5 ms·

> should show that the overwhelming majority of Zcash transactions have the privacy properties of Bitcoin transactions (or worse). Agreed, this should updated

> should show that the overwhelming majority of Zcash transactions have the privacy properties of Bitcoin transactions (or worse). Agreed, this should updated to specify that only transactions between shielded addresses are protected. The point they are trying to make is that the anonymity set between shielded addresses is that of all transactions in the anonymous set. (FWIW, this is a pre-publication draft.) > No? It seems kind of imbalanced to have an analysis which emphasizes the security compromises caused by older monero (pre-CT, pre minimum mixin count) ZCash is pretty explicit about the difference between shielded and transparent addresses.... However, the news here isn't about ZCash. Monero's main claim to fame is that it has an "opaque" blockchain, but this isn't cryptographically ensured. Instead, it relies on each client to create dummy transactions that mirror real ones. That leaves Monero wide open to side channel attacks now and in the future. One would expect careful analysis and much more cautious language. Instead, it looks like clients weren't even doing basic checks: > We find that among Monero transaction inputs with one or more mixins, 62% of these are deducible, i.e. they can be incontrovertibly linked to the prior TXO they spend. It's a solid piece of research and even if Monero fixes everything in this upcoming release, that doesn't make this analysis any less worrying.

str4d 10y ago
> ZCash is pretty explicit about the difference between shielded and transparent addresses.... This is an important point. Having two very distinct addresses (different lengths, different prefixes, different RPC APIs) makes it very obvious to users when they have the benefits of shielded transactions, and when they don't. Thus users make an explicit choice to forgo privacy when they use transparent addresses. The problem of only 28% of transactions currently being shielded (https://explorer.zcha.in/statistics/network https://explorer.zcha.in/statistics/network https://explorer.zcha.in/statistics/timeseries?hashrate=false&supply=false https://explorer.zcha.in/statistics/timeseries?hashrate=fals...) is a separate ecosystem problem, where usage of shielded addresses with third parties (like wallets and exchanges) requires them to use new APIs, instead of just interacting with the new block chain via the Bitcoin API. IIUC Monero has also encountered these issues, and it is something we are both working on improving.
- sgp_ 10y ago
  Sorry if I'm looking at the data wrong, but this chart suggests less than 5% are shielded https://explorer.zcha.in/statistics/value https://explorer.zcha.in/statistics/value Is the chart wrong?
  - whatwhatwha 10y ago
    Perhaps it could have something to do with termonology (%value vs %transactions). For value I get: 42588 / (891015+222753) = 3.8% Shielded Value / (Cumulative Miner's Reward + Cumulative Founder's Reward) Perhaps it is 28% of transactions are shielded worth only 4% of zec value?
  - whatwhatwha 10y ago
    Perhaps it could have something to do with termonology (%value vs %transactions). For value I get: 42588 / (891015+222753) = 3.8% Shielded Value / (Cumulative Miner's Reward + Cumulative Founder's Reward) Perhaps it is 28% of transactions are shielded worth only 4% of zec value?
    - daira 10y ago
      Note that the number of prior shielded transactions (not the proportion, and not the value) is what is actually relevant to the privacy of new shielded transactions. Roughly speaking, the privacy you get with Zcash is comparable to what you would get with Monero if you could use all previous shielded transactions (over 120000 of them, currently) as mixins. That's why the criticisms of Zcash based on the percentage use of shielding (either by transactions or value) are totally missing the point. -- Daira Hopwood (Zcash developer)
      - davidsarah 10y ago
        The number of note commitments can be found using 'zcash-cli getblockchaininfo' and is currently 301068 commitments, i.e. 150534 JoinSplits (so a bit more than the 120000 I said).
