Topic: Zero Knowledge Transactions - page 13. (Read 18678 times)

Here's gmaxwell's original write-up on Confidential Transactions: https://people.xiph.org/%7Egreg/confidential_values.txt

Here's Denis Lukianov's latest paper on Compact Confidential Transactions: http://voxelsoft.com/dev/cct.html

Finally, here's the WIP paper that Shen Noether, of the Monero Research Lab, has been focusing on: https://github.com/ShenNoether/MiniNero/blob/master/RingCT0.3.pdf

The plot thickens.

Sounds like I need to do a little more reading around.

Any references?

I'll be interested to help, where I can, if you go down that route.

Your various thoughts and challenges have helped a lot of people and projects over the years. You might be surprised at how many people would be prepared to support you.

Smooth that was a better explanation than my response. Indeed Daniel is glossing over many issues.

Fundamentally sound anonymity is multi-pronged, end-to-end, and on chain.

My white paper even discusses computer security and what needs to be done and can practically be done. My white paper is holistic, as is everything I try to do in design work.

You are asking for more than 100K yet you have not responded to the cryptographer on reddit.

1. Plagiarize the work, shared freely, of Adam Back, Shen, Denis, myself, and others (and in my case even implemented in a high performance implementation).

2. Ask for twenty grand in donations.

3. Profit.

Here's a hint to someone who might think of funding this stuff, "just in case":   Non-contributiors being paid for what is primarily your work is incredibly demoralizing-- doubly so when they don't even add anything to it (not even a good implementation); if you want to kill science and engineering in this space go ahead and fund more vaporware scams.

Science needs to happen in the open. I'm also very supportive of people being paid for their work, but they need to actually do work, not just sell snakeoil to others.  This community often does a much better job at funding scams than people who reliably contribute.

Thank you.


Smooth and I discussed this I believe in 2014 and the conclusion is that everything sent to the internet can be recorded, so there is no such thing as off chain anonymity (CoinShuffle excepted, and also CoinJoin if jamming and DoS is not your worry) if you are referring to protection against national security agencies and government capital controls.

And if for a business or high net worth individual, then you may also want to be very safe against espionage and mobsters, so again your upstream ISP, masternode/delegated node, or what ever might be compromised.

Also one of the most important points is that only on chain anonymity obeys the End-to-end principle of networks. The means your anonymity is orthogonal to any agent in the network. This is critical for scalability, redundancy, and resilience.

So please enough with the off chain anonymity. It is highly inferior. It is a hack that got some play in terms of quick way to get anonymity rolling (e.g. Dash), but it is not the future. If the internet had been invented without the end-to-end principle, then TCP/IP wouldn't work and we'd not have the scalable, resilient internet we have today that enables to even be here.

Except for CoinShuffle, Off chain mixing = trusting someone (node/server) you can't prove you can trust.

Here follows the section from my white paper on this topic.


I solved that, but that is not what I am going to release now nor discuss now.


Well I have more surprises up my sleeve. This white paper isn't the only one.

Boolberry may not have lots of monero available for donations but it is an advanced CryptoNote coin and is part of SuperNET. Maybe SuperNET could fund you to combine CryptoNote and CT (they raised a lot in ICO) since Boolberry is part of SuperNET. That would seem like an infinitely superior solution to CoinShuffle which they are also working on. You should talk to the SuperNET people and cryptozoidberg from Boolberry.

This thread is a precursor to deciding where to apply energies. Gauging interest level, etc.. There are range of opportunities for this algorithm I invented, including even for example the SuperNet, Dash, Monero, holding for my own coin, partnering with another upstart coin such as Aeon, etc..

It also possible that I form a working relationship with another coin, then continue developing for that coin applying my other inventions there, but it really depends on how funding works well (efficient, well paid, helpful or non-divisive working relationships, etc).

To use that model, you have to use the forum funding system (FFS). Like everyone else. Example: https://forum.getmonero.org/9/work-in-progress/2400/open-source-amd-miner-by-wolf0

Perhaps you missed this link in my post:


The point of that quote link is that some developers have raised a lot of money and they are in a position to buy an exclusive on my white paper and have "first mover" advantage. As equity amasses to the coin that can be the "first mover" then it has an advantage in terms of funding developments and furthering its lead over others, and this can become insurmountable, e.g. Bitcoin.

