<p>Things to prove:</p>

<ul>
<li>Ownership

<ul>
<li>Address A belongs to Person 1

<ul>
<li>Person 1 controls the private key allowing spending from Address A</li>
</ul></li>
<li>Address B belongs to Person 2

<ul>
<li>Person 2 controls the private key allowing spending from Address B</li>
</ul></li>
</ul></li>
<li>Transaction T transferring an amount from Address A to Address B

<ul>
<li>occurred

<ul>
<li>was transmitted</li>
<li>was accepted</li>
<li>was confirmed</li>
<li>was included in a block

<ul>
<li>the block is a part of the longest chain, <em>the</em> blockchain.</li>
</ul></li>
</ul></li>
</ul></li>
</ul>

<h2>Proving ownership of an address</h2>

<p>Ownership is significantly easier to prove, provided that <strong>judge</strong> (to whom all this is proven), accepts either: <em>economic activity</em> or <em>digital signature</em> as proof of control of a private key.</p>

<h3>Economic activity</h3>

<p>Unfortunately, there is time and/or value cost to proving economic activity.</p>

<p>The judge could </p>

<ol>
<li>ask each prover to reproduce the transaction at a given time, but at a negligible amount: 1 satoshi plus a sufficient transaction fee. That the original transaction could be reproduced with only the amount changing, and a reverse of the transaction executed as well, should suffice to demonstrate that each Person controls the private key sufficiently to engage in economic activity.</li>
<li>ask each prover to send 2 satoshi plus double the sufficient transaction fee to the same address: an address supplied by the judge, who then returns half of what was sent to demonstrate their own control of the address to which the 2 satoshi transaction was sent. This demonstrates that Person 1, Person 2, and the judge all control the addresses they say they do sufficient to engage in economic activity.</li>
</ol>

<p>The costs of either of these are obvious, but generally sufficiently negligible as not to be a significant burden on any party involved. The transaction fees could be omitted, provided the transferred amount is sufficiently large to be both processed without transaction fee <em>and</em> trusted to be returned by the recipient.</p>

<p>The trust of these transactions could be increased by the judge assigning a random two-digit amount of satoshis to each transaction, or basing that random amount on an agreed-upon, yet-to-happen event with an expected time period within which the proving transactions must be transmitted to the judge. An example of a yet-to-happen event would be a newspaper headline or simply the leftmost two numbers in the 10th oldest block at a certain date and time.</p>

<p>Another, more convoluted yet more humanly trustworthy way would be for the judge to provide a private key to each prover. The prover then transmits an amount to an address controllable by that private key, then immediately returns that same amount using the provided private key. The judge has temporary control, though, so trust in the judge is necessary.</p>

<p>This method is infeasible if the parties are unable to broadcast the transactions to the network or the time necessary for transaction confirmation is too long.</p>

<h3>Digital signatures</h3>

<p>If the judge is familiar with how digital signatures work, or can be convinced of their validity, then this is an option. Some effort might be worth it, as this option is without economic expenditure and does not require the time necessary for the proving transactions described above to be confirmed by the network.</p>

<p>The judge provides a unique text to each prover. This phrase can be something sensible or randomly generated. Random is probably better, largely because it would take less time to generate. Alternatively, basing that text on an agreed-upon, yet-to-happen event with an expected time period within which the signature must be transmitted to the judge. An example of a yet-to-happen event would be a newspaper headline or simply the leftmost two numbers in the 10th oldest block at a certain date and time.</p>

<p>The signatures should be sent among all parties, so that all adversarial parties can verify the signature.</p>

<p>Remember that the point of this exercise is to demonstrate control of the private key. A downside of this is that not all wallet softwares support signing data, most commonly because the private keys backing the wallet are not exposed to the user in anyway except for the purposes of signing transactions. If a prover claims that their software does not have this functionality, this method is infeasible. The prover could be convinced to use another software, but that could compromise their position if they could be tricked into using malicious software, if a false positive proof of control is undesirable.</p>

<h3>A combination of the two</h3>

<p>Each of these methods has strengths and weaknesses, so a combination of the two would likely provide the most confidence proving control of a private key, and thus control of an address.</p>

