation to Other Protocols: SPSP is used for exchanging connection information before an ILP payment or data transfer is initiated RFC 8905 specifies "The 'payto:' URI Scheme for Payments" and does support ILP addresses https://www.rfc-editor.org/rfc/rfc8905.html#name-tracking-payment-target-typ https://www.rfc-editor.org/rfc/rfc8905.html#name-tracking-pa... https://datatracker.ietf.org/doc/rfc8905/ https://datatracker.ietf.org/doc/rfc8905/ : > 7. Tracking Payment Target Types > A registry of "Payto Payment Target Types" is described in Section 10. The registration policy for this registry is "First Come First Served", as described in [RFC8126]. When requesting new entries, careful consideration of the following criteria [...] DID URIs are probably also already payto: URI-scheme compatible but not yet so registered? ILP Addresses - v2.0.0 https://interledger.org/rfcs/0015-ilp-addresses/ https://interledger.org/rfcs/0015-ilp-addresses/ : > ILP addresses provide a way to route ILP packets to their intended destination through a series of hops, including any number of ILP Connectors. (This happens after address lookup using a higher-level protocol such as SPSP.) Addresses are not meant to be user-facing, but allow several ASCII characters for easy debugging.
voz_ 4y ago
[flagged]
- agravier 4y ago
  Ad hominem arguments don't work very well on this crowd, fortunately. Try criticizing the substance of the article.
alexbakers 4y ago
Stealth addresses are beneficial for large amounts. For example: - 0x1... stealth address have 5USDC - 0x2... stealth address have 5USDC - 0x3... stealth address have 5USDC Now I want to pay 9USDC to 0x4..., how do I do that? 0x1... -> 0x4... = 3USDC (gas transfer ERC20 ~2USDC) 0x2... -> 0x4... = 3USDC (gas transfer ERC20 ~2USDC) 0x3... -> 0x4... = 3USDC (gas transfer ERC20 ~2USDC) And since you spend from different addresses in one transaction, in theory you can reveal your identity.
- zaroth 4y ago
  These types of addresses are useful for publishing static directions for receiving payment (what they call a “meta-address”) that doesn’t then reveal every transaction that has been sent to it. It is orthogonal to / does not impact sender privacy whatsoever, and likewise doesn’t help the receiver maintain privacy when they try to spend those coins if they get intermingled with other coins that could be tracked.
- ETH_start 4y ago
  Even if 0x4... is also a meta address, and you send the USDC to three different stealth addresses derived from the meta 0x4... instead of to 0x4..., the three transactions could be linked to you by observing the timing of the first and second batch, and noticing they were all sent together both times. But still, it's definitely better than the current horrible status quo, where users don't have even the most rudimentary protection against having their privacy compromised.
deanCommie 4y ago
> Suppose that Alice wants to send Bob an asset. This could be some quantity of cryptocurrency (eg. 1 ETH, 500 RAI), or it could be an NFT. When Bob receives the asset, he does not want the entire world to know that it was he who got it. Except we live in a society. Whose cohesion requires us to be able to verify that: * Bob did not receive an asset that Alice previously stole from Carol * If Bob received an asset as income, then he needs to pay a portion of it in taxes to continue receiving water, sanitation, emergency services, etc. * The asset Bob received isn't evidence of a crime (such as terrorism or child pornography), that while Bob may not have committed, his desire to receive it generated the demand that incentivized the commission of the crime. Privacy is important. Don't get me wrong, I am certainly aware the same arguments can be made to weaken end to end encryption in communication, and things like terrorism & CP are frequently used as scare tactics to remove civil liberties and infringe on people's privacy. But it's also important to acknowledge that when building a decentralized financial system as folks are keen to do with Etherium, you are replacing something that is one of the core building blocks of our society.
- f38zf5vdt 4y ago
  When I order a cheeseburger and pay with cash, the clerk is always cautious to ensure that the cash I provide wasn't previously stolen. After enjoying my meal, I always make sure to thoroughly investigate the diner after to ensure that they pay their fair share of taxes.
  - burnished 4y ago
    Granted. What about when you make a transaction over 10k?
    - f38zf5vdt 4y ago
      $10k today, or in 40 years when that's how much I need to pay for a cheeseburger?
      - burnished 4y ago
unwind 4y ago
Meta: I think this title would benefit from an "Ethereum:" prefix, or something. As written, it's not at all clear what the context and topic are, unless you're supposed to recognize that from the domain name (I did not, and I would say it's not a domain seen often on the front page).
- deleted 4y ago
  [deleted]
- pvg 4y ago
  It's fine for titles not to be completely self-explanatory https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=by%3Adang%20%22work%20a%20little%22&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
kdragon 4y ago
TLDR: - Create two keypairs. - Use ECDH to derive a shared secret. - Use secret to tweak pubkey of the recipient. - Send money to the tweaked (and hashed) pubkey. - Recipient has to keep an eye out for this tweaked key on the blockchain.
joshspankit 4y ago
> Inserting memes of 2017-era (or older) crypto scam figures is an important technique that writers can use to signal erudition and respectableness... Possibly my favourite part of the article
micropresident 4y ago
I've already built a fully working prototype of all of this, and am looking for funding to complete it. It also supports a number of other things such as pay-to-mail that have been talked about for years. https://web.stampchat.io https://web.stampchat.io