Right now we are laying the ground work for the next big move in the BTC price to new all time highs (probably 2017, but starting to move up in later half of 2016), so it is of the essence to be in that position before the moves starts.


Ditto the above. I think the most value will come from my invention by putting it exclusively in a coin that people are invested in, so then they have the most incentive to invest in my work as an addition to their investment. The most value would come from doing my own coin along with a lot more work to complete, and I retain that option if none of the other coins can meet my minimal compensation threshold.


Those who raised a lot of money had an ICO or premine. Monero didn't. I am happy to contribute to Monero if their claimed donation model works. That is why I am here making this thread. Many people have claimed to me that ICO and premines are bad and that donations with a "fair" distribution is better. Okay so prove it to me. I want to see which model can fund the development of the best anonymity design. This thread is an experiment to teach me more about the economics of the crypto market, as well as my other stated objectives.


I am trying to make this my job. If it doesn't work out, I will lick my wounds and charge it to experience.


It is still possible I keep it only for the Ion project.

But the Ion project would take more months to develop, and the anonymity would probably be added after the high TPS and block chain scaling, so that means this anonymity feature might not reach the market until mid-2016 (perhaps sooner but maybe not).

So on balance, I am trying to do what seems to make the most sense overall by being flexible and observing all options, weighing all the risk factors and what is best also for me as both a user of crypto and a potential lead developer or a just a contributing developer.

Nor should you have to.

Unfortunately, many will take the view that this will be open source at some point, so most will just wait.

If it is peer reviewed and tested, you might find that mixing services would be prepared to pay you.

Just a thought.

He got 0 for it. He even donated as every core member to development that makes it a fat minus.



Open Source projects barely pay an income especially smaller ones, so forget it.



Why are you even working on that stuff then, get a job that pays you what you need. Should be easy.

As my Abstract says, my design requires no new unproven crypto. He is inventing a new type of signature that has probabilistic assumptions (plus perhaps complex external factors which impact probabilities). Those assumptions could be broken. I use long standing crypto that is well proven.

Also he still hasn't solved the other problem which is balances can't be merged without revealing values.

Also I have fixed CCT, which is much more efficient than CT.

Also I expect further problems with Shen's approach as it undergoes a lot of peer review. I just haven't taken the time to really dig into, as it is a patchwork quilt of crypto methods, whereas mine is so very straight foward merging of existing Cryptonote and CCT with simple and obvious tech.

Trust in the anonymity is the most important that is worth a lot more than a measly $21,000.


I was there debating with one of those guys just after he claimed to have optimized it (because I had designed a similar PoW has to Cryptonote's before I learned about CN). And someone posted he had earned $150,000 on that effort and I don't remember any refutation. I believe it was DGA.

In any case, if the crypto market can't pay a good income, then it is okay if developers will choose not to work on the market. I assume NoodleDoodle or who ever did that optimization earned what they felt was a good return on their investment.

I am not here to donate my time. I can't afford it.

This remains kind of uncertain overall. I think there are some questions raised in one of shen's papers. By being smarter about how you break up amounts you can achieve quite a bit of hiding and not incur the cost of the range proofs. There are, as you pointed out, certain weaknesses to unlinkability and maybe CT-derived approaches end up being a win overall but it isn't totally clear yet.

As you say there are different markets and for some markets hiding amounts completely may be more important even if there is an overall resource cost. For example, those wanting to hide large transfers (you can't make anything that looks like a large transfer in cryptonote if you don't even have a large amount of coins to begin with, and in a mixed system smaller users won't, so actual very large transfers or at least transfers by users with very large wallets, will tend to stick out).

good ideas but i wouldent donate

I agree that you can't go after for example decentralized exchanges on chain if you don't have very high TPS. So there are certain markets you can't service without the high TPS solution.

However, the governments are coming after everything with capital controls, and for that and other reasons some people may want to really anonymize their transaction trails very well, so that is an example of one market that can use low TPS anonymity improvements and that market will be growing very fast in 2016. So Monero or other anonymous coin having the "first mover" advantage on the most significant advance for anonymity since Cryptonote and theoretical Zerocash could potentially significantly raise the market moment of that coin.