  - 10y ago
polarized 10y ago
> The point they are trying to make is that the anonymity set between shielded addresses is that of all transactions in the anonymous set. This way of stating is somewhat questionable in light of the claims in the second half of the paper. What is shown in the second half of the paper is that all possible sources are not equally likely and this most probably applies to Zcash (and every other coin) as well. In the Figure 1 illustration of Zcash, it is most likely that the rightmost (most recent) arc is the correct one. Of course this can't be stated with certainty in either coin. Another way of interpreting the trend shown in Figure 8 is that Zcash gains little (though of course it still gains something) from including all transactions in the anonymity set (arbitrarily far to the right) because once one departs from focusing predominantly on the more recent transactions, the effective anonymity set does not grow much. > Instead, it looks like clients weren't even doing basic checks: >> We find that among Monero transaction inputs with one or more mixins, 62% of these are deducible, i.e. they can be incontrovertibly linked to the prior TXO they spend. There are no basic checks that can solve that issue. It was fixed in a different way. > even if Monero fixes everything in this upcoming release, Most of the issues in the paper were already addressed in the past, and the paper says this. The remaining issue is the time bias which the paper states has already been improved, but can be improved further.
- davidsarah 10y ago
  You're mistaken in saying that it is most likely that the actual note is the most recent one for Zcash. The figure gives a slightly misleading impression because it has to show few enough inputs to fit on the page. The number of possible inputs is the total number of previous shielded notes (before the JoinSplit anchor) that the adversary does not control or know to have been spent. There have been around 129000 JoinSplits so far, each creating two notes; I'll get back to this with a more precise number. In any case, the probability of the actual note being an output from the most recent prior JoinSplit is extremely small, even taking into account recency bias. Another way of saying this is that in Zcash, the content of a fully shielded transaction does not give an adversary any more information about the possible input distribution than they could guess without seeing the content (i.e. only based on the timestamp and the number of JoinSplits in that transaction). In Monero, the adversary can refine their guess of the distribution based on the inputs that are actually mixed in, and that is what creates the privacy weakness. Figure 8 does not apply to Zcash, it is specific to Monero, as the caption states. -- Daira Hopwood (Zcash developer)
plasticmachine 10y ago
What do you mean "if Monero fixes everything"? They already fixed everything, which is why the paper shows the decline in their ability to deduce things, and the paper COMPLETELY STOPS showing data after RingCT went into action. Perhaps you should familiarise yourself with the papers that Monero themselves published on this in September 2014, and the follow-up in January 2015? Here- https://lab.getmonero.org/pubs/MRL-0001.pdf https://lab.getmonero.org/pubs/MRL-0001.pdf https://lab.getmonero.org/pubs/MRL-0004.pdf https://lab.getmonero.org/pubs/MRL-0004.pdf Now the recommendations made in that 2nd paper were only instituted in the v2 hard fork in March 2016, because hard forks are hard and it was their first one, but it doesn't change the fact that they published two papers on it to warn the community, made immediate changes so that updated clients used minimum ring sig sizes, and then hard forked to ban mixin 0. Publishing a paper on an already-discovered and already-solved issue two years later isn't particularly interesting or novel.
- kobe26 10y ago
  How exactly do you fix the reputation of a system that previously claimed unlinkable transactions that is now essentially deanonimized, with some of those users DN users? Everything is ok now and users should have confidence in these people, including G. Maxwell?

