7 ms·

No. Two words. Trusted setup. Monero is way closer to Satoshi's vision, up to and including having an unknown inventor.

JelteF 9y ago
The trusted setup is not as bad as those two words make it sound without any context: 1. All people present in the trusted setup would have to be colluding or be compromised to cause an issue. 2. Some of these people have reason to make the currency succeed, because they own large amounts of zcash. 3. Some show the lengths they went to to prevent compromise: https://petertodd.org/2016/cypherpunk-desert-bus-zcash-trusted-setup-ceremony https://petertodd.org/2016/cypherpunk-desert-bus-zcash-trust... One of my own opinions on collusion: If collusion was suggested by one or more of the people present in the setup it would be quite likely that another one would have come out and said something about it. This would have made zcash and the person itself very untrustworthy. This makes it likely that it wasn't worth the risk to the person thinking of collusion in the first place.
- nubela 9y ago
  Erm, #1 is not that far from being achieved. IIRC, that's just 6 people, guarding hundreds of millions of dollars. There lies the inherent problem with "trusted setup", why leave there a possibility of 6 people not colluding? That just isn't scientific or exhuastive. Just drop the IFs, go with Monero's method of RingCT. Beside, Monero's privacy is a working feature today, with no pre-mines, unlike ZCash.
  - sowithit 9y ago
    It is not down to 6 people forever not colluding. It's down to 6 people not having colluded at one point in time in the past, each having been scrutinized during the procedure, with post-hoc inspection of the software and hardware. If those 6 people decided at any point after the procedure that they wanted to collude, then it would be too late for them to do so. Essentially they each produced a private key, and if each of them revealed their private key to the same party then that party could derive a master private key that would allow them to (among other things) mint Zcash for free (privacy wouldn't be broken). Assuming that any one of the 6 did in fact destroy/corrupt his private key without revealing it, then the collusion opportunity is forever lost.
- mercer 9y ago
  Honest question: what about the potential of someone kidnapping two or more of these people and forcing them to give up their keys? What would the consequence of that be?
  - rspeer 9y ago
    My understanding is that you would have to believe that they were kidnapped or otherwise under duress at the time that they did the trusted setup, which was on video. The trusted information (supposedly) can't be given up now because nobody has it: it was ceremonially destroyed in interesting ways.
- makomk 9y ago
  The trusted setup is not necessarily an issue in practice, but it's something that Bitcoin was explicitly created to avoid and that makes it rather absurd to describe Zcash as "Satoshi's vision". Arguably it has as much or more in common with the older pre-Bitcoin cryptocurrencies than with Bitcoin.
- petertodd 9y ago
  I'd suggest you read my "Cypherpunk Desert Bus" article a little more closely, notably section 1.2 where I say: "Until the software and deterministic builds are audited, the entire ceremony is a bunch of crypto hocus pocus that means nothing." The trusted setup is really dubious and highly vulnerable; so far my efforts were wasted due to the fundamental problems that everyone in the multi-party-computation ran the exact same unaudited software.
kobeya 9y ago
The other issue with zcash is an ever growing double-spend list. Monero also suffers this flaw, unfortunately. If either one scaled up to just bitcoin's level of activity, there'd be severe problems. Mimblewimble is far more likely to be a lasting privacy gain since the technology it is built upon, Blockstream's confidential transactions, has properties more like Bitcoin's in this regard, and perhaps even better as you can sync from a partially-pruned history.
- q-base 9y ago
  Could you elaborate on this flaw, or perhaps point to a link - especially with regards to Monero?
  - dangero 9y ago
    Yes, I'm pretty sure that neither Zcash or Monero allow double-spends. Wondering what the context of that statement could possibly be. Any successful cryptocurrency must solve the double-spend problem or there's no value in the ledger at all.
  - kobeya 9y ago
    Here's a stack exchange question: https://monero.stackexchange.com/questions/2158/what-is-moneros-mechanism-for-defending-against-a-double-spend-attack https://monero.stackexchange.com/questions/2158/what-is-mone... TL;DR Monero requires every transaction input to include a "key image" (an elliptic curve point, looks like a public key). The key image is deterministically constructed from the actual coin being spent, without actually revealing which one it is. So making sure the chain never contains a repeated key image is sufficient to make sure that no coin is ever spent more than once, without actually knowing whether any one specific coin is spent. This is how Monero achieves its inflation/non-cloning guarantee. (There was a famous double-spending bug in CryptoNote protocols you might have heard about that resulted in limitless inflation. This was because the Ed25519 signature scheme used has a co-factor