116 points by DocFeind 4y ago

Thanks for the article. If you're a newbie and want to learn about stealth address, I'd suggest also https://serhack.me/articles/what-is-stealth-address-technology-monero/ https://serhack.me/articles/what-is-stealth-address-technolo...

LelouBil 4y ago
I was looking for an article about this, thanks !

lysergia 4y ago

> Basic stealth addresses can be implemented fairly quickly today, and could be a significant boost to practical user privacy on Ethereum. They do require some work on the wallet side to support them So how easy is it realistically? I hope it's not going to un-ergonomic like PGP where novices are sometimes seeing to be pasting their private key into e-mails and sending things in plaintext which should have been ciphertext, or otherwise leaking info. I imagine you have to be really careful not to mess things up here.

zaroth 4y ago
There’s no reason for there to be any sharp edges or foot guns. The “meta-address” published by the receiver has everything in it needed to generate a one time address on the sender side, and it should all “just work” from a sender’s wallet perspective once a standard is reached. There’s nothing a sender can do wrong really unless the wallet code is broken. On the receiver side the private key will never look like an “address” so it would be hard to confuse the two.
westurner 4y ago
Oh, there's WKD: Web Key Directory https://wiki.gnupg.org/WKD#How_does_an_email_client_use_WKD.3F https://wiki.gnupg.org/WKD#How_does_an_email_client_use_WKD.... gpg --homedir "$(mktemp -d)" --verbose --locate-keys your.email@example.org https://example.org/.well-known/openpgpkey/hu/0t5sewh54rxz33fwmr8u6dy4bbz8itz2 Is there a pinned certificate for `gpg recv-keys` (that isn't possible with WKD) https://en.wikipedia.org/wiki/Key_server_(cryptographic)#Problems_with_keyservers https://en.wikipedia.org/wiki/Key_server_(cryptographic)#Pro... ? WKD and HKP depend upon TLS and preshared CA certs (PKI or pinned certificates) in all forms AFAIU: # HKP, HTTPS gpg --recv-keys an.email@example.org # WKD gpg --locate-keys your.email@example.org Who is trusted with read/write to all keys on the HTTP pubkey server? W3C DIDs are encodable into QR codes, too. And key hierarchy is optional with DIDs. (Edit) https://www.w3.org/TR/did-core/#did-controller https://www.w3.org/TR/did-core/#did-controller : > DID Controller > A DID controller is an entity that is authorized to make changes to a DID document. The process of authorizing a DID controller is defined by the DID method. > The controller property is OPTIONAL. If present, the value MUST be a string or a set of strings that conform to the rules in 3.1 DID Syntax. The corresponding DID document(s) SHOULD contain verification relationships that explicitly permit the use of certain verification methods for specific purposes. > When a controller property is present in a DID document, its value expresses one or more DIDs. Any verification methods contained in the DID documents for those DIDs SHOULD be accepted as authoritative, such that proofs that satisfy those verification methods are to be considered equivalent to proofs provided by the DID subject. /? "Certificate Transparency" blockchain / dlt ... QKD, ... Web Of Trust and temp keys What does Interledger Protocol say about these an in-band / in-channel signaling around transactions? https://westurner.github.io/hnlog/ https://westurner.github.io/hnlog/ Ctrl-F "SPSP" > https://github.com/interledger/rfcs/blob/master/0009-simple-payment-setup-protocol/0009-simple-payment-setup-protocol.md#relation-to-other-protocols https://github.com/interledger/rfcs/blob/master/0009-simple-... : > Relation to Other Protocols: SPSP is used for exchanging connection information before an ILP payment or data transfer is initiated RFC 8905 specifies "The 'payto:' URI Scheme for Payments" and does support ILP addresses https://www.rfc-editor.org/rfc/rfc8905.html#name-tracking-payment-target-typ https://www.rfc-editor.org/rfc/rfc8905.html#name-tracking-pa... https://datatracker.ietf.org/doc/rfc8905/ https://datatracker.ietf.org/doc/rfc8905/ : > 7. Tracking Payment Target Types > A registry of "Payto Payment Target Types" is described in Section 10. The registration policy for this registry is "First Come First Served", as described in [RFC8126]. When requesting new entries, careful consideration of the following criteria [...] DID URIs are probably also already payto: URI-scheme compatible but not yet so registered? ILP Addresses - v2.0.0 https://interledger.org/rfcs/0015-ilp-addresses/ https://interledger.org/rfcs/0015-ilp-addresses/ : > ILP addresses provide a way to route ILP packets to their intended destination through a series of hops, including any number of ILP Connectors. (This happens after address lookup using a higher-level protocol such as SPSP.) Addresses are not meant to be user-facing, but allow several ASCII characters for easy debugging.