str4d 10y ago

> ZCash is pretty explicit about the difference between shielded and transparent addresses.... This is an important point. Having two very distinct addresses (different lengths, different prefixes, different RPC APIs) makes it very obvious to users when they have the benefits of shielded transactions, and when they don't. Thus users make an explicit choice to forgo privacy when they use transparent addresses. The problem of only 28% of transactions currently being shielded (https://explorer.zcha.in/statistics/network https://explorer.zcha.in/statistics/network https://explorer.zcha.in/statistics/timeseries?hashrate=false&supply=false https://explorer.zcha.in/statistics/timeseries?hashrate=fals...) is a separate ecosystem problem, where usage of shielded addresses with third parties (like wallets and exchanges) requires them to use new APIs, instead of just interacting with the new block chain via the Bitcoin API. IIUC Monero has also encountered these issues, and it is something we are both working on improving.

sgp_ 10y ago
Sorry if I'm looking at the data wrong, but this chart suggests less than 5% are shielded https://explorer.zcha.in/statistics/value https://explorer.zcha.in/statistics/value Is the chart wrong?
- whatwhatwha 10y ago
  Perhaps it could have something to do with termonology (%value vs %transactions). For value I get: 42588 / (891015+222753) = 3.8% Shielded Value / (Cumulative Miner's Reward + Cumulative Founder's Reward) Perhaps it is 28% of transactions are shielded worth only 4% of zec value?
- whatwhatwha 10y ago
  Perhaps it could have something to do with termonology (%value vs %transactions). For value I get: 42588 / (891015+222753) = 3.8% Shielded Value / (Cumulative Miner's Reward + Cumulative Founder's Reward) Perhaps it is 28% of transactions are shielded worth only 4% of zec value?
  - daira 10y ago
    Note that the number of prior shielded transactions (not the proportion, and not the value) is what is actually relevant to the privacy of new shielded transactions. Roughly speaking, the privacy you get with Zcash is comparable to what you would get with Monero if you could use all previous shielded transactions (over 120000 of them, currently) as mixins. That's why the criticisms of Zcash based on the percentage use of shielding (either by transactions or value) are totally missing the point. -- Daira Hopwood (Zcash developer)
    - davidsarah 10y ago
      The number of note commitments can be found using 'zcash-cli getblockchaininfo' and is currently 301068 commitments, i.e. 150534 JoinSplits (so a bit more than the 120000 I said).
- 10y ago

polarized 10y ago

> The point they are trying to make is that the anonymity set between shielded addresses is that of all transactions in the anonymous set. This way of stating is somewhat questionable in light of the claims in the second half of the paper. What is shown in the second half of the paper is that all possible sources are not equally likely and this most probably applies to Zcash (and every other coin) as well. In the Figure 1 illustration of Zcash, it is most likely that the rightmost (most recent) arc is the correct one. Of course this can't be stated with certainty in either coin. Another way of interpreting the trend shown in Figure 8 is that Zcash gains little (though of course it still gains something) from including all transactions in the anonymity set (arbitrarily far to the right) because once one departs from focusing predominantly on the more recent transactions, the effective anonymity set does not grow much. > Instead, it looks like clients weren't even doing basic checks: >> We find that among Monero transaction inputs with one or more mixins, 62% of these are deducible, i.e. they can be incontrovertibly linked to the prior TXO they spend. There are no basic checks that can solve that issue. It was fixed in a different way. > even if Monero fixes everything in this upcoming release, Most of the issues in the paper were already addressed in the past, and the paper says this. The remaining issue is the time bias which the paper states has already been improved, but can be improved further.

davidsarah 10y ago
You're mistaken in saying that it is most likely that the actual note is the most recent one for Zcash. The figure gives a slightly misleading impression because it has to show few enough inputs to fit on the page. The number of possible inputs is the total number of previous shielded notes (before the JoinSplit anchor) that the adversary does not control or know to have been spent. There have been around 129000 JoinSplits so far, each creating two notes; I'll get back to this with a more precise number. In any case, the probability of the actual note being an output from the most recent prior JoinSplit is extremely small, even taking into account recency bias. Another way of saying this is that in Zcash, the content of a fully shielded transaction does not give an adversary any more information about the possible input distribution than they could guess without seeing the content (i.e. only based on the timestamp and the number of JoinSplits in that transaction). In Monero, the adversary can refine their guess of the distribution based on the inputs that are actually mixed in, and that is what creates the privacy weakness. Figure 8 does not apply to Zcash, it is specific to Monero, as the caption states. -- Daira Hopwood (Zcash developer)

plasticmachine 10y ago

What do you mean "if Monero fixes everything"? They already fixed everything, which is why the paper shows the decline in their ability to deduce things, and the paper COMPLETELY STOPS showing data after RingCT went into action. Perhaps you should familiarise yourself with the papers that Monero themselves published on this in September 2014, and the follow-up in January 2015? Here- https://lab.getmonero.org/pubs/MRL-0001.pdf https://lab.getmonero.org/pubs/MRL-0001.pdf https://lab.getmonero.org/pubs/MRL-0004.pdf https://lab.getmonero.org/pubs/MRL-0004.pdf Now the recommendations made in that 2nd paper were only instituted in the v2 hard fork in March 2016, because hard forks are hard and it was their first one, but it doesn't change the fact that they published two papers on it to warn the community, made immediate changes so that updated clients used minimum ring sig sizes, and then hard forked to ban mixin 0. Publishing a paper on an already-discovered and already-solved issue two years later isn't particularly interesting or novel.

kobe26 10y ago
How exactly do you fix the reputation of a system that previously claimed unlinkable transactions that is now essentially deanonimized, with some of those users DN users? Everything is ok now and users should have confidence in these people, including G. Maxwell?