5 ms·

Amiller, Figure 1 should show that the overwhelming majority of Zcash transactions have the privacy properties of Bitcoin transactions (or worse). No? It seem

by nullc 10y ago

Amiller, Figure 1 should show that the overwhelming majority of Zcash transactions have the privacy properties of Bitcoin transactions (or worse). No? It seems kind of imbalanced to have an analysis which emphasizes the security compromises caused by older monero (pre-CT, pre minimum mixin count) while ignoring the ongoing privacy flaw in Zcash usage in practice.

woah 10y ago
Are you talking about the fact that Zcash has, as a feature, the ability to make non-anonymous payments as well? Why would this be of interest to anyone studying the anonymity properties of Monero?
- midmagico 10y ago
  .. ask the author. He's the one that put that in the paper. Didn't you read it?
- nullc 10y ago
  > Are you talking about the fact that Zcash has, as a feature, the ability to make non-anonymous payments as well? Last I checked virtually none of Zcash's transaction used the anonymous payment feature (presumably because the performance of it is very poor). So it's plausible that monero transactions could practically end up with a larger anonymity set in absolute terms than zcash (especially for current monero, which has CT and a minimum mixin size). I think it would be more accurate to say that Zcash, has, as a feature, a way to make anonymous payments, but it is rarely used.
  - socrates1024 10y ago
    In the next version we'll clarify zcash shielded transactions are optional. Fwiw it's used by 28% of tx according to https://explorer.zcha.in/statistics/network https://explorer.zcha.in/statistics/network and comments above, not "rarely used"
    - indolering 10y ago
      And how much of that is from miners who immediately cash out move it to a transparent address?
    - canth 10y ago
      I'm not certain the source of these shielded transactions but the vast majority of value seems to be in unshielded transactions. Transparent value (unspent TX + unspent block rewards) = 1,070,918 while shielded value = 42,588 or around 4% of all value. That sounds like rarely used for transactions of any value to me.
  - indolering 10y ago
    There is nothing preventing memory usage from being brought into the ~250MB range. The performance issues stem from a legacy codebase built by academics and a focus on safety and enterprise features. >So it's plausible that monero transactions could practically end up with a larger anonymity set in absolute terms than zcash (especially for current monero, which has CT and a minimum mixin size). No, it isn't. There will always be a transaction graph between accounts, which limits the total number of possible routes between two participants in a trade.
    - davidsarah 10y ago
      To correct a minor point, none of the current Zcash code comes from the Zerocash academic prototype. All of the code that had come from the prototype was rewritten before launch (mainly in https://github.com/zcash/zcash/pull/625 https://github.com/zcash/zcash/pull/625 ). Much of the performance issue comes from a single design decision made in Zerocash: to use SHA-256 for the Merkle tree, PRF, and note commitment hashes. We'll be changing this for the Sapling update. -- Daira Hopwood (Zcash developer)
      - indolering 10y ago
        My apologies, I had assumed the codebase was legacy due to some lamentations about not being able to use Rust. I hope my portrayal of the performance issues was appropriate.
        daira 10y ago
        The legacy codebase issue we are lamenting there is just that the code inherited from Bitcoin is in C++. It's of course possible to interface between C++ and Rust, and that's what we're intending to do in future. It would have been risky to try to do that in the code we wrote before launch. Yes, your portrayal of the performance issues was fine.
  - zookozcash 10y ago
    Here are current stats about shielded and unshielded transactions in the last hour/day/week/month: https://explorer.zcha.in/statistics/usage https://explorer.zcha.in/statistics/usage And here historical stats about shielded and unshielded transactions in the most recent 100 blocks over the life of the blockchain so far (about 6 months): https://explorer.zcha.in/statistics/timeseries?supply=false&hashrate=false https://explorer.zcha.in/statistics/timeseries?supply=false&... Note that a big part of the shielded transactions is because coinbases are required by the consensus rules to be shielded when first spent. This was in order to provide a guaranteed privacy-set. If you make a shielded Zcash transaction today there is actually a very large privacy-set of possible previous transactions which could be inputs to your transaction. In the long run we intend to improve the functionality of Zcash shielded addresses and to deprecate Zcash transparent addresses, so that all transactions are shielded and so that the user experience is simpler.
indolering 10y ago
> should show that the overwhelming majority of Zcash transactions have the privacy properties of Bitcoin transactions (or worse). Agreed, this should updated to specify that only transactions between shielded addresses are protected. The point they are trying to make is that the anonymity set between shielded addresses is that of all transactions in the anonymous set. (FWIW, this is a pre-publication draft.) > No? It seems kind of imbalanced to have an analysis which emphasizes the security compromises caused by older monero (pre-CT, pre minimum mixin count) ZCash is pretty explicit about the difference between shielded and transparent addresses.... However, the news here isn't about ZCash. Monero's main claim to fame is that it has an "opaque" blockchain, but this isn't cryptographically ensured. Instead, it relies on each client to create dummy transactions that mirror real ones. That leaves Monero wide open to side channel attacks now and in the future. One would expect careful analysis and much more cautious language. Instead, it looks like clients weren't even doing basic checks: > We find that among Monero transaction inputs with one or more mixins, 62% of these are deducible, i.e. they can be incontrovertibly linked to the prior TXO they spend. It's a solid piece of research and even if Monero fixes everything in this upcoming release, that doesn't make this analysis any less worrying.
- str4d 10y ago
  > ZCash is pretty explicit about the difference between shielded and transparent addresses.... This is an important point. Having two very distinct addresses (different lengths, different prefixes, different RPC APIs) makes it very obvious to users when they have the benefits of shielded transactions, and when they don't. Thus users make an explicit choice to forgo privacy when they use transparent addresses. The problem of only 28% of transactions currently being shielded (https://explorer.zcha.in/statistics/network https://explorer.zcha.in/statistics/network https://explorer.zcha.in/statistics/timeseries?hashrate=false&supply=false https://explorer.zcha.in/statistics/timeseries?hashrate=fals...) is a separate ecosystem problem, where usage of shielded addresses with third parties (like wallets and exchanges) requires them to use new APIs, instead of just interacting with the new block chain via the Bitcoin API. IIUC Monero has also encountered these issues, and it is something we are both working on improving.
  - 10y ago
kobe26 10y ago
Take this as a prime example of the corruption that has become the defacto behavior of a small but very influential group of Bitcoin developers. Greg has been promoting Monero since it's inception, a cryptocurrency advertised as being unlinkable. T addresses in ZEC were NEVER STATED TO BE PRIVATE. The argument that Monero transactions being found to be linkable at a wide range of mixins, as demonstrated by the paper and the search facility on http://monerolink.com http://monerolink.com, is somehow comparable to ZCash NON PRIVATE transactions between T addresses, is essentially academic fraud, which is in many ways the norm for people so jaded by the pursuit of profit - Yes, Greg is a Monero holder. Greg, as you continue to flap around this issue presenting such fallacious arguments to essentially cover your own incompetence, and an incompetence that potentially could have cost many people their own privacy and security by promoting such a defunct privacy system, please understand that most people are not this easily fooled and your own credibility is permanently tainted in this regard, as it very well should be. I would add that the additional argument being floated on this issue, that this major flaw is fixed now and doesn't matter, is another case of academic fraud; Any system that has is misrepresented for so long (May 2014- Jan 2017) at the cost of user's privacy and once a "fix" such as CT is applied to then say this system is sound is another pathetic attempt by dishonest academics to cover the incompetence and protect their reputations and personal financial interests. Bitcoin was intended to fight corruption and the influence of corrupt "officials". It is time for change.

