[XMR] Monero - A secure, private, untraceable cryptocurrency - page 1429.

owlcatz

legendary

Activity: 3570

Merit: 1959

Quote from: iCEBREAKER on September 18, 2014, 06:00:51 PM

Quote from: RentaMouse on September 18, 2014, 10:48:41 AM

Quote

I appreciate Anon136's argument against imposing a "post-mine" which would affect the emissions curve, as he says miners have the choice to stop mining if they dont like the change but investors have already bought in so changing the conditions is unfair. I still like the idea of a post-mine on the principle that the devteam have proved themselves worthy of a pre-mine which never happened, but I don't have a decent idea of how to create it Sad

BBR has a 1% dev tax, and I still consider it free as in FOSS. VIA had a completely fair, transparent, and very successful presale of Block 1's 10% of total coins.

We should emulate both of these approaches, and combine them to make Monero a staggeringly well funded project with concomitant high resiliency/survivability characteristics...

I'm a Monero investor who has been hloding tight since it was at parity with Primecoin, and only traded on cryptonoteexchange.

Which is more unfair to me?
A) risking the near certainty of devs running out of enthusiasm/money for completion of our very ambitions goals (thus XMR being unable to grow and respond to emergencies), or,
B) changing the emission 'social contract' condition by a slight degree

I think the former is far more unfair, because it puts my entire investment at risk in entirely predictable and probably preventable ways, IE liquidity crises and stagnation.

The emission 'social contract' is not set in stone, EG the final emission rate is still undecided.

As in investor, I don't feel comfortable being a free rider by expecting the devs to work for free/cheap, or jointly subsidizing others' free rides by making piddly one time donations.

Yes, the devteam has proven themselves worth of a pre-mine which never happened. Here is how to create it:

I call it the 'Two To TacoTime' plan. Cool

-One-time Bootstrap Block 302612 (celebrating 100k anniversary of historic Battle of Troll Block)

-Bootstrap Block includes 1% of final coin total (184k XMR) moved from end of emission (years away) to Soon^TM

-Bootstrap Block coins are bid for and distributed proportionately in the same trustless/transparent way as VIA's Block 1 presale (http://presale.viacoin.org/terms)

-Bootstrap Block is worth at least $300k dollars, enough to refactor codebase, integrate DB, complete I2P, create Official Wallet, and hire pros for meticulous security audits

-After the Bootstrap Block, all subsequent blocks (less transaction fees) pay 1% to dev fund

-Ongoing 1% mining tax provides for continued care and maintenance of the mature platform created by our Bootstrap Block

-New 'set in stone' rules/guarantees/commitments/social contract: no more Bootstrap Blocks ever no matter what, and mining devtax will never go over 1%

-dev fund is kept 50/50 in XMR/BTC multisig escrow. Rebalancing may be done without notice, prior or otherwise

-dev fund expenditures must be authorized by at least 5 of the 9 (7 core team members + RPietila + Zoidberg)

-dev funds may only be used to pay for writing/auditing critical code, and may not be used to raise more funds or for marketing

This sounds pretty fair to me, but then again i'm not all that savvy on premines or how it may or may not affect current prices etc.

Sounds like the general consensus is that either way, something must be done, these guys can't work for free, or this whole project will just never happen... something has to give, somewhere....

Quote

As in investor, I don't feel comfortable being a free rider by expecting the devs to work for free/cheap, or jointly subsidizing others' free rides by making piddly one time donations.

I feel the same way here, thanks for posting your idea, even if it gets shot down by devs or whatever...

iCEBREAKER

legendary

Activity: 2156

Merit: 1072

Crypto is the separation of Power and State.

Quote from: RentaMouse on September 18, 2014, 10:48:41 AM

Quote

I appreciate Anon136's argument against imposing a "post-mine" which would affect the emissions curve, as he says miners have the choice to stop mining if they dont like the change but investors have already bought in so changing the conditions is unfair. I still like the idea of a post-mine on the principle that the devteam have proved themselves worthy of a pre-mine which never happened, but I don't have a decent idea of how to create it Sad

BBR has a 1% dev tax, and I still consider it free as in FOSS. VIA had a completely fair, transparent, and very successful presale of Block 1's 10% of total coins.

We should emulate both of these approaches, and combine them to make Monero a staggeringly well funded project with concomitant high resiliency/survivability characteristics...

I'm a Monero investor who has been hloding tight since it was at parity with Primecoin, and only traded on cryptonoteexchange.