of 8, a stupid performance "enhancement" that DJB should really re-think. As a result, a given key-image had a 1-in-8 chance of being malleable by adding a point of order 8. It's fixed by checking that the key image is actually contained in the group. These sorts of unexpected consequences are why serious cryptographers don't use co-factors other than 1, or other fiddly tricks that get you small constant implementation gains with risky not well studied trade-offs. This is also why the current push to standardize on DJB designed crypto solutions is borderline insanity. But I digress.) The mathematics of what zerocash does is wildly different, but it serves essentially the same purpose. Each private/anonymous spend in zerocash has some bits associated with it that are generated in a non-linking way from the input being spent. As long as there are never two transactions in the entire block chain history with the same value for this field, there are no double-spends. ----- The problem is that these can never go away. In bitcoin if a coin is spent, you can prune knowledge of that coin from your local history. This is what the "-prune" option does in recent versions of Bitcoin Core. You still need to receive and process the transaction once when you sync the chain, but you can then throw it away if you are space constrained. Mimblewimble potentially improves the situation even better by boiling down each transaction to just a single EC point, the script kernel, such that a client needs only the current UTXO set and the full history of all these kernels to do initial sync. The rest of the data can well and truly be forgotten. But although those kernels are needed for initial sync, pruning nodes can throw them away afterwards. They are not needed for the validation of future blocks in any way. TL;DR: The amount of data a verifier needs to keep around to validate a new block in bitcoin depends only on the number of unspent outputs. The full block chain is only needed for initial sync. This is asymptotically O(current size of bitcoin ecosystem). The amount of data needed by Monero or Zerocash, on the other hand, is (a constant factor of) the entire block chain used by these systems. This is asymptotically O(every transaction ever). Monero and ZCash are chugging along now, but every single block found increases the amount of data a verifier needs to keep around. That doesn't scale....
tromp 9y ago
Mimblewimble [0] is a radically different approach to privacy and fungibility, making all transactions look alike. [0] http://mimblewimble.cash/ http://mimblewimble.cash/
- IIAOPSW 9y ago
  This is a cool project. Thanks for sharing the link. I'll totally buy/mine some GRIN when it comes out. Things I like so far: 1) Solves privacy and scaling in a single elegant stroke. 2) Inventors seem to be anonymous. I didn't try too hard to identify them but Tom Elvis Jedusor is the French name of Lord Voldemort. This is an important feature for privacy focused coins and for cryptocurrency as a political statement (not just as a technology). 3) The website, by eschewing flashy web2.0 design and and buzzwords, clearly sets itself apart from the typical "lets get rich quick" coin. Although I am disappointed the white paper isn't done in LaTeX. Reasons I'm skeptical (perhaps you can address these): 1) Missed the boat on first mover advantage. Monero seems to solve the privacy problem good enough. Perhaps it is unreasonable to expect people to completely swap over to a new coin whenever there's an advance in tech. Especially when word of the new coin has to spread through grass roots instead of a centralized mechanism. 2) Elliptic curve crypto is vulnerable to quantum computers. IMO this is a ticking time bomb. 3) Expanding on point 2, bitcoin intentionally made a habit of layering "proven" crypto methods on top of each other. Eg both SHA256 and RIPEMD160 hash functions are used so that if a weakness is found in one hash the other is still ok. So far as I can tell mimblewimble has a single point of failure (elliptic curve cryptography).
  - tromp 9y ago
    > Reasons I'm skeptical (perhaps you can address these): 1) Monero may have first mover advantage in the privacy realm, but at the cost of prunability. Grin not only avoids that cost but further improves prunability beyond bitcoin. To me the first mover advantage will always belong to bitcoin, which will likely adopt privacy improving features in the long term. 2+3) Indeed; when evidence appears of quantum computers becoming feasible at breaking EC crypto, current blockchains will need to adopt post-quantum crypto methods of signing transactions, and migrate existing balances. Since EC crypto is more heavily ingrained into Grin, it may have a much harder time than the more modular bitcoin design, or even find it impossible to do so. I'm not aware of any post-quantum equivalent to Pedersen commitments. My hope is that quantum computer development runs into insurmountable barriers...
zooko-at-zcash 9y ago
I really don't like the reliance on the Ceremony to prevent counterfeiting, but it is the only way science has yet discovered for how to enable full-strength (encryption-based) privacy. Fortunately, science continues to advance and I hope we'll be able to upgrade to a trapdoor-free cryptographic proof system someday.

