<p>What if somebody sees the password as the transaction is being relayed around, and makes a new version that transfers your bitcoins to them? If they have better network integration/a higher bandwidth connection, then their version might be able to overtake yours.</p>

CC BY-SA 3.0
2012-11-26T19:52:28.423Z
Yeah, it's better to encrypt a private key and use the password to that. You can even store the encrypted private key in the block chain if you want.
theymos
CC BY-SA 3.0
2012-11-26T22:38:16.173Z
I guess there are then two questions. Whether the password transaction is _possible_ and whether it is _advisable_. The attack you suggest reminds me of double spending. I should think about it, but maybe the same network consensus mechanism that puts double spending in check would be enough to protect the password transaction .
halftimepad
CC BY-SA 3.0
2012-11-27T06:32:48.340Z
Possible: yes; advisable; no. Also, the attack I described is much easier to pull off than double spending, because it doesn't require getting 51% of hashing power. Also, to usefully double-spend, you need some sort of merchant to trust you. This attack can be pulled off by any random person on the internet.
Nick ODell
CC BY-SA 3.0
2012-11-26T19:24:59.647Z
2012-11-26T19:24:59.647Z
Nick ODell
<p>I have been reading about the role of script in transactions and I gather it should be possible to do a Bitcoin transfer to a receiver who knows a password. Instead of checking an address, the script would check that the hash of an input corresponds to the value given by the sender.</p>

<p>I have a few doubts on how this would work exactly. The script I have in mind, following the notation used in <a href="https://en.bitcoin.it/wiki/Script" rel="noreferrer">https://en.bitcoin.it/wiki/Script</a> for standard and IP transactions, is:</p>

<pre><code>scriptPubKey: OP_HASH160 &lt;passwordHash&gt; OP_EQUALVERIFY OP_CHECKSIG
scriptSig: &lt;sig&gt;&lt;pubKey&gt;&lt;password&gt;
</code></pre>

<p>The transfer would have six steps:</p>

<pre><code>- Stack: Empty  Script: &lt;sig&gt;&lt;pubKey&gt;&lt;password&gt; OP_HASH160 &lt;passwordHash&gt; OP_EQUALVERIFY OP_CHECKSIG
- Stack: &lt;sig&gt;&lt;pubKey&gt;&lt;password&gt;  Script: OP_HASH160 &lt;passwordHash&gt; OP_EQUALVERIFY OP_CHECKSIG
- Stack: &lt;sig&gt;&lt;pubKey&gt;&lt;passwordhashA&gt;  Script: &lt;passwordHash&gt; OP_EQUALVERIFY OP_CHECKSIG
- Stack: &lt;sig&gt;&lt;pubKey&gt;&lt;passwordhashA&gt;&lt;passwordHash&gt;  Script:  OP_EQUALVERIFY OP_CHECKSIG
- Stack: &lt;sig&gt;&lt;pubKey&gt;   Script:  OP_CHECKSIG
- Stack: true   Script:  Empty
</code></pre>

<p>I have left OP_HASH160 because it is already being used so no new operation is needed, but the other hashes in script should be possible. The protocol has some nice properties like making the password public when the coins are transferred. </p>

<p>Is this code correct? Is there something similar in the blockchain? I would like to try it, but I'm not really sure how to connect to the network with such a script. Should I first create a transaction to a "Bitcoin Limbo" and then try to recover it to the final address?</p>

<transactions><script>
Password-based bitcoin transactions
halftimepad
# Password-based bitcoin transactions

(Asked by: username_0 on 2012-11-26)

I have been reading about the role of script in transactions and I gather it should be possible to do a Bitcoin transfer to a receiver who knows a password. Instead of checking an address, the script would check that the hash of an input corresponds to the value given by the sender.

I have a few doubts on how this would work exactly. The script I have in mind, following the notation used in <https://en.bitcoin.it/wiki/Script> for standard and IP transactions, is:

```
scriptPubKey: OP_HASH160 <passwordHash> OP_EQUALVERIFY OP_CHECKSIG
scriptSig: <sig><pubKey><password>

```

The transfer would have six steps:

```
- Stack: Empty  Script: <sig><pubKey><password> OP_HASH160 <passwordHash> OP_EQUALVERIFY OP_CHECKSIG
- Stack: <sig><pubKey><password>  Script: OP_HASH160 <passwordHash> OP_EQUALVERIFY OP_CHECKSIG
- Stack: <sig><pubKey><passwordhashA>  Script: <passwordHash> OP_EQUALVERIFY OP_CHECKSIG
- Stack: <sig><pubKey><passwordhashA><passwordHash>  Script:  OP_EQUALVERIFY OP_CHECKSIG
- Stack: <sig><pubKey>   Script:  OP_CHECKSIG
- Stack: true   Script:  Empty

```

I have left OP\_HASH160 because it is already being used so no new operation is needed, but the other hashes in script should be possible. The protocol has some nice properties like making the password public when the coins are transferred.

Is this code correct? Is there something similar in the blockchain? I would like to try it, but I'm not really sure how to connect to the network with such a script. Should I first create a transaction to a "Bitcoin Limbo" and then try to recover it to the final address?

**Tags:** transactions, script


---

## 1 answers

### Answer by username_1 on 2012-11-26. Score: 6 | Accepted answer

What if somebody sees the password as the transaction is being relayed around, and makes a new version that transfers your bitcoins to them? If they have better network integration/a higher bandwidth connection, then their version might be able to overtake yours.

> **Comments:**
> **username_2**: Yeah, it's better to encrypt a private key and use the password to that. You can even store the encrypted private key in the block chain if you want.  
> **username_0**: I guess there are then two questions. Whether the password transaction is _possible_ and whether it is _advisable_. The attack you suggest reminds me of double spending. I should think about it, but maybe the same network consensus mechanism that puts double spending in check would be enough to protect the password transaction .  
> **username_1**: Possible: yes; advisable; no. Also, the attack I described is much easier to pull off than double spending, because it doesn't require getting 51% of hashing power. Also, to usefully double-spend, you need some sort of merchant to trust you. This attack can be pulled off by any random person on the internet.  

---

