Bitcoin Forum

Bitcoin is great, but it misses one thing that usual bank transfers have: payment title.

Perhaps it should be possible to include short (<=512 bytes) message for each transaction.
The message could be encrypted with public/private keys so only the receiver can see its contents.

What do You think ?

PS.
I might be wrong, but the messages could also be used to increase randomness of hashing process by the way, couldn't they ? If not, never mind.

I red somewhere that the kind of keys used in the software supports signature, but not encryption.

Since it is very easy to create a new bitcoin address for each transaction, a paiement label is not necessary.  Just use the bitcoin address as a reference for your message, and transmit it via email or any other way of communication.

Sure it is "not necessary" but still would be useful for people.

Perhaps some people would like to keep one BTC address for some reasons.
Also bigger financial institutions won't really like the idea of different account number for each transation.

What about the increase of the block size, then ?

Even if 512o per transaction is small, it might represent a significative amount since all has to be stored in the block chain.

I will tell You what have i just done.
I clicked "quote", copied the message and pasted it in a text file.

Then, i have truncated the file to 512 bytes, and EDIT: GZIPPED  it. It now takes 329 bytes.
Next, i have bzipped it. Now it takes 288 bytes.

Of course, there is no need for such a long message. Let's try 384 bytes. I used lorem ipsum generator from here: http://lipsum.com/
Results:

I think that maximum ~260-280 bytes per transaction is not bad.

Like grondilu said, encryption isn't possible.

It's possible to modify Bitcoin to send messages. Just create transactions that start with something like this:

The network will accept these, but I don't think your recipient will recognize them unless he is also using your modified Bitcoin.

I found something interesting.

http://stackoverflow.com/questions/1138345/best-compression-algorithm-for-short-text-strings

There is a small OS project on github, which does good compression of short text strings.
http://github.com/antirez/smaz


So we could further get the 384 bytes down to <200 or <175 bytes.

I also wonder if the message has to be taken into account for the hash computation.  Not doing so would allow to delete it later.

I very much don't like this idea of a message.  Since it is not necessary to the protocol, I'm not sure if it would be easy to find a place where it really fits.  I'm not a programmer though.  I'd be curious to have Satoshi's thought on this.

Edit.  I have a funny idea.  Imagine that numeric precision is increased way beyond 8 decimals, say 128 decimals for instance.

What about using those decimals to code your message ?  Somehow you would have a "natural fee" for this service, and we won't have to modify anything from the protocol.

Edit #2.  Gosh I LOVE this idea :)

Edit #3.  We don't need 128 decimals.  Correct me if I'm wrong, but with 32 decimals you can code a 17 characters-longed uncompressed message in a 64 characters set.  (32*log(10)/log(64)  = 7.717)

Yeah, I'm curious of that too.

ECDSA can't encrypt messages, only sign signatures.

It would be unwise to have permanently recorded plaintext messages for everyone to see.  It would be an accident waiting to happen.

If there's going to be a message system, it should be a separate system parallel to the bitcoin network.  Messages should not be recorded in the block chain.  The messages could be signed with the bitcoin address keypairs to prove who they're from.

I think I didn't exactly understand how the system works. So if the messages would be sent together with bitcoin, they will also be permamently stored in the block chain for ages.

It seems you're right, satoshi.

This could be done externally via encrypted jabber, email or any number of other methods.  All that would need to be done to permit a message to be sent that could be associated to a particular transaction is create a summation number of the transaction to be pasted into the short message, followed by the short message either cleartext or by some agreed upon encryption method such as public key encryption and then signed by the same bitcoin key used to sign the transaction.  This message could be sent to the receiver by any method, never to be included inside a block, but can be verified as well as definatively associated with a particular transaction regardless of how the transaction comes to the receiver.

Call it a transaction number and they'll insist that it be different each time.

As bitcoin scales to millions of transactions, the bandwidth requirements of running a generator are going to get quite large. I believe that keeping the transaction size as small as possible is the highest priority.

The more competing generators of bitcoin, the better for it's stability, i guess. Bandwidth is going to be the greatest barrier to running a node.

+1

Also, I'd like to point at that bitcoin should adhere to the KISS philosophy.

It's common nerd knowledge that many software were great at beginning, but tend to become ugly fat cats as users wanted to add many features to it.  Additionnal features that are not required for the protocol, should be part of a separate project.

A better idea would be an encrypted email service for bitcoin users using gpg and pgp encryption.
Then we would have a secure private communication channel.

What do you mean ??

You don't need anything to use GPG, apart from the GPG software.

I mean a service like mailvault. You can hide your bitcoin inside an encrypted message :)

I didn't know about mailvault.  I don't get it :  what's the point of using GPG if you don't own your private key ?  Well, I guess some people just don't like the idea of installing software on their computer...

Anyway, on their "about" page, they mention their distributed offshore servers :  http://www.metropipe.net/

This website accepts an impressive number of methods for paiements, including pecunix for instance.   I guess they might accept bitcoins.

+50 to that.

KISS philosophy is what makes Linux so great.

What bad effect would you anticipate?

This is already sort-of possible with the current system due to the broadband subchannel in ECDSA.

I was looking for ways of distributing arbitrary information in the block chain to support the implementation of a full client which did  not have to bother remembering the entire block chain.
See http://bitcointalk.org/index.php?topic=505.0 - a thread about "Balance Sheets"
A naive way of encoding the data would be based on sending money to a variety of addresses, the data to be decoded by examining let's say the first couple of of bytes of the receiving addresses but this is rather wasteful of bandwidth with many transactions required to transmit relatively little data.