Which is more unfair to me?
A) risking the near certainty of devs running out of enthusiasm/money for completion of our very ambitions goals (thus XMR being unable to grow and respond to emergencies), or,
B) changing the emission 'social contract' condition by a slight degree

I think the former is far more unfair, because it puts my entire investment at risk in entirely predictable and probably preventable ways, IE liquidity crises and stagnation.

The emission 'social contract' is not set in stone, EG the final emission rate is still undecided.

As in investor, I don't feel comfortable being a free rider by expecting the devs to work for free/cheap, or jointly subsidizing others' free rides by making piddly one time donations.

Yes, the devteam has proven themselves worth of a pre-mine which never happened. Here is how to create it:

I call it the 'Two To TacoTime' plan. Cool

-One-time Bootstrap Block 302612 (celebrating 100k anniversary of historic Battle of Troll Block)

-Bootstrap Block includes 1% of final coin total (184k XMR) moved from end of emission (years away) to Soon^TM

-Bootstrap Block coins are bid for and distributed proportionately in the same trustless/transparent way as VIA's Block 1 presale (http://presale.viacoin.org/terms)

-Bootstrap Block is worth at least $300k dollars, enough to refactor codebase, integrate DB, complete I2P, create Official Wallet, and hire pros for meticulous security audits

-After the Bootstrap Block, all subsequent blocks (less transaction fees) pay 1% to dev fund

-Ongoing 1% mining tax provides for continued care and maintenance of the mature platform created by our Bootstrap Block

-New 'set in stone' rules/guarantees/commitments/social contract: no more Bootstrap Blocks ever no matter what, and mining devtax will never go over 1%

-dev fund is kept 50/50 in XMR/BTC multisig escrow. Rebalancing may be done without notice, prior or otherwise

-dev fund expenditures must be authorized by at least 5 of the 9 (7 core team members + RPietila + Zoidberg)

-dev funds may only be used to pay for writing/auditing critical code, and may not be used to raise more funds or for marketing

akula999

hero member

Activity: 509

Merit: 500

So much math... need to dummy it down a bit and read a Wolverine comic

smooth

legendary

Activity: 2968

Merit: 1198

Quote from: Odalv on September 18, 2014, 04:46:02 PM

Quote from: fluffypony on September 18, 2014, 04:35:35 PM

Quote from: Odalv on September 18, 2014, 04:28:08 PM

so what exact "I = x * Hp(P)" means ?

https://www.certicom.com/index.php/52-the-elliptic-curve-discrete-logarithm-problem (and https://www.certicom.com/index.php/the-basics-of-ecc)

http://en.wikipedia.org/wiki/Elliptic_curve_point_multiplication

http://homepages.warwick.ac.uk/~masiao/maths/lecturenotes/ellipticnotes.pdf

http://tools.ietf.org/html/rfc6090

http://people.irisa.fr/Arnaud.Tisserand/docs/slides-semcairn09-ecc-4p.pdf

http://crypto.stackexchange.com/questions/653/basic-explanation-of-elliptic-curve-cryptography

http://arstechnica.com/security/2013/10/a-relatively-easy-to-understand-primer-on-elliptic-curve-cryptography/

http://www.ccs.neu.edu/home/riccardo/courses/cs6750-fa09/talks/Ellis-elliptic-curve-crypto.pdf

http://crypto.stackexchange.com/questions/3907/how-does-one-calculate-the-scalar-multiplication-on-elliptic-curves

Please go read up, and then if there are specific questions once you have come to a proper understanding of the notation used when expressing elliptic curve multiplication then feel free to ask.

Thank you for posting. Seems you understand it well. Please use proper notation and tell me what "I = xHp(P)" means

I explained it earlier. It is elliptic curve multiplication between x (an integer) and Hp which is a point.

Odalv

legendary

Activity: 1414

Merit: 1000

Quote from: fluffypony on September 18, 2014, 04:35:35 PM

Quote from: Odalv on September 18, 2014, 04:28:08 PM

so what exact "I = x * Hp(P)" means ?

https://www.certicom.com/index.php/52-the-elliptic-curve-discrete-logarithm-problem (and https://www.certicom.com/index.php/the-basics-of-ecc)

http://en.wikipedia.org/wiki/Elliptic_curve_point_multiplication

http://homepages.warwick.ac.uk/~masiao/maths/lecturenotes/ellipticnotes.pdf

http://tools.ietf.org/html/rfc6090

http://people.irisa.fr/Arnaud.Tisserand/docs/slides-semcairn09-ecc-4p.pdf

http://crypto.stackexchange.com/questions/653/basic-explanation-of-elliptic-curve-cryptography

http://arstechnica.com/security/2013/10/a-relatively-easy-to-understand-primer-on-elliptic-curve-cryptography/

http://www.ccs.neu.edu/home/riccardo/courses/cs6750-fa09/talks/Ellis-elliptic-curve-crypto.pdf

http://crypto.stackexchange.com/questions/3907/how-does-one-calculate-the-scalar-multiplication-on-elliptic-curves

Please go read up, and then if there are specific questions once you have come to a proper understanding of the notation used when expressing elliptic curve multiplication then feel free to ask.

