9

Alice wants Bob to transfer 10btc to Carol, and is willing to pay Bob 11btc for the transfer.

They both entrust Trent to mediate the transaction, and Alice is willing to pay Trent 1btc as commission.

What is the correct and most secure protocol for performing this contract?

Edit: does the following protocol make sense?

  1. Alice broadcasts a transaction (Tx1) with 2 outputs:
    • 11btc with an output script specifying 2-of-3 multi-signature verification, specifying Alice, Bob and Trent as recipients
    • 1btc to Trent (commission)
  2. Bob verifies Alice's transaction:
    • Verified: Bob broadcasts a transaction (Tx2) sending Trent 10btc
    • Rollback - Bob is unsatisfied or fails to transfer the funds to Trent: Trent broadcasts a transaction (Tx3) sending Alice her 11btc back, specifying Tx1's first output as an input and signs the input. When Alice wants to spend Tx3, adding her signature to the input satisfies the 2-of-3 requirement (and the process stops here)
  3. Trent broadcasts a transaction (Tx4) sending Bob the 11btc, specifying Tx1's first output as an input. When Bob wants to spend Tx4, adding his signature to the input satisfies the 2-of-3 requirement
  4. Trent broadcasts a transaction (Tx5) sending Carol 10btc, specifying Tx2 as an input
nivs
  • 647
  • 4
  • 13
  • 2
    Why doesn't Alice pay Carol 10 BTC herself, then pay 1 BTC to Bob? – Nick ODell Mar 18 '13 at 15:18
  • Theoretically, Alice wants plausible deniability regarding the transfer of funds to Carol. – nivs Mar 18 '13 at 15:32
  • 4
    The Bitcoin protocol can do M of N transactions, but the clients don't yet support it. The solution will be coming. – Stephen Gornick Mar 18 '13 at 18:22
  • Thanks Stephen. What I'm looking for is the best security protocol for fulfilling the contract (preserving the plausible deniability of Alice, making sure Alice and Bob transfer funds, and enabling Trent to rollback the transaction), regardless of client implementation. – nivs Mar 18 '13 at 19:16
  • For clarification, as far as "plausible deniability", it should appear that the final decision to transfer funds to Carol was made by Bob and/or Trent, not Alice? – Nate Eldredge Jan 13 '14 at 04:05
  • Also, is Bob supposed to front his own 10btc to Carol and then be reimbursed, or does it have to come out of the coins he gets from Alice? – Nate Eldredge Jan 13 '14 at 04:08

2 Answers2

1

Your protocol makes sense, but i would modify it as follows

  1. the 1btc sent to trent should also be mutlisig with Alice's signature as the 2nd one, so that if Trent fails to do what he promised he gets no commission. ((the 1btc will stay in limbo, unless Alice and Trent can somehow work this out)
  2. The Tx2 should also be multisig and Carol's signature should be added, that way Trent can't run with the money.
Albert S
  • 1,600
  • 10
  • 21
-1

There is BTCrow (http://btcrow.com/) and ThruCoin (http://thrucoin.com/create), which both look like they will perform the services you need.

cjastram
  • 139
  • 1
  • 4
    Thanks @cjastram, but I'm not looking for a service that implements it but for a description of the best information flow between parties. Also note that Carol is an uninvolved 3rd party, if that makes any difference. – nivs Mar 18 '13 at 15:21