How do you respond to the criticism that you might indeed be able to use an algorithm to generate a number of unknown factorization that contains two large prime factors (the so called RSA UFO, a key part of a trustless solution to Zerocoin), but you won't be able to prove you actually used such an algorithm, meaning your Zerocoin implementation will require that we have trust on you?
I have found an approach that anyone can verify. It involves hashing, which means that anyone can verify that I did not multiply prime factors together to generate the "UFO"s (I would need to mount a pre-image attack on the hash function). We can assume that the candidates are uniformly distributed in the range [0, 2^3840), which is nice. See Github (if you read C++):
https://github.com/Anoncoin/anoncoin/blob/zerocoin/src/libzerocoin/ParamGeneration.cpp#L748
https://github.com/Anoncoin/anoncoin/blob/zerocoin/src/libzerocoin/PrintUFOCandidate.cpp
PrintUFOCandidate.cpp compiles to a program called "ufo" (do "cd src/libzerocoin/Build-gcc && make -j9 ufo && ./ufo `seq 0 16`") that takes one or more "UFO index" numbers on the command line and generates 3840-bit UFO candidates using SHA-256 hashing. The output format is one or more lines of "
My posts in this Reddit thread explain it further.
Has the problem described on this thread been solved?
https://pay.reddit.com/r/crypto/comments/1t23ph/generating_a_composite_number_of_unknown/
Yes it has been solved.