<h2>Proving that a transaction occurred</h2>

<p>The easiest way for a judge to verify that any given transaction occurred is to use a trusted blockchain explorer program, since few wallet programs expose functionality enabling the user to search the blockchain by address, transaction, or block. </p>

<p>The judge can use the explorer verify the activity of each address in question, as well as the transaction itself. It is up to the judge to verify that the transaction has been a part of the longest chain for a permissible number of blocks. One block depth is sufficiently secure against most attacks that would cancel the transaction, but each additional block depth further solidifies the transaction.</p>

<p>This does not necessarily require network connectivity if the transaction occurred sufficiently far in the past that the judge's own copy of the blockchain can be explored. </p>

<p>If the judge does not have access to a copy of the blockchain, the desired proof cannot be surely obtained. Given the raw transaction, the judge can use the digital signature method to verify that Person 1 has control of Address A, as the raw transaction will contain a verifiable signature. However, the raw transaction itself contains nothing that would enable to the judge to verify Person 2's control of Address B.</p>

CC BY-SA 3.0
2015-09-05T18:33:21.883Z
2015-09-05T18:33:21.883Z
Colin Dean
<p>What is the best way to prove to a title agency that a particular bitcoin transaction has occurred and that the addresses do indeed belong to the parties exchanging the title?</p>

CC BY-SA 3.0
2015-09-04T02:38:32.590Z
Wouldn't it be sufficient for both the sender and the receiver to certify that the transaction occurred? Or are you trying to prove that there was a transaction to a third party?
Nick ODell
CC BY-SA 3.0
2015-09-04T02:59:04.033Z
The first is difficult without some understanding of Bitcoin from the party being proven to. Signing a message with the recipient address would do the second job, this function is built into many wallets. Be careful what you sign though, "this is my address" is meaningless, as anybody can copy it and reuse it in any situation. "I am X, todays date is X, this proves to entity X that I own this address" is substantially more proof that you own an address, or at least have control of it.
Claris
CC BY-SA 3.0
2015-09-04T18:43:49.860Z
@Bitcoin: One has to be a little careful.  It proves that the owner of the address is willing to claim they are you.  Nothing stops me from signing a message saying "I am Barack Obama, today is September 4, 2015, and this proves to the Illuminati High Council that I own this address."  But this does not, in fact, prove that Barack Obama owns that address.
Nate Eldredge
CC BY-SA 3.0
2015-09-05T04:59:30.963Z
@NateEldredge Make each party sign the message the title agency determines.
Geremia
<contracts><proof-of-solvency>
Proving to a title agency a bitcoin transaction occurred?
Geremia
# Proving to a title agency a bitcoin transaction occurred?

(Asked by: username_0 on 2015-09-04)

What is the best way to prove to a title agency that a particular bitcoin transaction has occurred and that the addresses do indeed belong to the parties exchanging the title?

**Tags:** contracts, proof-of-solvency

> **Comments:**
> **username_1**: Wouldn't it be sufficient for both the sender and the receiver to certify that the transaction occurred? Or are you trying to prove that there was a transaction to a third party?  
> **username_2**: The first is difficult without some understanding of Bitcoin from the party being proven to. Signing a message with the recipient address would do the second job, this function is built into many wallets. Be careful what you sign though, "this is my address" is meaningless, as anybody can copy it and reuse it in any situation. "I am X, todays date is X, this proves to entity X that I own this address" is substantially more proof that you own an address, or at least have control of it.  
> **username_3**: @Bitcoin: One has to be a little careful.  It proves that the owner of the address is willing to claim they are you.  Nothing stops me from signing a message saying "I am Barack Obama, today is September 4, 2015, and this proves to the Illuminati High Council that I own this address."  But this does not, in fact, prove that Barack Obama owns that address.  
> **username_0**: @username_3 Make each party sign the message the title agency determines.  

---

## 1 answers

### Answer by username_4 on 2015-09-05. Score: 2 | Accepted answer

Things to prove:

* Ownership
  + Address A belongs to Person 1
    - Person 1 controls the private key allowing spending from Address A
  + Address B belongs to Person 2
    - Person 2 controls the private key allowing spending from Address B
* Transaction T transferring an amount from Address A to Address B
  + occurred
    - was transmitted
    - was accepted
    - was confirmed
    - was included in a block
      * the block is a part of the longest chain, *the* blockchain.

