4 ms·

When you compared ZCash and MimbleWimble, you forgot to mention that the latter doesn't need a trusted setup like the former needed.

by knocte 8y ago

josh2600 8y ago
The trusted setup is the major problem with Zcash, but it’s much more private than MW (assuming you believe the setup). I’m not gonna spend a lot of time arguing on here, but I think it’s worth closely studying these systems as they’re fascinating. All anonymity focused systems have tradeoffs, just like more commonly understood distributed systems.
- rdl 8y ago
  The big privacy concern I see with MW is the exchange of blinding factor, and there are some arbitrarily good solutions to that if you make other tradeoffs. With ZCash I'm willing to trust the trusted setup (even if it was imperfect); the issue is that people don't actually use shielded addresses/privacy protecting transactions much.
  - josh2600 8y ago
    Zksnarks is an incredible pile of research. It’s actually stunning. Out of band blinding factor transfer is interesting, also relay/mix nets are interesting. I think it’s all a super cool area that’s worth studying closely.
  - tromp 8y ago
    There is no need for exchange of blinding factors. The mailing list message https://lists.launchpad.net/mimblewimble/msg00091.html https://lists.launchpad.net/mimblewimble/msg00091.html explains how any possible multi-party transaction can be done safely without exchanging blinding factors.
  - ianmiers 8y ago
    The biggest privacy issue with grin is it doesn't hide the transaction graph. See their own write up[0] which offers a very good and nuanced privacy discussion. This means, for example, you can be tracked by colluding vendors. Or can be identified when trying to accept payments anonymously. I don't think blinding factors are as much of an issue. Zcash setup doesn't matter for privacy. The larger issue is as you said, adoption of private transactions. [0]https://github.com/mimblewimble/docs/wiki/Grin-Privacy-Primer https://github.com/mimblewimble/docs/wiki/Grin-Privacy-Prime...
    - xkarga00 8y ago
      RSA accumulators is an active area of research that will help with unlinking inputs and outputs, see the grin forum thread for more discussion: https://www.grin-forum.org/t/benedikt-bunzs-utxo-commitments-rsa-accumulators/1045 https://www.grin-forum.org/t/benedikt-bunzs-utxo-commitments...
      - ianmiers 8y ago
        It really doesn't help with that unless you use a completely different protocol and assume trusted setup. At which point, just use zcash, it will have smaller and faster to verify transactions. Trust me, I've been working with RSA accumulators for privacy in Bitcoin since 2011.
        rdl 8y ago
        Ah, I didn't see how the blinding factor was being used (the code is actually easier to understand than the paper). This has approximately the same linkability as monero, inferior to zcash (complex) or chaumian tokens (hyper-efficient, but centralized per-currency, although currencies can be permissionless).
    - rdl 8y ago
      Why can’t you just do self to self transactions before/after each external transaction, and split/aggregate to standardized values (to start, let’s assume the entire system only allows payments of exactly 100 units each).
- Ar-Curunir 8y ago
  Privacy of Zcash doesn't depend on the setup, only the soundness (preventing people from creating money out of thin air)
  - josh2600 8y ago
    Privacy of zcash depends entirely on the setup. Please reread the paper.
    - Ar-Curunir 8y ago
      I work with SNARKs on a regular basis. Soundness depends on the setup; zero-knowledge is unconditional.
- hanniabu 8y ago
  What's the trusted setup with zcash?
  - garmaine 8y ago
    A group of people came up with the initial parameters (some random numbers). If they kept these numbers, they’d be able to anonymously, silently print unlimited amounts of zcash coins, and no one would know.
    - hanniabu 8y ago
      Interesting, are you aware if there's research on a trustless way to create a trusted setup? Basically a way to generate these random number without others knowing and to prove they no longer exist?
kim0 8y ago
Monero doesn't need a trusted setup as well!

When you compared ZCash and MimbleWimble, you forgot to mention that the latter doesn't need a trusted setup like the former needed.

by knocte 8y ago

When you compared ZCash and MimbleWimble, you forgot to mention that the latter doesn't need a trusted setup like the former needed.

josh2600 8y ago

The trusted setup is the major problem with Zcash, but it’s much more private than MW (assuming you believe the setup). I’m not gonna spend a lot of time arguing on here, but I think it’s worth closely studying these systems as they’re fascinating. All anonymity focused systems have tradeoffs, just like more commonly understood distributed systems.

rdl 8y ago
The big privacy concern I see with MW is the exchange of blinding factor, and there are some arbitrarily good solutions to that if you make other tradeoffs. With ZCash I'm willing to trust the trusted setup (even if it was imperfect); the issue is that people don't actually use shielded addresses/privacy protecting transactions much.
- josh2600 8y ago
  Zksnarks is an incredible pile of research. It’s actually stunning. Out of band blinding factor transfer is interesting, also relay/mix nets are interesting. I think it’s all a super cool area that’s worth studying closely.
- tromp 8y ago
  There is no need for exchange of blinding factors. The mailing list message https://lists.launchpad.net/mimblewimble/msg00091.html https://lists.launchpad.net/mimblewimble/msg00091.html explains how any possible multi-party transaction can be done safely without exchanging blinding factors.
- ianmiers 8y ago
  The biggest privacy issue with grin is it doesn't hide the transaction graph. See their own write up[0] which offers a very good and nuanced privacy discussion. This means, for example, you can be tracked by colluding vendors. Or can be identified when trying to accept payments anonymously. I don't think blinding factors are as much of an issue. Zcash setup doesn't matter for privacy. The larger issue is as you said, adoption of private transactions. [0]https://github.com/mimblewimble/docs/wiki/Grin-Privacy-Primer https://github.com/mimblewimble/docs/wiki/Grin-Privacy-Prime...
  - xkarga00 8y ago
    RSA accumulators is an active area of research that will help with unlinking inputs and outputs, see the grin forum thread for more discussion: https://www.grin-forum.org/t/benedikt-bunzs-utxo-commitments-rsa-accumulators/1045 https://www.grin-forum.org/t/benedikt-bunzs-utxo-commitments...
    - ianmiers 8y ago
      It really doesn't help with that unless you use a completely different protocol and assume trusted setup. At which point, just use zcash, it will have smaller and faster to verify transactions. Trust me, I've been working with RSA accumulators for privacy in Bitcoin since 2011.
      - rdl 8y ago
        Ah, I didn't see how the blinding factor was being used (the code is actually easier to understand than the paper). This has approximately the same linkability as monero, inferior to zcash (complex) or chaumian tokens (hyper-efficient, but centralized per-currency, although currencies can be permissionless).
  - rdl 8y ago
    Why can’t you just do self to self transactions before/after each external transaction, and split/aggregate to standardized values (to start, let’s assume the entire system only allows payments of exactly 100 units each).
Ar-Curunir 8y ago
Privacy of Zcash doesn't depend on the setup, only the soundness (preventing people from creating money out of thin air)
- josh2600 8y ago
  Privacy of zcash depends entirely on the setup. Please reread the paper.
  - Ar-Curunir 8y ago
    I work with SNARKs on a regular basis. Soundness depends on the setup; zero-knowledge is unconditional.
hanniabu 8y ago
What's the trusted setup with zcash?
- garmaine 8y ago
  A group of people came up with the initial parameters (some random numbers). If they kept these numbers, they’d be able to anonymously, silently print unlimited amounts of zcash coins, and no one would know.
  - hanniabu 8y ago
    Interesting, are you aware if there's research on a trustless way to create a trusted setup? Basically a way to generate these random number without others knowing and to prove they no longer exist?

kim0 8y ago

Monero doesn't need a trusted setup as well!