3 ms·
> The so-called "key image" as used in CryptoNote coins utilising elliptic curve ed25519 can be modified in a special way, allowing double-spends. This effectiv
by runeks 9y ago
> The so-called "key image" as used in CryptoNote coins utilising elliptic curve ed25519 can be modified in a special way, allowing double-spends. This effectively allows someone to create an infinite amount of coins in a way that is impossible to detect without knowing about the exploit and explicitly writing code to check for it.
Ouch. I guess we're now seeing the value in having a crypto-currency depend on as few (well-tested) cryptographic primitives as possible.
It always strikes me as a bit overzealous when blockchain-based currencies add exotic cryptographic primitives to improve on the properties of Bitcoin a little bit, while at the same time risking complete destruction in case just the tiniest detail has gone unnoticed.
I feel like crypto-money must rely on cryptographic primitives whose subversion would cause great harm elsewhere, too. If not, the financial incentive to expose flaws isn't present until it's already too late (the currency is very valuable). If this isn't the case, the crypto-currency becomes a somewhat meaningless research project, as the financial incentive to reveal weaknesses just isn't there.
- tptacek 9y agoNot sure it's reasonable to call ed25519 an "exotic crypto primitive". It's more modern than P-curve ECDSA, but "modernism" in curves is a trend towards user-proofing: the P-curves and DSA are themselves a thicket of thorny implementation pitfalls. There's no simple conservative path you can chart through this particular crypto use case that will make things easy. Public key cryptography is difficult and dangerous.
- runeks 9y agoI'm honestly not sure if "cryptographic primitive" is the right terminology (I'm no cryptographer), but I was referring to the ring signature scheme that comprises CryptoNote[1]; not ed25519 itself. [1] https://bytecoin.org/cryptonote/ https://bytecoin.org/cryptonote/
- tptacek 9y agoOh, totally fair. Sorry, I shouldn't have well-actuallied you here.
- indolering 9y agoMonero/CryptoNote actually uses fairly vanilla crypto compared to Zcash. However, you have to create new crypto if you want to do new things. Bitcoin's security model is based on the ridiculous premise that people will spend real money to run worthless calculations in exchange for virtual money (edit: /s). What bothers me is that none of them are using high-assurance software methods. Cryptocurrencies are better than most in that the developers have an informal security model written down somewhere. However, the real specification boils down to a pile of C++ code.
- runeks 9y ago> Bitcoin's security model is based on the ridiculous premise that people will spend real money to run worthless calculations in exchange for virtual money. This ridiculous premise is the reality right now. Also, the calculations are by no means worthless. They prevent alteration of the blockchain history. Without this, everyone involved in a crypto-currency can collude to increase their own balances without leaving any proof whatsoever. It's not waste; it's a necessity. Imagine an attacker exploiting a bug in the reference implementation, where the exploit is able to travel from node to node (not far-fetched). This exploit deletes the existing chain that all nodes carry, replacing it with the attacker's version. With Bitcoin this exploit has no effect, because proof-of-work makes the chain immutable. For non-proof-of-work currencies, everyone will be left wondering which version of the history is the correct one, and the only way to settle the matter would be through trust.
- indolering 9y agoI was being sarcastic ; ) I'll edit the post.
- deleted 9y ago[deleted]