So in terms of untraceability cryptonote+stealth addresses is not less secure than darksend? Thought I read about an possible attack, even on wikipedia, but cant find it anymore.
Anyways thanks for all interesting answers.
monero is a one trick pony that will be replaced by zerocash soon, even the monero devs know it.Anyways thanks for all interesting answers.
You're ripping things out of context, full reply beneath:
Quote
ZeroCash is amazing, cutting-edge research. In the far future I fully expect it will make Monero and Bitcoin obsolete. However, it is somewhat unworkable right now. Firstly, it has a trusted accumulator problem that remains unsolved at this stage (although they posit solving this through an RSA UFO). Even if that is solved there is still the very real danger of it being impossible to see exploits in an absolutely opaque blockchain with relatively new and untested cryptography (ie. an exploit that lets an attacker create, say, 2 000 000 ZeroCash in a single day will go unnoticed). Finally, even with their newer ZKP schemes there is still a significant size impact for each transaction, and absolutely no way you'd be able to run SPV-style wallets or perform blockchain pruning. Once the cryptography has been more thoroughly tested, corner cases have been solved, and technology is at a point where the size impact is negligible, then I would imagine some future iteration of ZeroCash will become the dominant form for cryptocurrency payments.
Somewhere else he also stated that this could take upto 30 years, so your reply isn't really relevant.
Also gmaxwell on Zerocash:
Quote
The cryptosystem implementation underlying ZeroCash had a total break announced recently:
https://eprint.iacr.org/2015/437
A failure of the bleeding edge cryptography used for the proofs in ZC results in unbounded undetectable inflation.
Because of the way the proofs are used-- false proofs would allow the corruption of the system; even after replacing the proof system with a fixed version, if any bad proofs had made it in the state would be undetectably corrupted. So it wouldn't be trustworthy, and there would be little to no way to restore trustworthyness; short of forcing the unblinding all the coins and hoping all could be unblinded and the result wasn't more coins than should exist. So take a step back here and appreciate this fully: If we had deployed this months ago, Bitcoin might well be over now.
I'd ask for your thanks-- but it wasn't really a question: As far as "refused" goes, -- there exists no implementation; and the people who described it have declined to release their circuits, so I couldn't even get started on one without repeating a huge amount of work. Actually deploying this is quite hard, from an engineering perspective. No one has proposed deploying it, no one has turned it down. That said, the system has a huge negative scaling impact largely prevents pruning. Many of us that work on Bitcoin core are very much in favor of privacy features; but that doesn't mean rushing head long into every conjectural cryptosystem that comes across our desks.
As an aside; The ring signature scheme being discussed here has no real relation to transaction privacy. Ring signature transactions require a special kind of tracable ring signature to prevent double spends. Ring sigs are not especially hard to implement, and I've implemented one and am working on a second one now (though for something much cooler than how they're used in cryptocurrencies so far).
https://eprint.iacr.org/2015/437
A failure of the bleeding edge cryptography used for the proofs in ZC results in unbounded undetectable inflation.
Because of the way the proofs are used-- false proofs would allow the corruption of the system; even after replacing the proof system with a fixed version, if any bad proofs had made it in the state would be undetectably corrupted. So it wouldn't be trustworthy, and there would be little to no way to restore trustworthyness; short of forcing the unblinding all the coins and hoping all could be unblinded and the result wasn't more coins than should exist. So take a step back here and appreciate this fully: If we had deployed this months ago, Bitcoin might well be over now.
I'd ask for your thanks-- but it wasn't really a question: As far as "refused" goes, -- there exists no implementation; and the people who described it have declined to release their circuits, so I couldn't even get started on one without repeating a huge amount of work. Actually deploying this is quite hard, from an engineering perspective. No one has proposed deploying it, no one has turned it down. That said, the system has a huge negative scaling impact largely prevents pruning. Many of us that work on Bitcoin core are very much in favor of privacy features; but that doesn't mean rushing head long into every conjectural cryptosystem that comes across our desks.
As an aside; The ring signature scheme being discussed here has no real relation to transaction privacy. Ring signature transactions require a special kind of tracable ring signature to prevent double spends. Ring sigs are not especially hard to implement, and I've implemented one and am working on a second one now (though for something much cooler than how they're used in cryptocurrencies so far).
You're just spreading FUD.
PS: If it makes Monero and Bitcoin obsolete, it will probably make DASH obsolete as well.