The trusted setup is not as bad as those two words make it sound without any context: 1. All people present in the trusted setup would have to be colluding or be compromised to cause an issue. 2. Some of these people have reason to make the currency succeed, because they own large amounts of zcash. 3. Some show the lengths they went to to prevent compromise: https://petertodd.org/2016/cypherpunk-desert-bus-zcash-trusted-setup-ceremony https://petertodd.org/2016/cypherpunk-desert-bus-zcash-trust... One of my own opinions on collusion: If collusion was suggested by one or more of the people present in the setup it would be quite likely that another one would have come out and said something about it. This would have made zcash and the person itself very untrustworthy. This makes it likely that it wasn't worth the risk to the person thinking of collusion in the first place.

nubela 9y ago
Erm, #1 is not that far from being achieved. IIRC, that's just 6 people, guarding hundreds of millions of dollars. There lies the inherent problem with "trusted setup", why leave there a possibility of 6 people not colluding? That just isn't scientific or exhuastive. Just drop the IFs, go with Monero's method of RingCT. Beside, Monero's privacy is a working feature today, with no pre-mines, unlike ZCash.
- sowithit 9y ago
  It is not down to 6 people forever not colluding. It's down to 6 people not having colluded at one point in time in the past, each having been scrutinized during the procedure, with post-hoc inspection of the software and hardware. If those 6 people decided at any point after the procedure that they wanted to collude, then it would be too late for them to do so. Essentially they each produced a private key, and if each of them revealed their private key to the same party then that party could derive a master private key that would allow them to (among other things) mint Zcash for free (privacy wouldn't be broken). Assuming that any one of the 6 did in fact destroy/corrupt his private key without revealing it, then the collusion opportunity is forever lost.
mercer 9y ago
Honest question: what about the potential of someone kidnapping two or more of these people and forcing them to give up their keys? What would the consequence of that be?
- rspeer 9y ago
  My understanding is that you would have to believe that they were kidnapped or otherwise under duress at the time that they did the trusted setup, which was on video. The trusted information (supposedly) can't be given up now because nobody has it: it was ceremonially destroyed in interesting ways.
makomk 9y ago
The trusted setup is not necessarily an issue in practice, but it's something that Bitcoin was explicitly created to avoid and that makes it rather absurd to describe Zcash as "Satoshi's vision". Arguably it has as much or more in common with the older pre-Bitcoin cryptocurrencies than with Bitcoin.
petertodd 9y ago
I'd suggest you read my "Cypherpunk Desert Bus" article a little more closely, notably section 1.2 where I say: "Until the software and deterministic builds are audited, the entire ceremony is a bunch of crypto hocus pocus that means nothing." The trusted setup is really dubious and highly vulnerable; so far my efforts were wasted due to the fundamental problems that everyone in the multi-party-computation ran the exact same unaudited software.

kobeya 9y ago

The other issue with zcash is an ever growing double-spend list. Monero also suffers this flaw, unfortunately. If either one scaled up to just bitcoin's level of activity, there'd be severe problems. Mimblewimble is far more likely to be a lasting privacy gain since the technology it is built upon, Blockstream's confidential transactions, has properties more like Bitcoin's in this regard, and perhaps even better as you can sync from a partially-pruned history.

