4 ms·

I don't see how privacy can ever be solved with blockchain. By design, everything you ever do is permanently out in the open for ever and ever for anyone to no

I don't see how privacy can ever be solved with blockchain. By design, everything you ever do is permanently out in the open for ever and ever for anyone to not only see what you did, but mathematically prove that it was you (well, your key at least) that did it. Sure you can be "anonymous" when using your wallet etc, but as we all know it is usually trivial to de-anonymize large data sets. Likewise, being anonymous when using a wallet then removes a lot of the perceived value of using it for identity verification (e.g. sign-ins, proof of humanity etc).

leashless 4y ago
See https://docs.zksync.io/zkevm/#what-is-zkevm-and-why-is-this-a-big-deal https://docs.zksync.io/zkevm/#what-is-zkevm-and-why-is-this-... Basically you can make transactions anonymous using much the same kind of protection as you have between public and private keys. There is a proof the transaction is valid but that is basically all you can see.
- JofArnold 4y ago
  Sounds like a good idea. Until, like Tornado, the tech gets sanctioned.
  - camgunz 4y ago
    I feel like your downvotes are undeserved. From an engineering perspective, all Tornado did was add anonymity/plausible deniability to the blockchain--which is all that ZK will do. Maybe there's a question as to whether OFEC will also see ZK as money laundering, but my guess is they won't until it gets to a certain scale and then they will--exactly like Tornado. That limit was ~$7 billion, which is < 1 FTX, and far smaller than the current market cap of Ethereum.
  - audunw 4y ago
    Yeah, I feel like cryptocurrencies only have a chance of providing value to some users if it's not actually very succesfull. - If it's successful in providing anonymous transactions to everyone: Regulated to death due to laws aimed at combating money laundering and organized crimes. Even cryptocurrencies that aren't perfectly anonymous will probably eventually be regulated to death for not providing good enough guarantees about the identity of the wallet holders. - If it threatens the Eurodollar as a world reserve currency: regulated to death at least in USA and probably Europe. In what scenario can cryptocurrencies actually achieve its goals without risking being regulated to death? And yes, I know you can't effectively ban all trade of cryptocurrencies. But trade will always be a niche if most people can't use it in the real world.
- qazxcvbnm 4y ago
  I confess I possess only a shallow understanding of ZK rollups - can anyone explain how you can have an opaque proof that transactions are valid and still solve double-spending problems?
  - conradev 4y ago
    This thread might be helpful: https://twitter.com/LuozhuZhang/status/1538171370814570497 https://twitter.com/LuozhuZhang/status/1538171370814570497 Essentially, zkEVMs map EVM bytecode to equivalent zero-knowledge circuits (containing the logic of what is and isn't valid, i.e. double-spending) so that the entire execution can generate a proof. It is a lot of math.
    - qazxcvbnm 4y ago
      Thanks for the link. I've glanced at it, and so far my understanding of it says that the ZK proof allows verification that the results of each individual transaction is exactly as what is given, so that the resultant state provided by the ZK commitment can be trusted. My original confusion was more about how consistency of state can be maintained across completely opaque commitments of transaction validity. Now that I think of it, it seems that my original concern was a matter more trivially dismissed than what you've explained - my doubts were more about how state could possibly be consistently yet opaquely maintained, but the blockchain state machine, and I gather the ZK commitments, are simply not opaque with respect to the VM state - the opaqueness provided by ZK commitments is opaqueness in the intermediate transaction state (essentially irrelevant information - perfect candidate to be optimised away). The problem of double-spending is never relevant within a single chain of block commitments, as any second-spending of resources is simply an invalid transaction and is rejected, given the (necessarily public) hitherto state reached by consensus (- the problem of which, is precisely what the blockchain mechanism was designed to solve). Disclaimer: I have no idea what I'm talking about with respect to ZK, and may be completely wrong.
      - krackers 4y ago
        > more about how consistency of state can be maintained across completely opaque commitments of transaction validity. I have the same confusion as you, and I'm not sure I understood your last paragraph. The prover (person submitting a new transaction) can provide a ZKP that the transaction he is making is valid, and the blockchain will adopt it if indeed it's a valid proof. So then the onus of preventing the double-spend here effectively on the prover: he can only provide a valid ZKP for a valid transaction, and a double-spend would not be a valid transaction. But then at the end of the day, seems like the underlying balance needs to be accessed somehow (otherwise how would the prover even know if he has enough funds avaliable?). I guess the prover (and only the prover) can do this because he presumably has access to the right private keys?
lawn 4y ago
You should look up how Monero and ZCash work.
- bilsbie 4y ago
  Can those be built onto eth?
  - flotzam 4y ago
    Aztec already is: https://zk.money/ https://zk.money/ It's like the Zcash shielded pool, but as an Ethereum L2.
  - lawn 4y ago
    Monero can't for the simple reason that for privacy to work well it needs to be on by default, not opt-in like ZCash does it.
    - rahen 4y ago
      However Monero has shortcomings, the main one being its auditability. Some Monero developers have created a new project which tries to solve those issues, and add zero knowledge proof to the mix: https://pirate.black https://pirate.black
      - lawn 4y ago
        You can audit Moneros math and source code, therefore you can audit the supply. It's more work than with Bitcoin to be sure, but it's still possible. Monero already uses zero knowledge proofs, but in a different way than eg ZCash.
    - Ar-Curunir 4y ago
      The opt-in nature of Zcashs privacy mechanism is not inherent. You can just flip a switch and disallow private transactions.
  - tiluha 4y ago
dopidopHN 4y ago
My bet is that a zero knowledge algorithm is what is hinted at. You can prove that you have the keys to sign. Without having to produce the key. Or something of that effect. Cryptocurrencies are bunker. Zero Knowledge is a big deal.
swalsh 4y ago
A reply you got already mentioned zk functions, which is the best answer (cool tidbit, Avalanche's custom VM allows you to build these functions and anything else you want as precompiled code. More gas efficient.) My second reply would be a hybrid system. I've been tossing around this idea in my head for what I call a decentralized PBM. At first I struggled with the privacy idea. Then I had the realization that it was unnecessary to bring PHI on chain. I could accomplish all the stuff that would benefit from a chain without it. You can realize a lot of value from blockchains even if you're not purely decentralized.
xrd 4y ago
Look at this code: https://docs.zama.ai/concrete/getting-started/quick_start https://docs.zama.ai/concrete/getting-started/quick_start This is a rust based Fully Homomorphic Encryption (FHE) example. That is to say, you can encrypt two numbers, do a mathematical calculation on them without decrypting them, and then, only the person with the private key can decrypt the result to get the value. If you add something like FHE to blockchains (it's coming) then you can get anonymous transactions on the blockchain directly. By the way, Zero knowledge proofs are not what is needed to get anonymous transactions. When you use ZK, you are issuing the proof AND have knowledge of the inputs. The prover needs to know the inputs, but does not need to reveal them to the verifier (which happens on chain). This means the transaction can assert that the mathematical operation occurred without doubt, but when you need to get at the numbers, you are back to a transparent value on the chain.
- cto_of_antifa 4y ago
- DSingularity 4y ago
  Given the high complexity of FHE, surely there be limits to FHE based transactions?
  - xrd 4y ago
    Definitely. And, the founder of Zama says there are new chips which will optimize these types of calculations and make them more mainstream. For the record, no clue how true that assertion is, but seems like now that the calculations are possible, Moore's law will solve that problem one way or another. FHE is going to make things interesting and it seems like it is only a matter of time before they are workable on existing blockchains. Plus, these types of calculations are not susceptible to side-chain attacks, since no private keys are used in the calculations.
    - tsimionescu 4y ago
      FHE computations are hundreds of thousands of times slower than non-encrypted computations, and are non-parallelizable, and Moore's law is long since dead for single-core performance.
kirevmaco 4y ago
There is a solution called DECO: https://invidious.snopyta.org/watch?v=zWTx1iQOCDM https://invidious.snopyta.org/watch?v=zWTx1iQOCDM Backup video link: https://www.youtube.com/watch?v=zWTx1iQOCDM https://www.youtube.com/watch?v=zWTx1iQOCDM Original paper: https://arxiv.org/abs/1909.00938 https://arxiv.org/abs/1909.00938
baby 4y ago
Check zero-knowledge proof based blockchains. They provide ways to build privacy-enhanced applications with smart contracts (called zkapps). I wrote about it a bit here: https://www.cryptologie.net/article/575/whats-the-deal-with-zkapps/ https://www.cryptologie.net/article/575/whats-the-deal-with-...
hanniabu 4y ago
https://github.com/EYBlockchain/nightfall_3 https://github.com/EYBlockchain/nightfall_3