Thank you for posting. Seems you understand it well. Please use proper notation and tell me what "I = xHp(P)" means

fluffypony

donator

Activity: 1274

Merit: 1060

GetMonero.org / MyMonero.com

Quote from: Odalv on September 18, 2014, 04:28:08 PM

so what exact "I = x * Hp(P)" means ?

https://www.certicom.com/index.php/52-the-elliptic-curve-discrete-logarithm-problem (and https://www.certicom.com/index.php/the-basics-of-ecc)

http://en.wikipedia.org/wiki/Elliptic_curve_point_multiplication

http://homepages.warwick.ac.uk/~masiao/maths/lecturenotes/ellipticnotes.pdf

http://tools.ietf.org/html/rfc6090

http://people.irisa.fr/Arnaud.Tisserand/docs/slides-semcairn09-ecc-4p.pdf

http://crypto.stackexchange.com/questions/653/basic-explanation-of-elliptic-curve-cryptography

http://arstechnica.com/security/2013/10/a-relatively-easy-to-understand-primer-on-elliptic-curve-cryptography/

http://www.ccs.neu.edu/home/riccardo/courses/cs6750-fa09/talks/Ellis-elliptic-curve-crypto.pdf

http://crypto.stackexchange.com/questions/3907/how-does-one-calculate-the-scalar-multiplication-on-elliptic-curves

Please go read up, and then if there are specific questions once you have come to a proper understanding of the notation used when expressing elliptic curve multiplication then feel free to ask.

Odalv

legendary

Activity: 1414

Merit: 1000

Quote from: fluffypony on September 18, 2014, 04:21:27 PM

Quote from: canonsburg on September 18, 2014, 03:01:36 PM

Someone needs to check the source code too but I believe the whitepaper's notation is screwed up.

The paper defines private key a and public Key A through the transformation A = a*G, where G is the Hash function.
So in this case, the multiplication step is to denote the hash mapping.

In the paper, it also defined the key image as I = x * Hp(P)

Now this seems like it is the multiplication of private key x with the hash to the public key P.

But I think this is actually I = x * Hp(P) = x*G2, where G2 like above is another hash function so this is just a hash of private key x using some deterministic hash function that is dependent on public key P (Hp(P)).

I'll just quote from someone who knows way more math than I do -

sarang: The operation is actually repeated elliptic addition... and that addition is really a curve intersection and some other complicated shit sarang: Multiplying an integer by an elliptic curve point is well-defined sarang: the x*H(p) is not another hash sarang: You convert the hash output H(p) to an elliptic point sarang: and then do the integer-elliptic multiplication sarang: so it's super important to identify what is an integer and what is an elliptic curve point sarang: The notation is identical, as it would be in formal mathematics sarang: They usually use lowercase for integers and uppercase for points sarang: and always use the multiplication order integer*point sarang: just as a matter of convention, that is sarang: so anyone saying you can divide a point by an integer is wrong sarang: elliptic curve crypto would be broken wide open if that were the case sarang: Oh, and G is NOT a hash function. It's the elliptic base point sarang: so A is also an elliptic point

so what exact "I = x * Hp(P)" means ?

fluffypony

donator

Activity: 1274

Merit: 1060

GetMonero.org / MyMonero.com

Quote from: canonsburg on September 18, 2014, 03:01:36 PM

Someone needs to check the source code too but I believe the whitepaper's notation is screwed up.

The paper defines private key a and public Key A through the transformation A = a*G, where G is the Hash function.
So in this case, the multiplication step is to denote the hash mapping.

In the paper, it also defined the key image as I = x * Hp(P)

Now this seems like it is the multiplication of private key x with the hash to the public key P.

But I think this is actually I = x * Hp(P) = x*G2, where G2 like above is another hash function so this is just a hash of private key x using some deterministic hash function that is dependent on public key P (Hp(P)).

