On Tue, Dec 4, 2012 at 9:23 PM, Gregory Maxwell <gmaxw...@gmail.com> wrote: > On Tue, Dec 4, 2012 at 10:06 PM, Mike Koss <m...@coinlab.com> wrote: >> I've implemented an alternative to the BIP 32 proposal. I wanted a system >> based on a hierarchical string representation (rather than hierarchy of >> integers as BIP 32 proposes). For example I name keys like this: >> >> [hd1.75491111].store.1. 1D7GM5dkUtxvGeWgn7SYtanBuyj1MD1EZy >> [hd1.75491111].store.2. 1QAqDbzpNKViGSjVe1XmnGbmZtvz5hM7t1 >> [hd1.75491111].store.3. 14XkSN92QLGeorYPpoVbG87DQhowEx3mFn >> [hd1.75491111].store.4. 1JLcGdod6Wm33rMZuZZUmAEE6osLhM4QMn >> >> First draft of proposal: >> >> https://gist.github.com/4211704 > > As Pieter pointed out recently— it's not (realistically) possible to > blindly iterate through strings. This means your proposal loses the > backup recoverablity property which is part the point of a > deterministic wallet: If you have a backup prior to a new string name > being established you must also have a reliable backup of the string > as well.
I would like to note that BIP32 and this new proposal have a missing feature: being able to spend a coin sent to an address generated by this scheme implies being able to spend any coin generated by this scheme. The easiest deterministic wallet construction is simply to use a stream cipher to generate random bytes used as the private keys in a wallet. Hierarchical constructions do not seem to me to add more, other then distinguishing transactions by sending to unique addresses, which could be done by other means. > > Of course, if you're backing up the strings then you can also backup a > map equating the hdwallet indexes to your strings, and in the event of > a catastrophic loss where you are only left with the original ultimate > root you lose no coins (only metadata) with the BIP32 scheme. If, > instead, we have your scheme and the backup of strings is incomplete > then some or all assigned coin may be lost forever. > > Your extended hierarchy of multiplers also makes me uncomfortable. > BIP32 uses a HMAC in its construction to obtain strongly unstructured > points. I read BIP32. And while the multipliers at each level are unstructured, the ones in the next level are products of the ones before i.e. we have a multiplication tree with random looking branches. Note that the order of the basepoint is prime or a small cofactor times a prime, so this isn't an issue (usually: the cofactor could be annoying). -- "Those who would give up Essential Liberty to purchase a little Temporary Safety deserve neither Liberty nor Safety." -- Benjamin Franklin ------------------------------------------------------------------------------ LogMeIn Rescue: Anywhere, Anytime Remote support for IT. Free Trial Remotely access PCs and mobile devices and provide instant support Improve your efficiency, and focus on delivering more value-add services Discover what IT Professionals Know. Rescue delivers http://p.sf.net/sfu/logmein_12329d2d _______________________________________________ Bitcoin-development mailing list Bitcoin-development@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/bitcoin-development