q-base 9y ago
Could you elaborate on this flaw, or perhaps point to a link - especially with regards to Monero?
- dangero 9y ago
  Yes, I'm pretty sure that neither Zcash or Monero allow double-spends. Wondering what the context of that statement could possibly be. Any successful cryptocurrency must solve the double-spend problem or there's no value in the ledger at all.
- kobeya 9y ago
  Here's a stack exchange question: https://monero.stackexchange.com/questions/2158/what-is-moneros-mechanism-for-defending-against-a-double-spend-attack https://monero.stackexchange.com/questions/2158/what-is-mone... TL;DR Monero requires every transaction input to include a "key image" (an elliptic curve point, looks like a public key). The key image is deterministically constructed from the actual coin being spent, without actually revealing which one it is. So making sure the chain never contains a repeated key image is sufficient to make sure that no coin is ever spent more than once, without actually knowing whether any one specific coin is spent. This is how Monero achieves its inflation/non-cloning guarantee. (There was a famous double-spending bug in CryptoNote protocols you might have heard about that resulted in limitless inflation. This was because the Ed25519 signature scheme used has a co-factor of 8, a stupid performance "enhancement" that DJB should really re-think. As a result, a given key-image had a 1-in-8 chance of being malleable by adding a point of order 8. It's fixed by checking that the key image is actually contained in the group. These sorts of unexpected consequences are why serious cryptographers don't use co-factors other than 1, or other fiddly tricks that get you small constant implementation gains with risky not well studied trade-offs. This is also why the current push to standardize on DJB designed crypto solutions is borderline insanity. But I digress.) The mathematics of what zerocash does is wildly different, but it serves essentially the same purpose. Each private/anonymous spend in zerocash has some bits associated with it that are generated in a non-linking way from the input being spent. As long as there are never two transactions in the entire block chain history with the same value for this field, there are no double-spends. ----- The problem is that these can never go away. In bitcoin if a coin is spent, you can prune knowledge of that coin from your local history. This is what the "-prune" option does in recent versions of Bitcoin Core. You still need to receive and process the transaction once when you sync the chain, but you can then throw it away if you are space constrained. Mimblewimble potentially improves the situation even better by boiling down each transaction to just a single EC point, the script kernel, such that a client needs only the current UTXO set and the full history of all these kernels to do initial sync. The rest of the data can well and truly be forgotten. But although those kernels are needed for initial sync, pruning nodes can throw them away afterwards. They are not needed for the validation of future blocks in any way. TL;DR: The amount of data a verifier needs to keep around to validate a new block in bitcoin depends only on the number of unspent outputs. The full block chain is only needed for initial sync. This is asymptotically O(current size of bitcoin ecosystem). The amount of data needed by Monero or Zerocash, on the other hand, is (a constant factor of) the entire block chain used by these systems. This is asymptotically O(every transaction ever). Monero and ZCash are chugging along now, but every single block found increases the amount of data a verifier needs to keep around. That doesn't scale....

tromp 9y ago

Mimblewimble [0] is a radically different approach to privacy and fungibility, making all transactions look alike. [0] http://mimblewimble.cash/ http://mimblewimble.cash/

IIAOPSW 9y ago
This is a cool project. Thanks for sharing the link. I'll totally buy/mine some GRIN when it comes out. Things I like so far: 1) Solves privacy and scaling in a single elegant stroke. 2) Inventors seem to be anonymous. I didn't try too hard to identify them but Tom Elvis Jedusor is the French name of Lord Voldemort. This is an important feature for privacy focused coins and for cryptocurrency as a political statement (not just as a technology). 3) The website, by eschewing flashy web2.0 design and and buzzwords, clearly sets itself apart from the typical "lets get rich quick" coin. Although I am disappointed the white paper isn't done in LaTeX. Reasons I'm skeptical (perhaps you can address these): 1) Missed the boat on first mover advantage. Monero seems to solve the privacy problem good enough. Perhaps it is unreasonable to expect people to completely swap over to a new coin whenever there's an advance in tech. Especially when word of the new coin has to spread through grass roots instead of a centralized mechanism. 2) Elliptic curve crypto is vulnerable to quantum computers. IMO this is a ticking time bomb. 3) Expanding on point 2, bitcoin intentionally made a habit of layering "proven" crypto methods on top of each other. Eg both SHA256 and RIPEMD160 hash functions are used so that if a weakness is found in one hash the other is still ok. So far as I can tell mimblewimble has a single point of failure (elliptic curve cryptography).
- tromp 9y ago
  > Reasons I'm skeptical (perhaps you can address these): 1) Monero may have first mover advantage in the privacy realm, but at the cost of prunability. Grin not only avoids that cost but further improves prunability beyond bitcoin. To me the first mover advantage will always belong to bitcoin, which will likely adopt privacy improving features in the long term. 2+3) Indeed; when evidence appears of quantum computers becoming feasible at breaking EC crypto, current blockchains will need to adopt post-quantum crypto methods of signing transactions, and migrate existing balances. Since EC crypto is more heavily ingrained into Grin, it may have a much harder time than the more modular bitcoin design, or even find it impossible to do so. I'm not aware of any post-quantum equivalent to Pedersen commitments. My hope is that quantum computer development runs into insurmountable barriers...

zooko-at-zcash 9y ago

I really don't like the reliance on the Ceremony to prevent counterfeiting, but it is the only way science has yet discovered for how to enable full-strength (encryption-based) privacy. Fortunately, science continues to advance and I hope we'll be able to upgrade to a trapdoor-free cryptographic proof system someday.