📅 Original date posted:2013-05-16
📝 Original message:Not only does the size of the proof grow endlessly as the coin is
passed around, the size of the UTXO set grows endlessly as more and
more of the already spent coins cannot be proven to have been spent
because the proofs are passed out-of-band. I never said the idea was
good, just interesting :)
Thanks,
Caleb
On 05/15/2013 10:45 PM, Gregory Maxwell wrote:
> On Wed, May 15, 2013 at 7:22 PM, Mike Hearn <mike at plan99.net> wrote:
>> Conceptually it sounds a lot like ZeroCoin (not in implementation)?
>
> Zerocoin conceals the connection from everyone forever, assuming the
> underlying trapdoor problem is computational infeasible, but at great
> cost.
>
> Adamcoin, depending on how its done, at most conceals the transactions
> from people who aren't a party to them... though as time goes on
> eventually everyone becomes a party to a sufficiently old coin, and
> avoiding publication creates quadratic costs in evaluating a private
> clique's claims.... so instead an implementation would make the
> identities public but only once they're burred a bit.
>
> Perhaps an extreme version of the idea is easier to understand. Ignore
> DOS attacks for a moment and pretend there is never any address reuse:
>
> Everyone creates txouts paying a P2SH addresses that have a OP_PUSH
> nonce in them and tell you recipient the nonce out of band.
>
> When the recipients spend those coins they provide the script but not the nonce.
>
> The recipient knows what coins he's spending, but the public does not.
>
> The public can tell there is no double spend though, because they'd
> see the same script twice. The person he's paying may be skeptical
> that he actually has any coin and didn't just mine some gibberish, but
> our spender tells that their receiver the nonce, and that person can
> see the coin available for spending in the chain and also see that
> there are no double spends.
>
> This could actually go on forever with no ambiguity over who owns
> what, but the out of band proofs that you have to give people when you
> spend coins would grow with the history of the coins.
>
> Since there wouldn't be much privacy once a transaction was
> sufficiently split up in any case, you instead just publish the
> unblindings once transactions are sufficiently buried. Thus bounding
> the growth of the proofs. The reason I say I need to internalize
> this more is mostly that I need to think about attacks on the
> publication for 'tained' transactions being more or less isomorphic
> to just refusing to allow spending of the 'tainted' coins in any case.
>
> ------------------------------------------------------------------------------
> AlienVault Unified Security Management (USM) platform delivers complete
> security visibility with the essential security capabilities. Easily and
> efficiently configure, manage, and operate all of your security controls
> from a single console and one unified framework. Download a free trial.
> http://p.sf.net/sfu/alienvault_d2d
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>
Caleb James DeLisle [ARCHIVE] /
npub138…9dl95
2023-06-07 15:01:56
in reply to nevent1q…egw2
Author Public Key
npub138d0km3t8jujy9duwng26dh79fwuxqhw0xmxjdw2h2t2dgwzwpxsk9dl95Published at
2023-06-07 15:01:56Event JSON
{
"id": "d73a94fbb0531313286a39c1be408b89f29843ae2e5eecac167d352b0207594b",
"pubkey": "89dafb6e2b3cb92215bc74d0ad36fe2a5dc302ee79b66935caba96a6a1c2704d",
"created_at": 1686150116,
"kind": 1,
"tags": [
[
"e",
"052db3d87a8ddcca9322b2943b65186caaf79275f7fd59c7239cb800e064e1db",
"",
"root"
],
[
"e",
"43d0ae28aaaa6c88497efa82b5827a25d2c72122b094463462ea9bbf2168def2",
"",
"reply"
],
[
"p",
"4aa6cf9aa5c8e98f401dac603c6a10207509b6a07317676e9d6615f3d7103d73"
]
],
"content": "📅 Original date posted:2013-05-16\n📝 Original message:Not only does the size of the proof grow endlessly as the coin is\npassed around, the size of the UTXO set grows endlessly as more and\nmore of the already spent coins cannot be proven to have been spent\nbecause the proofs are passed out-of-band. I never said the idea was\ngood, just interesting :)\n\nThanks,\nCaleb\n\n\nOn 05/15/2013 10:45 PM, Gregory Maxwell wrote:\n\u003e On Wed, May 15, 2013 at 7:22 PM, Mike Hearn \u003cmike at plan99.net\u003e wrote:\n\u003e\u003e Conceptually it sounds a lot like ZeroCoin (not in implementation)?\n\u003e \n\u003e Zerocoin conceals the connection from everyone forever, assuming the\n\u003e underlying trapdoor problem is computational infeasible, but at great\n\u003e cost.\n\u003e \n\u003e Adamcoin, depending on how its done, at most conceals the transactions\n\u003e from people who aren't a party to them... though as time goes on\n\u003e eventually everyone becomes a party to a sufficiently old coin, and\n\u003e avoiding publication creates quadratic costs in evaluating a private\n\u003e clique's claims.... so instead an implementation would make the\n\u003e identities public but only once they're burred a bit.\n\u003e \n\u003e Perhaps an extreme version of the idea is easier to understand. Ignore\n\u003e DOS attacks for a moment and pretend there is never any address reuse:\n\u003e \n\u003e Everyone creates txouts paying a P2SH addresses that have a OP_PUSH\n\u003e nonce in them and tell you recipient the nonce out of band.\n\u003e \n\u003e When the recipients spend those coins they provide the script but not the nonce.\n\u003e \n\u003e The recipient knows what coins he's spending, but the public does not.\n\u003e \n\u003e The public can tell there is no double spend though, because they'd\n\u003e see the same script twice. The person he's paying may be skeptical\n\u003e that he actually has any coin and didn't just mine some gibberish, but\n\u003e our spender tells that their receiver the nonce, and that person can\n\u003e see the coin available for spending in the chain and also see that\n\u003e there are no double spends.\n\u003e \n\u003e This could actually go on forever with no ambiguity over who owns\n\u003e what, but the out of band proofs that you have to give people when you\n\u003e spend coins would grow with the history of the coins.\n\u003e \n\u003e Since there wouldn't be much privacy once a transaction was\n\u003e sufficiently split up in any case, you instead just publish the\n\u003e unblindings once transactions are sufficiently buried. Thus bounding\n\u003e the growth of the proofs. The reason I say I need to internalize\n\u003e this more is mostly that I need to think about attacks on the\n\u003e publication for 'tained' transactions being more or less isomorphic\n\u003e to just refusing to allow spending of the 'tainted' coins in any case.\n\u003e \n\u003e ------------------------------------------------------------------------------\n\u003e AlienVault Unified Security Management (USM) platform delivers complete\n\u003e security visibility with the essential security capabilities. Easily and\n\u003e efficiently configure, manage, and operate all of your security controls\n\u003e from a single console and one unified framework. Download a free trial.\n\u003e http://p.sf.net/sfu/alienvault_d2d\n\u003e _______________________________________________\n\u003e Bitcoin-development mailing list\n\u003e Bitcoin-development at lists.sourceforge.net\n\u003e https://lists.sourceforge.net/lists/listinfo/bitcoin-development\n\u003e",
"sig": "73199defd63a75c8e87c9be4e4d45448fb12d2929c953eabba8882bd5ad353007ac74ecd8e11ca4a2757c3c22a19172bb4188b2389f51b8f45d2348a64ad2d31"
}