Also as I wrote to illodin, this reduces block chain bloat in terms of less transactions needed to transfer a balance as powers-of-ten (well that is not factoring in the cost of the Proof of Sums so perhaps not a size reduction overall, but you gain an important feature of hiding values) and wallet complexity/inflexibility of any existing Cryptonote coin.

Of course they would want to follow it up with more efforts to make their platform viable for more markets. High TPS are not the only markets. They are important to me, so I won't disagree about their high potential value, but low TPS anonymity is also a market. Also anonymity is already a developed and proven market whereas high TPS is a new unproven market.

When the next bubble comes back to crypto, anonymity can be one of those sectors that gets hot with speculators.

Caveat: make sure the low TPS anonymous rings are mixing properly with UXTO that are also spent into anonymous rings, otherwise the anonymity breaks down if only a few people are using anonymous rings (but I think Monero and others are already aware of this, even I think Boolberry had a special feature flag to force this).

Anonymity is a feature. For example what if Crypto Kingdom gamers want to be really untraceable to their other hacker gamers. Did you see that kid in Manila was mauled to death for writing "whew" on a girls facebook page. There are non-nefarious reasons for using anonymity.

Even businesses want to hide the values they are transacting so that competitors do not have that proprietary information. And that could be low TPS transactions for now.

I agree eventually we need to solve high TPS and block chain scaling, but anonymity isn't entirely useless just as Bitcoin isn't entirely useless. I'd hold more BTC if the damn thing was more anonymous. I have not trusted I could transfer over to Monero, mix, then come back and retain anonymity well. I'd rather have it on chain for the coin I am holding.


I think there is a better design but I am not ready yet to discuss that. I need to focus in this thread and time on the anonymity invention I created.

We will hopefully get there asap. But really I have been in such a whirlwind with my rollercoaster health, that I don't want to talk too much about the future. Let's get done what I can do now for now.


I had already responded to you about that in the past and explained it doesn't have untraceability therefor it is trivially unmasked via combinatorial analysis. It adds some obfuscation, but it is step backwards from Cyptonote except that it doesn't have the problem of equal denominations. And it can hide value. Mine combines all of Cryptonote (which includes both stealth addresses for unlinkability and rings for untraceability) with hidden values. I have the first complete on chain anonymity that doesn't have Zerocash's drawbacks.


The opposite. It will destroy the anonymity aspect of the threat from Bitshares, by moving way beyond it on anonymity features. I'd say Monero needs this to stay in the clear anonymity lead.

As for whether Bitshare's high TPS solution will become more important to the market than anonymity, I don't know. Last time I looked, Bitshares was talking about what each CPU could process, not about actually network throughput on a real testnet. Perhaps more has come out since I last looked. I will look into it at some point in near future.

We have anon with dash, why we should donate?

Ok, I've only skimmed those papers as they are not relevant to the eMunie ledger design, so kinda pointless to educate on them in depth.

UTXOs will kill your ability to scale though unless you enforce BitShares level machines with endless RAM at high loads...have you considered those kind of loads and how to manage them?

Maybe, but attacks on anonymity can be quite subtle, with various combinatorial, timing, and sybil type attacks, so I wouldn't be so confident. If you look at unlinkability, untraceability, and amount hiding as three prongs of resistance to blockchain analysis, then he's entirely missing one prong, which makes his argument quite weak. Blockstream has stated likewise about CT not hiding what they call transaction metadata, only content. Stealth is a nice convenience feature, but largely similar to just having good address reuse practices in Bitcoin (which can also be achieved via payment protocols and HD address chains). To do this well, you really need another piece, at least some sort of good coinjoin/coinshuffle type solution, and that is really hard to do well (potentially impossible) given sybil and timing attacks. At least Dash tries, but Larimer dismisses the problem too easily.

So I'd characterize Larimer's argument as largely wishful thinking and/or hype (i.e. this is what I have therefore this is what is needed, the marketers variation of the arguing from the conclusion fallacy).

But that's an entirely different argument from whether strong privacy/anonymity/fungibility (it is very hard to separate any of these from the others) is more important than scalability (or vice versa). I suppose you could also make that argument that without all of these things you don't really have a very strong solution overall and again are engaging in wishful thinking (which was in many ways the premise of TPTB's original Ion "Bitcoin killer" concept, before he neutered it).