Password protection of a transaction

Question

The CryptoNote whitepaper contains this example of application for the transaction script system (in §6.3):

Password protection. Possession of a secret password s is equivalent to the knowledge of a private key, deterministically derived from the password: k = KDF(s). Hence, a receiver can prove that he knows the password by providing another signature under the key k. The sender simply adds the corresponding public key to his own output. Note that this method is much more secure than the "transaction puzzle" used in Bitcoin, where the password is explicitly passed in the inputs.

1. Is it possible to do that with Monero?

2. What are some realistic use cases for that?

Answer 1

As I understand it, it'd be a form of 2FA on a particular address.

It could work, but it'd be clunky (no such thing is implemented at this time).

You'd do something like this:

1. Create a new address type, call it "password-protected address".
2. Append the public key of k to the normal public spend/view pair. The address will be even longer than normal. :)
3. The sender then creates a normal stealth output, but adds the pubkey of k to it (P + K if you will).
4. The receiver, when scanning for outputs, would also check if any match P' + K.
5. To spend protected outputs, the wallet would prompt for the password to derive s, then add s to the generated private key for that output to get the real one.

Overall it's not that clunky, but you would also have to provide s to get the key image (for spent status when scanning).