by nullc 10y ago

woah 10y ago

Are you talking about the fact that Zcash has, as a feature, the ability to make non-anonymous payments as well? Why would this be of interest to anyone studying the anonymity properties of Monero?

midmagico 10y ago
.. ask the author. He's the one that put that in the paper. Didn't you read it?
nullc 10y ago
> Are you talking about the fact that Zcash has, as a feature, the ability to make non-anonymous payments as well? Last I checked virtually none of Zcash's transaction used the anonymous payment feature (presumably because the performance of it is very poor). So it's plausible that monero transactions could practically end up with a larger anonymity set in absolute terms than zcash (especially for current monero, which has CT and a minimum mixin size). I think it would be more accurate to say that Zcash, has, as a feature, a way to make anonymous payments, but it is rarely used.
- socrates1024 10y ago
  In the next version we'll clarify zcash shielded transactions are optional. Fwiw it's used by 28% of tx according to https://explorer.zcha.in/statistics/network https://explorer.zcha.in/statistics/network and comments above, not "rarely used"
  - indolering 10y ago
    And how much of that is from miners who immediately cash out move it to a transparent address?
  - canth 10y ago
    I'm not certain the source of these shielded transactions but the vast majority of value seems to be in unshielded transactions. Transparent value (unspent TX + unspent block rewards) = 1,070,918 while shielded value = 42,588 or around 4% of all value. That sounds like rarely used for transactions of any value to me.
- indolering 10y ago
  There is nothing preventing memory usage from being brought into the ~250MB range. The performance issues stem from a legacy codebase built by academics and a focus on safety and enterprise features. >So it's plausible that monero transactions could practically end up with a larger anonymity set in absolute terms than zcash (especially for current monero, which has CT and a minimum mixin size). No, it isn't. There will always be a transaction graph between accounts, which limits the total number of possible routes between two participants in a trade.
  - davidsarah 10y ago
    To correct a minor point, none of the current Zcash code comes from the Zerocash academic prototype. All of the code that had come from the prototype was rewritten before launch (mainly in https://github.com/zcash/zcash/pull/625 https://github.com/zcash/zcash/pull/625 ). Much of the performance issue comes from a single design decision made in Zerocash: to use SHA-256 for the Merkle tree, PRF, and note commitment hashes. We'll be changing this for the Sapling update. -- Daira Hopwood (Zcash developer)
    - indolering 10y ago
      My apologies, I had assumed the codebase was legacy due to some lamentations about not being able to use Rust. I hope my portrayal of the performance issues was appropriate.
      - daira 10y ago
        The legacy codebase issue we are lamenting there is just that the code inherited from Bitcoin is in C++. It's of course possible to interface between C++ and Rust, and that's what we're intending to do in future. It would have been risky to try to do that in the code we wrote before launch. Yes, your portrayal of the performance issues was fine.
- zookozcash 10y ago
  Here are current stats about shielded and unshielded transactions in the last hour/day/week/month: https://explorer.zcha.in/statistics/usage https://explorer.zcha.in/statistics/usage And here historical stats about shielded and unshielded transactions in the most recent 100 blocks over the life of the blockchain so far (about 6 months): https://explorer.zcha.in/statistics/timeseries?supply=false&hashrate=false https://explorer.zcha.in/statistics/timeseries?supply=false&... Note that a big part of the shielded transactions is because coinbases are required by the consensus rules to be shielded when first spent. This was in order to provide a guaranteed privacy-set. If you make a shielded Zcash transaction today there is actually a very large privacy-set of possible previous transactions which could be inputs to your transaction. In the long run we intend to improve the functionality of Zcash shielded addresses and to deprecate Zcash transparent addresses, so that all transactions are shielded and so that the user experience is simpler.