voz_ 4y ago

[flagged]

agravier 4y ago
Ad hominem arguments don't work very well on this crowd, fortunately. Try criticizing the substance of the article.

alexbakers 4y ago

Stealth addresses are beneficial for large amounts. For example: - 0x1... stealth address have 5USDC - 0x2... stealth address have 5USDC - 0x3... stealth address have 5USDC Now I want to pay 9USDC to 0x4..., how do I do that? 0x1... -> 0x4... = 3USDC (gas transfer ERC20 ~2USDC) 0x2... -> 0x4... = 3USDC (gas transfer ERC20 ~2USDC) 0x3... -> 0x4... = 3USDC (gas transfer ERC20 ~2USDC) And since you spend from different addresses in one transaction, in theory you can reveal your identity.

zaroth 4y ago
These types of addresses are useful for publishing static directions for receiving payment (what they call a “meta-address”) that doesn’t then reveal every transaction that has been sent to it. It is orthogonal to / does not impact sender privacy whatsoever, and likewise doesn’t help the receiver maintain privacy when they try to spend those coins if they get intermingled with other coins that could be tracked.
ETH_start 4y ago
Even if 0x4... is also a meta address, and you send the USDC to three different stealth addresses derived from the meta 0x4... instead of to 0x4..., the three transactions could be linked to you by observing the timing of the first and second batch, and noticing they were all sent together both times. But still, it's definitely better than the current horrible status quo, where users don't have even the most rudimentary protection against having their privacy compromised.

deanCommie 4y ago

> Suppose that Alice wants to send Bob an asset. This could be some quantity of cryptocurrency (eg. 1 ETH, 500 RAI), or it could be an NFT. When Bob receives the asset, he does not want the entire world to know that it was he who got it. Except we live in a society. Whose cohesion requires us to be able to verify that: * Bob did not receive an asset that Alice previously stole from Carol * If Bob received an asset as income, then he needs to pay a portion of it in taxes to continue receiving water, sanitation, emergency services, etc. * The asset Bob received isn't evidence of a crime (such as terrorism or child pornography), that while Bob may not have committed, his desire to receive it generated the demand that incentivized the commission of the crime. Privacy is important. Don't get me wrong, I am certainly aware the same arguments can be made to weaken end to end encryption in communication, and things like terrorism & CP are frequently used as scare tactics to remove civil liberties and infringe on people's privacy. But it's also important to acknowledge that when building a decentralized financial system as folks are keen to do with Etherium, you are replacing something that is one of the core building blocks of our society.

f38zf5vdt 4y ago
When I order a cheeseburger and pay with cash, the clerk is always cautious to ensure that the cash I provide wasn't previously stolen. After enjoying my meal, I always make sure to thoroughly investigate the diner after to ensure that they pay their fair share of taxes.
- burnished 4y ago
  Granted. What about when you make a transaction over 10k?
  - f38zf5vdt 4y ago
    $10k today, or in 40 years when that's how much I need to pay for a cheeseburger?
    - burnished 4y ago

unwind 4y ago

Meta: I think this title would benefit from an "Ethereum:" prefix, or something. As written, it's not at all clear what the context and topic are, unless you're supposed to recognize that from the domain name (I did not, and I would say it's not a domain seen often on the front page).

deleted 4y ago
[deleted]
pvg 4y ago
It's fine for titles not to be completely self-explanatory https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=by%3Adang%20%22work%20a%20little%22&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

kdragon 4y ago

TLDR: - Create two keypairs. - Use ECDH to derive a shared secret. - Use secret to tweak pubkey of the recipient. - Send money to the tweaked (and hashed) pubkey. - Recipient has to keep an eye out for this tweaked key on the blockchain.

joshspankit 4y ago

> Inserting memes of 2017-era (or older) crypto scam figures is an important technique that writers can use to signal erudition and respectableness... Possibly my favourite part of the article

micropresident 4y ago

I've already built a fully working prototype of all of this, and am looking for funding to complete it. It also supports a number of other things such as pay-to-mail that have been talked about for years. https://web.stampchat.io https://web.stampchat.io