5 ms·
Crypto tribalism aside, you got two technical points fundamentally wrong about the cryptography: 1) snarks are fast now. It takes 3 seconds on a pixel phone for
by ianmiers 6y ago
Crypto tribalism aside, you got two technical points fundamentally wrong about the cryptography:
1) snarks are fast now. It takes 3 seconds on a pixel phone for Zcash.
2)The decoy based approaches Monero uses are subject to all kinds of passive and active attacks. Both in practice ( https://arxiv.org/pdf/1704.04299/ https://arxiv.org/pdf/1704.04299/) and just fundamentally: https://www.youtube.com/watch?v=9s3EbSKDA3o https://www.youtube.com/watch?v=9s3EbSKDA3o. There are ways to mitigate some of these problems to a degree. This is why you hear Monero people talk about coin control and churning (both of which can make you stand out in other ways). But the fact that they have to mention that should tell you its far from a perfect solution cryptographically.
There's a reason projects go with the large anonymity set approach. And if you're a cryptographer at ConsenSys, you should know that: it's what Ethereum is doing with Aztec.
You also should know several projects, including Zcash, are working on trustless setup zk proofs.
(Disclosure: I am involved in Zcash.)
- drenvuk 6y agoThose issues with monero in that paper were already fixed. Years ago. Disclaimer: I wouldn't trust zcash for anything.
- gojomo 6y agoHow much non-default "churning" should a Monero user manually choose for maximum privacy?
- ianmiers 6y agoMost of those attacks, as the paper points out, are fixed. The one that is still relevant is the issues around sampling decoys vs real spends. At the time, with high probability you could assume the most recent tx in the set of decoys was the real source of funds because money is spent frequently. Monero improved their sampling algorithm, but it's still an arms race. The existence of the problem at all, whether or not its reasonably dealt with, should tell you monero isn't cryptographicly strong privacy, its obfuscation. This isn't a Zcash vs Monero thing, people should do their own comparisons. But that has to start with facts.
- Sargos 6y agoYou mentioned Aztec so I'd like to ask you my unanswered question for him below as I'd love to hear the opinion of an expert! What do you think about Aztec (zkRollup L2 for Ethereum)? I tend to get really excited about it as it looks like a private by default system that supports smart contracts (including calling L1 in some cases), inherits Ethereum's security, and is interoperable with DeFi and Ethereum's ecosystem. It sounds fairly perfect for us cypherpunks but I just know there's some blemish that I'm missing. If there's not then it makes me very hopeful for our future.