3 ms·

Mimblewimble doesn't provide very strong privacy protections. Indeed, to a first approximation all it hides is transaction value. The aggregatable transactions

Mimblewimble doesn't provide very strong privacy protections. Indeed, to a first approximation all it hides is transaction value. The aggregatable transactions only provide privacy if you assume they are generated, fully formed from nothing. Which isn't true. If they are passed around the network and things are aggregated in, than anyone observing the networking will see exactly what went in and what didn't. IF you pass them to a trusted party, well then you have a centralized party you trust for privacy.

tromp 9y ago
It's true that an entity like NSA would notice transactions at their point of origin, before aggregation, and could relate inputs to outputs. Reducing this linkability doesn't require a trusted party though, as MimbleWimble is compatible with the valueshuffle [0] protocol. [0] https://people.mmci.uni-saarland.de/~truffing/papers/valueshuffle.pdf https://people.mmci.uni-saarland.de/~truffing/papers/valuesh...
- ianmiers 9y ago
  You have a choice: use a trusted party (obviously bad) or pass around partial aggregates and have someone add on to them ( this is the standard proposal). Problem is, you can trivially attach to almost every full node and observe those transactions as they get broadcast around. Its not NSA level attacks, I know at least 2 blockchain analysis companies that do this in Bitcoin today. So, against that attacker, which already exists and is live today, mimblewimble seeming provides almost no privacy.
  - igno_peverell 9y ago
    Everything in a MimbleWimble chain, and even at the transaction broadcast level, look like sorted sets of uniformly random curve points. There are no amounts as you point out, but there are no addresses either. So now, tell me what that "attack" gives you?
    - ianmiers 9y ago
      If Alice gives you a coin and then you spend it to Bob, what stops Alice and Bob from identifying that they delt with the same person? This isn't an issue of addresses or values, but the transaction graph. The only thing that hides that in mimblewimble is aggregate transactions. But again, they don't hide it if you see them assembled. To such an attacker , the transaction graph is entirely intact.
      - tromp 9y ago
        The transaction graph (apart from private aggregation) is intact to an attacker who has seen all transactions being broadcast, but can then only relate outputs that they themselves have been involved in (like Alice and Bob in your example) to real world identities. This is the great advantage of having no addresses.

tromp 9y ago

It's true that an entity like NSA would notice transactions at their point of origin, before aggregation, and could relate inputs to outputs. Reducing this linkability doesn't require a trusted party though, as MimbleWimble is compatible with the valueshuffle [0] protocol. [0] https://people.mmci.uni-saarland.de/~truffing/papers/valueshuffle.pdf https://people.mmci.uni-saarland.de/~truffing/papers/valuesh...

ianmiers 9y ago
You have a choice: use a trusted party (obviously bad) or pass around partial aggregates and have someone add on to them ( this is the standard proposal). Problem is, you can trivially attach to almost every full node and observe those transactions as they get broadcast around. Its not NSA level attacks, I know at least 2 blockchain analysis companies that do this in Bitcoin today. So, against that attacker, which already exists and is live today, mimblewimble seeming provides almost no privacy.
- igno_peverell 9y ago
  Everything in a MimbleWimble chain, and even at the transaction broadcast level, look like sorted sets of uniformly random curve points. There are no amounts as you point out, but there are no addresses either. So now, tell me what that "attack" gives you?
  - ianmiers 9y ago
    If Alice gives you a coin and then you spend it to Bob, what stops Alice and Bob from identifying that they delt with the same person? This isn't an issue of addresses or values, but the transaction graph. The only thing that hides that in mimblewimble is aggregate transactions. But again, they don't hide it if you see them assembled. To such an attacker , the transaction graph is entirely intact.
    - tromp 9y ago
      The transaction graph (apart from private aggregation) is intact to an attacker who has seen all transactions being broadcast, but can then only relate outputs that they themselves have been involved in (like Alice and Bob in your example) to real world identities. This is the great advantage of having no addresses.