indolering 10y ago

> should show that the overwhelming majority of Zcash transactions have the privacy properties of Bitcoin transactions (or worse). Agreed, this should updated to specify that only transactions between shielded addresses are protected. The point they are trying to make is that the anonymity set between shielded addresses is that of all transactions in the anonymous set. (FWIW, this is a pre-publication draft.) > No? It seems kind of imbalanced to have an analysis which emphasizes the security compromises caused by older monero (pre-CT, pre minimum mixin count) ZCash is pretty explicit about the difference between shielded and transparent addresses.... However, the news here isn't about ZCash. Monero's main claim to fame is that it has an "opaque" blockchain, but this isn't cryptographically ensured. Instead, it relies on each client to create dummy transactions that mirror real ones. That leaves Monero wide open to side channel attacks now and in the future. One would expect careful analysis and much more cautious language. Instead, it looks like clients weren't even doing basic checks: > We find that among Monero transaction inputs with one or more mixins, 62% of these are deducible, i.e. they can be incontrovertibly linked to the prior TXO they spend. It's a solid piece of research and even if Monero fixes everything in this upcoming release, that doesn't make this analysis any less worrying.

str4d 10y ago
> ZCash is pretty explicit about the difference between shielded and transparent addresses.... This is an important point. Having two very distinct addresses (different lengths, different prefixes, different RPC APIs) makes it very obvious to users when they have the benefits of shielded transactions, and when they don't. Thus users make an explicit choice to forgo privacy when they use transparent addresses. The problem of only 28% of transactions currently being shielded (https://explorer.zcha.in/statistics/network https://explorer.zcha.in/statistics/network https://explorer.zcha.in/statistics/timeseries?hashrate=false&supply=false https://explorer.zcha.in/statistics/timeseries?hashrate=fals...) is a separate ecosystem problem, where usage of shielded addresses with third parties (like wallets and exchanges) requires them to use new APIs, instead of just interacting with the new block chain via the Bitcoin API. IIUC Monero has also encountered these issues, and it is something we are both working on improving.
- 10y ago

kobe26 10y ago

Take this as a prime example of the corruption that has become the defacto behavior of a small but very influential group of Bitcoin developers. Greg has been promoting Monero since it's inception, a cryptocurrency advertised as being unlinkable. T addresses in ZEC were NEVER STATED TO BE PRIVATE. The argument that Monero transactions being found to be linkable at a wide range of mixins, as demonstrated by the paper and the search facility on http://monerolink.com http://monerolink.com, is somehow comparable to ZCash NON PRIVATE transactions between T addresses, is essentially academic fraud, which is in many ways the norm for people so jaded by the pursuit of profit - Yes, Greg is a Monero holder. Greg, as you continue to flap around this issue presenting such fallacious arguments to essentially cover your own incompetence, and an incompetence that potentially could have cost many people their own privacy and security by promoting such a defunct privacy system, please understand that most people are not this easily fooled and your own credibility is permanently tainted in this regard, as it very well should be. I would add that the additional argument being floated on this issue, that this major flaw is fixed now and doesn't matter, is another case of academic fraud; Any system that has is misrepresented for so long (May 2014- Jan 2017) at the cost of user's privacy and once a "fix" such as CT is applied to then say this system is sound is another pathetic attempt by dishonest academics to cover the incompetence and protect their reputations and personal financial interests. Bitcoin was intended to fight corruption and the influence of corrupt "officials". It is time for change.