Re: [Bitcoin-development] Double-Spending Fast Payments in Bitcoin due to Client versions 0.8.1

2013-06-27 Thread Gregory Maxwell
On Thu, Jun 27, 2013 at 9:03 AM, Arthur Gervais wrote: > affecting the same Bitcoin version. However we think it is > complementary, since our reported problem has nothing to do with fees, > dust, nor is it necessary to send the two double-spending transaction at > the same time. In our setting, d

Re: [Bitcoin-development] Double-Spending Fast Payments in Bitcoin due to Client versions 0.8.1

2013-06-27 Thread Jeff Garzik
On Thu, Jun 27, 2013 at 12:03 PM, Arthur Gervais wrote: > Our only intention is to raise the awareness for merchants who have to > accept zero-confirmation transactions. They should be aware of the > signature encoding difference between Bitcoin versions and the possible > consequences. Certainly

Re: [Bitcoin-development] Double-Spending Fast Payments in Bitcoin due to Client versions 0.8.1

2013-06-27 Thread Arthur Gervais
On 6/27/13 1:04 PM, Gregory Maxwell wrote: > On Thu, Jun 27, 2013 at 3:23 AM, Arthur Gervais > wrote: >> -BEGIN PGP SIGNED MESSAGE- >> Hash: SHA1 >> >> Dear Bitcoin developers, >> >> We would like to report a vulnerability which might lead, under some >> assumptions, to a double-spending a

Re: [Bitcoin-development] Double-Spending Fast Payments in Bitcoin due to Client versions 0.8.1

2013-06-27 Thread Gregory Maxwell
On Thu, Jun 27, 2013 at 3:23 AM, Arthur Gervais wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Dear Bitcoin developers, > > We would like to report a vulnerability which might lead, under some > assumptions, to a double-spending attack in a fast payment scenario. > The vulnerability

[Bitcoin-development] Double-Spending Fast Payments in Bitcoin due to Client versions 0.8.1

2013-06-27 Thread Arthur Gervais
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Dear Bitcoin developers, We would like to report a vulnerability which might lead, under some assumptions, to a double-spending attack in a fast payment scenario. The vulnerability has been introduced due to signature encoding incompatibilities betwee