Anyway, I just wanted to clear up some confusion here about the RSA UFOs: users will be able to know that I do not have the complete factorization because the UFOs were produced by hashing with a cryptographically secure hash function (SHA-256, which is used everywhere in Bitcoin, Litecoin, Anoncoin, etc.). Small factors were found and removed in the UFO project. So the procedure to generate the complete RSA UFOs is 1) create the 13 "raw" UFOs by hashing, and 2) divide out the small factors found in the UFO project. This is performed not only by the UFO clients and server, but also will be performed on startup by all Anoncoin wallet software.
The code is already there to do this.You say:
I do not have the complete factorization.We have no proof about that. On the few results you showed us:
https://bitcointalksearch.org/topic/m.8855999 we can see that you received the factors clearly.
About the UFO server code your provided on github, we have no proof that this is the same code used by the server during the few weeks of the RSA-UFO project.
You say:
the UFOs were produced by hashing with a cryptographically secure hash function SHA-256Yes, SHA-256 is a secure hash function and not reversible like RSA but to test and remove small factors from these UFOs, you must to convert these SHA-256 (hex) to decimals. Then, you know the UFOs.
About the ParamGeneration.cpp you provided on your github, this file is to test the 13 RSA-"UFOs" (N number) and start the accumulators with right parameters. The original file is there:
https://github.com/Zerocoin/libzerocoin/blob/master/ParamGeneration.cppAs you can see, Gnosis removed the original comments about the purpose of this file:
/// Fills in a ZC_Params data structure deterministically from
/// a trustworthy RSA modulus "N", which is provided as a Bignum.
///
/// Note: this routine makes the fundamental assumption that "N"
/// encodes a valid RSA-style modulus of the form "e1*e2" for some
/// unknown safe primes "e1" and "e2". These factors must not
/// be known to any party, or the security of Zerocoin is
/// compromised. The integer "N" must be a MINIMUM of 1023
/// in length, and 3072 bits is strongly recommended.Also, there is not one UFO, but 13 UFOs; to be valid, a coin must be accumulated in all of them. Using Monte Carlo simulations, I have found that there is a ~20% chance that any one of them can be factored by an extremely powerful attacker. This means that the probability of all 13 UFOs being factored by an extremely powerful attacker is about 1 in a billion -- and note that it would take factoring all of them to be able to forge zerocoins. My definition of "extremely powerful attacker" is one that can remove factors by the Elliptic Curve Method (ECM) up to 768 bits and can factor numbers up to 2048 bits using the Generalized Number Field Sieve (GNFS). This is far beyond what anybody is likely to be able to do for many decades.
This probability is based on the Sander white paper made in 1999. 15 years ago the known capabilities of a supposed attacker were not the same as today. No one knows the actual capabilities of the NSA today and in a year. In this area, things change very fast.
Some infos:
http://www.wired.com/2013/09/black-budget-what-exactly-are-the-nsas-cryptanalytic-capabilities/More infos:
http://en.wikipedia.org/wiki/Largest_known_prime_numberCan you ellaborate how you concluded the chance of factorization of a single UFO by an extremely powerful attacker is ~20%? To me a probability only makes sense if you take the variable time into account. How can a powerful attacker have a ~20% chance of factorization spending either 1 day or 1 year of computing power trying to factorize the number?
Okay, you're right. Pick any timespan you want, say, one year. A powerful attacker would be one that can find factors by ECM up to 768 bits and factor numbers up to 2048 bits by GNFS in one year. Such an attacker would then have a ~20% chance of factoring any one of those UFOs in that timespan. Assuming the capacity does not change, in 13 years, the attacker would have had a 1 in a billion chance of factoring all of them, because the attacker would have had enough time to be able to try all 13 in that time. Does that make sense?
There is a big mistake with your probability and timespan to broke the 13 RSA keys. You take in consideration that the attacker will do only one attack per key. If the attacker do multiple attacks on the 13 keys at the same time, the timespan to broke them decrease considerably.
Using RSA is doomed to failure because it's reversible. The probabilities and assumptions that it's too complex for an attacker to broke it are absurd. If there is a risk even small, it's not possible to take it.
About the risk of trapdoor, it's impossible to verify because the RSA generation is not made by the wallet but by its creator (Gnosis). The wallet only verify these keys to generate parameters and start accumulators (file: ParamGeneration.cpp).