## Proving ownership of an address

Ownership is significantly easier to prove, provided that **judge** (to whom all this is proven), accepts either: *economic activity* or *digital signature* as proof of control of a private key.

### Economic activity

Unfortunately, there is time and/or value cost to proving economic activity.

The judge could

1. ask each prover to reproduce the transaction at a given time, but at a negligible amount: 1 satoshi plus a sufficient transaction fee. That the original transaction could be reproduced with only the amount changing, and a reverse of the transaction executed as well, should suffice to demonstrate that each Person controls the private key sufficiently to engage in economic activity.
2. ask each prover to send 2 satoshi plus double the sufficient transaction fee to the same address: an address supplied by the judge, who then returns half of what was sent to demonstrate their own control of the address to which the 2 satoshi transaction was sent. This demonstrates that Person 1, Person 2, and the judge all control the addresses they say they do sufficient to engage in economic activity.

The costs of either of these are obvious, but generally sufficiently negligible as not to be a significant burden on any party involved. The transaction fees could be omitted, provided the transferred amount is sufficiently large to be both processed without transaction fee *and* trusted to be returned by the recipient.

The trust of these transactions could be increased by the judge assigning a random two-digit amount of satoshis to each transaction, or basing that random amount on an agreed-upon, yet-to-happen event with an expected time period within which the proving transactions must be transmitted to the judge. An example of a yet-to-happen event would be a newspaper headline or simply the leftmost two numbers in the 10th oldest block at a certain date and time.

Another, more convoluted yet more humanly trustworthy way would be for the judge to provide a private key to each prover. The prover then transmits an amount to an address controllable by that private key, then immediately returns that same amount using the provided private key. The judge has temporary control, though, so trust in the judge is necessary.

This method is infeasible if the parties are unable to broadcast the transactions to the network or the time necessary for transaction confirmation is too long.

### Digital signatures

If the judge is familiar with how digital signatures work, or can be convinced of their validity, then this is an option. Some effort might be worth it, as this option is without economic expenditure and does not require the time necessary for the proving transactions described above to be confirmed by the network.

The judge provides a unique text to each prover. This phrase can be something sensible or randomly generated. Random is probably better, largely because it would take less time to generate. Alternatively, basing that text on an agreed-upon, yet-to-happen event with an expected time period within which the signature must be transmitted to the judge. An example of a yet-to-happen event would be a newspaper headline or simply the leftmost two numbers in the 10th oldest block at a certain date and time.

The signatures should be sent among all parties, so that all adversarial parties can verify the signature.

Remember that the point of this exercise is to demonstrate control of the private key. A downside of this is that not all wallet softwares support signing data, most commonly because the private keys backing the wallet are not exposed to the user in anyway except for the purposes of signing transactions. If a prover claims that their software does not have this functionality, this method is infeasible. The prover could be convinced to use another software, but that could compromise their position if they could be tricked into using malicious software, if a false positive proof of control is undesirable.

### A combination of the two

Each of these methods has strengths and weaknesses, so a combination of the two would likely provide the most confidence proving control of a private key, and thus control of an address.

## Proving that a transaction occurred

The easiest way for a judge to verify that any given transaction occurred is to use a trusted blockchain explorer program, since few wallet programs expose functionality enabling the user to search the blockchain by address, transaction, or block.

The judge can use the explorer verify the activity of each address in question, as well as the transaction itself. It is up to the judge to verify that the transaction has been a part of the longest chain for a permissible number of blocks. One block depth is sufficiently secure against most attacks that would cancel the transaction, but each additional block depth further solidifies the transaction.

This does not necessarily require network connectivity if the transaction occurred sufficiently far in the past that the judge's own copy of the blockchain can be explored.

If the judge does not have access to a copy of the blockchain, the desired proof cannot be surely obtained. Given the raw transaction, the judge can use the digital signature method to verify that Person 1 has control of Address A, as the raw transaction will contain a verifiable signature. However, the raw transaction itself contains nothing that would enable to the judge to verify Person 2's control of Address B.


---

