3 ms·
> There is no known scheme that has similar properties but non-trusted setup. There's not a proof that it's impossible either, so something might get invented.
by knocte 9y ago
> There is no known scheme that has similar properties but non-trusted setup. There's not a proof that it's impossible either, so something might get invented. But at the moment, no.
Already invented. It's called MimbleWimble.
- kobeya 9y ago... that's a system with entirely different properties.
- knocte 9y agoAnd? It provides privacy.
- kobeya 9y agoWith a very different set of tradeoffs. MW does not provide anonymity. It provides, at best, pseudo-anonymity with coinjoin mixing by default, with N=2 in the implementations being considered. Careful repeated application with the right counter-parties can compound that into larger anonymity sets. That's a step forward from bitcoin, for sure. And if you're very careful, it could achieve whatever privacy requirement you might have. The Zcash-like approach on the other hand is to provide a transaction mode where your anonymity set is everyone who has ever transacted with the system before. That's N=everybody; the source of funds is entirely obscured. The two achieve totally different goals, with a different set of tradeoffs. Apples to oranges.
- plasticmachine 9y agoI’m a massive MW proponent but the privacy claims are very weak compared to ZCash and Monero. What MW does well is scalability.