I'll just quote from someone who knows way more math than I do -

sarang: The operation is actually repeated elliptic addition... and that addition is really a curve intersection and some other complicated shit sarang: Multiplying an integer by an elliptic curve point is well-defined sarang: the x*H(p) is not another hash sarang: You convert the hash output H(p) to an elliptic point sarang: and then do the integer-elliptic multiplication sarang: so it's super important to identify what is an integer and what is an elliptic curve point sarang: The notation is identical, as it would be in formal mathematics sarang: They usually use lowercase for integers and uppercase for points sarang: and always use the multiplication order integer*point sarang: just as a matter of convention, that is sarang: so anyone saying you can divide a point by an integer is wrong sarang: elliptic curve crypto would be broken wide open if that were the case sarang: Oh, and G is NOT a hash function. It's the elliptic base point sarang: so A is also an elliptic point

Odalv

legendary

Activity: 1414

Merit: 1000

Quote from: canonsburg on September 18, 2014, 03:01:36 PM

Someone needs to check the source code too but I believe the whitepaper's notation is screwed up.

The paper defines private key a and public Key A through the transformation A = a*G, where G is the Hash function.
So in this case, the multiplication step is to denote the hash mapping.

In the paper, it also defined the key image as I = x * Hp(P)

Now this seems like it is the multiplication of private key x with the hash to the public key P.

But I think this is actually I = x * Hp(P) = x*G2, where G2 like above is another hash function so this is just a hash of private key x using some deterministic hash function that is dependent on public key P (Hp(P)).

I think
  a) hash(P) -> I know pseudo-identity (worst case, same as Bitcoin)
  b) x*hash(P) -> I know identity + x (worst case, ZERO)
  c) hash(x) -> Nobody can verify transaction and "math" does not work (I can double spend)
  d) P*hash(x) -> I can double spend (I can cheat with hash(x))
  e) I do not know -> we will see
  f) Monero to the Moon

:-)

fluffypony

donator

Activity: 1274

Merit: 1060

GetMonero.org / MyMonero.com

Quote from: Odalv on September 18, 2014, 02:49:29 PM

I'll apply H_p on all public keys (P is public key) in signature.
I know I, P, H_p(P) seems I can compute x

x = I / Hp(P)

Edit:
P is one of 6 public keys ... I'll try all

lol cryptography, how does it work?

https://www.certicom.com/index.php/52-the-elliptic-curve-discrete-logarithm-problem

5w00p

hero member

Activity: 644

Merit: 502

Quote from: illodin on September 18, 2014, 03:00:27 PM

Quote from: ?? on ??

I have been thinking on the coin-killer posts and the more I read it the more I smell BS, there is nothing proving it is more than FUD, if people are dumping because of this they will be sorry soon.

You don't have to fully believe either option, if you think there's 10% chance it is true, the price should take 10% cut, right?

No.

Your statement lacks sound reasoning.

'You' is who? I believe that you mean it in the universal sense, but there is no way to determine the ratio of truthiness vs falseyness that all XMR and cryptocurrency market members ascertain in relation to said 'coin-killer posts.'

Furthermore, price is not necessarily proportional to the 'chance it is true.'

smooth

legendary

Activity: 2968

Merit: 1198

Quote from: Odalv on September 18, 2014, 02:24:50 PM

https://cryptonote.org/whitepaper.pdf

Quote

The signer picks a random secret key and computes the corresponding
public key P=xG. Additionally he computes another public key
I=xHp(P) which we will call the "key image"
...
Nobody can recover the public key from the key image and identify the signer

lol, but everybody can compute "key image" from public key and then identify the signer

Edit
if this mean I = x * Hp(P) then I can compute even x

x = I / Hp(P)
I is known and I can compute all Hp(Px)

Simple answer. It is elliptic curve multiplication. The hash gives you a point. This isn't invertible, so no, you can't do I/H.

Odalv

legendary

Activity: 1414

Merit: 1000

Quote from: illodin on September 18, 2014, 03:00:27 PM

Quote from: ?? on ??

I have been thinking on the coin-killer posts and the more I read it the more I smell BS, there is nothing proving it is more than FUD, if people are dumping because of this they will be sorry soon.

You don't have to fully believe either option, if you think there's 10% chance it is true, the price should take 10% cut, right?

I do not look at source. I'm only asking and study whitepaper (how it works). Maybe I'm wrong.

canonsburg

full member

Activity: 133

Merit: 100

Someone needs to check the source code too but I believe the whitepaper's notation is screwed up.