An interesting property of DSA is that if you're trying to sign a 32 byte message then each signature is 64 bytes long. This means that the signature includes 32 bytes of information just created out of thin air. If you look up the algorithm http://en.wikipedia.org/wiki/Digital_Signature_Algorithm , this information comes from the random parameter k. A signature consists of a pair of numbers g^k and another expression involving both k and g^k. If you could choose k such that g^k contained your data then you could include your plaintext data in the block chain in great big chunks. (Un)Fortunately, doing this has to be hard otherwise ECDSA is insecure.

However, if you effectively release the private key then everyone can, through some simple algebra recover the k values used in all your signatures signed with that key. I was not the first to realize this. See http://en.wikipedia.org/wiki/Subliminal_channels.
If you've spent all the money associated with that key then you don't care about it anymore. (Of course if someone sends more money to that key then everyone will race to spend it!) So you can encode a load of data in some normal transactions for days or months or whatever and then effectively release your private key (for which there is an elegant method) and then all the data is plain to see.

Of course my "balance sheet" scheme does not suffer from this problem (if problem it is) so badly   ;)

ByteCoin

Why should we reinvent the wheel when theres an existing way to do things ? When you send a bitcoin to a merchant you also send them a tweet or direct message on twitter!. Twitter allows you to add metadata to tweets http://dev.twitter.com/pages/annotations_overview (http://dev.twitter.com/pages/annotations_overview) .




Surely a bitcoin message would fit in there?  We can define the standard ourselves for how it is done.
I repeat-
What that metadata contains is up to you.

Does this mean you could  also fit your pgp key in that message allowing the merchant to identify you and preventing your message from being read by anyone else?Can you compress things in a way that fits inside the 512 limit?

Because this relies on the twitter infrastructure which is another point of failure. If the Bitcoin infrastructure fails then no Bitcoin payments are possible. If a messaging infrastructure is implemented within the Bitcoin protocol then (under plausible circumstances) the messaging would only fail if the payment infrastructure failed in which case there was no point sending the message anyway. Nothing lost.

If you implement the messaging in twitter then you have to cope with both the additional scenarios in which exactly one of twitter and Bitcoin fail. This would complicate your implementation.
I don't believe that twitter provides a guaranteed quality of service so you would be vulnurable to the human factors whereby support for your metadata is limited or terminated etc...

Considering that the fundamental size of a number used by the elliptic curve cryptography in Bitcoin is 32 bytes, 512 bytes means you can transmit 16 of them in one metadata packet. If you steer clear of the patent-encumbered point compression then a public key or a signature take two slots each and encrypting a one slot message takes four slots if you're keen on security. This still leaves plenty of room for your payload. The details on how much room is left depend on exactly what sort of security guarantees you're trying to achieve.

However, I suspect that a secure public key cryptography system implemented over twitter would be subject to various kinds of interference until rendered unsuitable.

ByteCoin

PS Thanks for the interesting twitter info.

Is there anything stopping a competitor from doing it?

A competitor to whom from doing what?

1. We definately should not use any third-party tools for messaging.
Messaging should be done only using some decentralized protocols.

I mean what will happen if some company buys twitter and concludes that it should not exist and then shuts it down ?
Using external services as the core of bitcoin functionality is just not safe.

2. I agree with Satoshi on this - a separate protocol should be used. Perhaps another P2P protocol, or some messaging protocol like Jabber. Let's stick to the Keep It Simple Stupid (tm) rule.

http://identi.ca/ is what I had in mind. Its based on status.net which is the open source version of twitter. It also lets anyone host their own server.

Still, I keep thinking that if precision is ever increased to about 32 decimals, we could send message using small change.

I think it would be pretty cool.

Edit.  For small amounts, one could divide the transfer in two.  The first part being the message, and the second making the necessary complement.

Let's say for instance I want to transfer one bitcoin with the message 'bitcoin is cool'.

I use a simple 27 characters coding.  'a' is 0, 'b' is 1, 'c' is 2 and so on.  The space character is 26.

Then the decimal representation of 'bitcoin is cool' is :

reduce( lambda a, b: 27*a + b, [11, 14, 14, 2, 26, 18, 8, 26, 13, 8, 14, 2, 19, 8, 1])

which is 1262462588570946134764

then we make two transfers :  one of 0.1262462588570946134764 BTC, and an other one of

1 - 0.1262462588570946134764 = 0.8737537411429053865236  BTC

Wouldn't that be cool ?  :)


Alternatively, if I'm ok with paying a small fee for such a data transmission, I can transfer an amount of :

1.00000000001262462588570946134764

But this is possible only with a 32 decimals precision.

For very very small amounts, it won't be possible.  But I guess no one would want to associate a message to such small transfers.


Edit.  I suspect there are deep implications to this idea.  I think it could be related to Shannon's theory of information.  Somehow, I think it could be possible to consider the smallest bitcoin unit as a "right to transfer a bit of information trough the bitcoin network".  This could help the whole abstract conceptualization of the network.   I will write more about that once it will get clearer in my head.

Is it possible to trigger another program to open when you send or receive a bitcoin?

Sure.  You can use bitcoind in a bash script, for instance.

Is there a transaction that would send back coins from a payee address if coins were received by that address?  I'm thinking of things like activation tokens, which could be bundled with the (token) coins sent back to the payer address.

This idea is relevant since there seems to be consensus in allowing prunable messages in Bitcoin 0.9.

By the way, grondilu, your suggestion of sending messages as part of the Value is very interesting.  For Freicoin, for example, there is a proposal to allow 775 digits after the decimal point.  That would be enough for some substantial text messages.  Or even binary messages.