How do I know who paid me?

[Gavin Andresen]

You CAN encode a message in a currently accepted transaction using the broadband subliminal channel inherent to DSA (and ECDSA).

Googling for 'ECDSA broadband subliminal channel' to figure out what the heck you're talking about...

... doesn't that require that the recipient (as well as the sender) know the private key?
(you encode the message in the 'k' param, which the recipient can only recover using the private key?)

[1715194904]

1715194904

[Gavin Andresen]

Thanks for the link to the wikipedia page in the other thread... so receiver CAN recover 'k' given the public key and signature.

Cool!

That doesn't solve the problem I'd like to solve (because you still need to generate a new keypair for every transaction), but it is cool.

[ByteCoin]

Thanks for the link to the wikipedia page in the other thread... so receiver CAN recover 'k' given the public key and signature.

Thanks for bearing this useful fact in mind.

Another thing to consider, once any coins associated with an address have ever been spent then the public keys associated with that address are public by virtue of the signature in the transaction. If the merchant's public key is available in this fashion then the customer and merchant can generate a shared secret using Diffie-Hellman key agreement or some similar scheme. This shared secret could be used as the "authentication key" mentioned in the wikipedia article.

Of course, if you're thinking of now enabling currently forbidden scripting features then a lot of options become available.

ByteCoin