📅 Original date posted:2022-06-30
📝 Original message:Just a small update to those interested:
I migrated the gist due to failures of github's new equation formatting feature (which unfortunately started just when I published this gist!), to [1](but comments still on the gist please, or here).
Secondly, I did some research (including toy code) into sublinear ring signatures and Groth/Kohlweiss 2014 can give logarithmic scaled ring signatures, whose security is reducible to that of the Pedersen commitments (essentially ECDLP). I made a note on what this looks like concretely here [2], TLDR 1 o 2 KB for 256-1024 keys. Open question how much the computational load matters. (Ring sig + key image I think is effected via ring sig + "spend a coin" part of "how to leak a secret and spend a coin", in the language of the paper).
The above paragraph is mentioned of course to address the question of how practical it might be to get genuinely big anonymity sets. In short, it might be practical. Again to mention: though bilinear pairings crypto could give substantially more efficient constructions, that would not work on 'bare' secp256k1, though there might be a sensible way of 'transferring' over to other curves (I'll leave that to others to figure out!).
[1] https://reyify.com/blog/riddle
[2] https://gist.github.com/AdamISZ/51349418be08be22aa2b4b469e3be92f?permalink_comment_id=4210892#gistcomment-4210892
Cheers,
AdamISZ/waxwing
Sent with Proton Mail secure email.
------- Original Message -------
On Sunday, June 12th, 2022 at 18:04, AdamISZ via bitcoin-dev <bitcoin-dev at lists.linuxfoundation.org> wrote:
> List denizens,
>
> As per the title, a suggested protocol for doing anti-Sybil that isn't too demanding for the users, but actually keeps a decent level of privacy.
>
> Notice how it's mostly focused on a user/customer of a service/product/website, but it could conceivably useful in e.g. anti-Sybil in things like Lightning.
>
> Sorry that as usual I write rather long but there are several conveniently arranged sections you can click on :)
>
> https://gist.github.com/AdamISZ/51349418be08be22aa2b4b469e3be92f
>
> (with apologies for my backronym-ing sins)
>
> Cheers,
> waxwing/AdamISZ
>
>
>
> Sent with Proton Mail secure email.
>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev at lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
AdamISZ [ARCHIVE] /
npub1nv…kqw2t
2023-06-07 23:10:26
in reply to nevent1q…8xs8
Author Public Key
npub1nv7tjpn2g8tvt8qfq5ccyl00ucfcu98ch998sq4g5xp65vy6fc4sykqw2tPublished at
2023-06-07 23:10:26Event JSON
{
"id": "5d384dc8114dcea0b975f4de7a69a5e9a932806d55428319c93c6c827ed7d77d",
"pubkey": "9b3cb9066a41d6c59c090531827defe6138e14f8b94a7802a8a183aa309a4e2b",
"created_at": 1686179426,
"kind": 1,
"tags": [
[
"e",
"37935a777d465cd8673e9ea7707b6f694ce475bce165e89a09d072932c181739",
"",
"root"
],
[
"e",
"764256926488fd00323f5ff26d069cd42f956a04166af2f42e5f4b85ca8cc6e8",
"",
"reply"
],
[
"p",
"9b3cb9066a41d6c59c090531827defe6138e14f8b94a7802a8a183aa309a4e2b"
]
],
"content": "📅 Original date posted:2022-06-30\n📝 Original message:Just a small update to those interested:\nI migrated the gist due to failures of github's new equation formatting feature (which unfortunately started just when I published this gist!), to [1](but comments still on the gist please, or here).\n\nSecondly, I did some research (including toy code) into sublinear ring signatures and Groth/Kohlweiss 2014 can give logarithmic scaled ring signatures, whose security is reducible to that of the Pedersen commitments (essentially ECDLP). I made a note on what this looks like concretely here [2], TLDR 1 o 2 KB for 256-1024 keys. Open question how much the computational load matters. (Ring sig + key image I think is effected via ring sig + \"spend a coin\" part of \"how to leak a secret and spend a coin\", in the language of the paper).\n\nThe above paragraph is mentioned of course to address the question of how practical it might be to get genuinely big anonymity sets. In short, it might be practical. Again to mention: though bilinear pairings crypto could give substantially more efficient constructions, that would not work on 'bare' secp256k1, though there might be a sensible way of 'transferring' over to other curves (I'll leave that to others to figure out!).\n\n[1] https://reyify.com/blog/riddle\n[2] https://gist.github.com/AdamISZ/51349418be08be22aa2b4b469e3be92f?permalink_comment_id=4210892#gistcomment-4210892\n\nCheers,\nAdamISZ/waxwing\n\n\n\n\nSent with Proton Mail secure email.\n\n------- Original Message -------\nOn Sunday, June 12th, 2022 at 18:04, AdamISZ via bitcoin-dev \u003cbitcoin-dev at lists.linuxfoundation.org\u003e wrote:\n\n\n\u003e List denizens,\n\u003e\n\u003e As per the title, a suggested protocol for doing anti-Sybil that isn't too demanding for the users, but actually keeps a decent level of privacy.\n\u003e\n\u003e Notice how it's mostly focused on a user/customer of a service/product/website, but it could conceivably useful in e.g. anti-Sybil in things like Lightning.\n\u003e\n\u003e Sorry that as usual I write rather long but there are several conveniently arranged sections you can click on :)\n\u003e\n\u003e https://gist.github.com/AdamISZ/51349418be08be22aa2b4b469e3be92f\n\u003e\n\u003e (with apologies for my backronym-ing sins)\n\u003e\n\u003e Cheers,\n\u003e waxwing/AdamISZ\n\u003e\n\u003e\n\u003e\n\u003e Sent with Proton Mail secure email.\n\u003e\n\u003e _______________________________________________\n\u003e bitcoin-dev mailing list\n\u003e bitcoin-dev at lists.linuxfoundation.org\n\u003e https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev",
"sig": "1def1270882378a672bc469a2d2f02fa71a306b07cec0fb57e6139edb7a4f4a78aad031671a33388be201ddcec4f9d94481d92d4bd3a58f36d700a33257b0d58"
}