The paper defines private key a and public Key A through the transformation A = a*G, where G is the Hash function.
So in this case, the multiplication step is to denote the hash mapping.

In the paper, it also defined the key image as I = x * Hp(P)

Now this seems like it is the multiplication of private key x with the hash to the public key P.

But I think this is actually I = x * Hp(P) = x*G2, where G2 like above is another hash function so this is just a hash of private key x using some deterministic hash function that is dependent on public key P (Hp(P)).

illodin

hero member

Activity: 966

Merit: 1003

Quote from: ?? on ??

I have been thinking on the coin-killer posts and the more I read it the more I smell BS, there is nothing proving it is more than FUD, if people are dumping because of this they will be sorry soon.

You don't have to fully believe either option, if you think there's 10% chance it is true, the price should take 10% cut, right?

Odalv

legendary

Activity: 1414

Merit: 1000

Quote from: fluffypony on September 18, 2014, 02:37:09 PM

Quote from: Odalv on September 18, 2014, 02:24:50 PM

https://cryptonote.org/whitepaper.pdf

Quote

The signer picks a random secret key and computes the corresponding
public key P=xG. Additionally he computes another public key
I=xHp(P) which we will call the "key image"
...
Nobody can recover the public key from the key image and identify the signer

lol, but everybody can compute "key image" from public key and then identify the signer

Edit
if this mean I = x * Hp(P) then I can compute even x

x = I / Hp(P)
I is known and I can compute all Hp(Px)

H_p is a deterministic hash function. You only know I, x is secret. P is computed using x. Explain again how you're going to reverse the hash function?

I'll apply H_p on all public keys (P is public key) in signature.
I know I, P, H_p(P) seems I can compute x

x = I / Hp(P)

Edit:
P is one of 6 public keys ... I'll try all

smooth

legendary

Activity: 2968

Merit: 1198

Quote from: fluffypony on September 18, 2014, 02:37:09 PM

Quote from: Odalv on September 18, 2014, 02:24:50 PM

https://cryptonote.org/whitepaper.pdf

Quote

The signer picks a random secret key and computes the corresponding
public key P=xG. Additionally he computes another public key
I=xHp(P) which we will call the "key image"
...
Nobody can recover the public key from the key image and identify the signer

lol, but everybody can compute "key image" from public key and then identify the signer

Edit
if this mean I = x * Hp(P) then I can compute even x

x = I / Hp(P)
I is known and I can compute all Hp(Px)

H_p is a deterministic hash function. You only know I, x is secret. P is computed using x. Explain again how you're going to reverse the hash function?

He's missing that you can verify the validity of the key image without knowing x. I explained that in the post after yours.

smooth

legendary

Activity: 2968

Merit: 1198

Quote from: Odalv on September 18, 2014, 01:39:16 PM

If you generate it from private key then no one can verify it is true. (they must trust you)

Nope, they verify it using the equations in VER on page 10, which depend only on r_i and c_i (i.e. the signature) and P, the public key generated from private key, not x, the private key.

The private key is not required to verify the key image, only to generate it.

fluffypony

donator

Activity: 1274

Merit: 1060

GetMonero.org / MyMonero.com

Quote from: Odalv on September 18, 2014, 02:24:50 PM

https://cryptonote.org/whitepaper.pdf

Quote

The signer picks a random secret key and computes the corresponding
public key P=xG. Additionally he computes another public key
I=xHp(P) which we will call the "key image"
...
Nobody can recover the public key from the key image and identify the signer

lol, but everybody can compute "key image" from public key and then identify the signer

Edit
if this mean I = x * Hp(P) then I can compute even x

x = I / Hp(P)
I is known and I can compute all Hp(Px)

H_p is a deterministic hash function. You only know I, x is secret. P is computed using x. Explain again how you're going to reverse the hash function?

smooth

legendary

Activity: 2968

Merit: 1198

Quote from: Odalv on September 18, 2014, 02:24:50 PM

https://cryptonote.org/whitepaper.pdf

Quote

The signer picks a random secret key and computes the corresponding
public key P=xG. Additionally he computes another public key
I=xHp(P) which we will call the "key image"
...
Nobody can recover the public key from the key image and identify the signer

lol, but everybody can compute "key image" from public key and then identify the signer

Nope, x is a private key (aka "secret key"). So you can't compute the key image from the public key. You need the private key (x).

Topic: [XMR] Monero - A secure, private, untraceable cryptocurrency - page 1429. (Read 4670622 times)