leashless 4y ago

See https://docs.zksync.io/zkevm/#what-is-zkevm-and-why-is-this-a-big-deal https://docs.zksync.io/zkevm/#what-is-zkevm-and-why-is-this-... Basically you can make transactions anonymous using much the same kind of protection as you have between public and private keys. There is a proof the transaction is valid but that is basically all you can see.

JofArnold 4y ago
Sounds like a good idea. Until, like Tornado, the tech gets sanctioned.
- camgunz 4y ago
  I feel like your downvotes are undeserved. From an engineering perspective, all Tornado did was add anonymity/plausible deniability to the blockchain--which is all that ZK will do. Maybe there's a question as to whether OFEC will also see ZK as money laundering, but my guess is they won't until it gets to a certain scale and then they will--exactly like Tornado. That limit was ~$7 billion, which is < 1 FTX, and far smaller than the current market cap of Ethereum.
- audunw 4y ago
  Yeah, I feel like cryptocurrencies only have a chance of providing value to some users if it's not actually very succesfull. - If it's successful in providing anonymous transactions to everyone: Regulated to death due to laws aimed at combating money laundering and organized crimes. Even cryptocurrencies that aren't perfectly anonymous will probably eventually be regulated to death for not providing good enough guarantees about the identity of the wallet holders. - If it threatens the Eurodollar as a world reserve currency: regulated to death at least in USA and probably Europe. In what scenario can cryptocurrencies actually achieve its goals without risking being regulated to death? And yes, I know you can't effectively ban all trade of cryptocurrencies. But trade will always be a niche if most people can't use it in the real world.
qazxcvbnm 4y ago
I confess I possess only a shallow understanding of ZK rollups - can anyone explain how you can have an opaque proof that transactions are valid and still solve double-spending problems?
- conradev 4y ago
  This thread might be helpful: https://twitter.com/LuozhuZhang/status/1538171370814570497 https://twitter.com/LuozhuZhang/status/1538171370814570497 Essentially, zkEVMs map EVM bytecode to equivalent zero-knowledge circuits (containing the logic of what is and isn't valid, i.e. double-spending) so that the entire execution can generate a proof. It is a lot of math.
  - qazxcvbnm 4y ago
    Thanks for the link. I've glanced at it, and so far my understanding of it says that the ZK proof allows verification that the results of each individual transaction is exactly as what is given, so that the resultant state provided by the ZK commitment can be trusted. My original confusion was more about how consistency of state can be maintained across completely opaque commitments of transaction validity. Now that I think of it, it seems that my original concern was a matter more trivially dismissed than what you've explained - my doubts were more about how state could possibly be consistently yet opaquely maintained, but the blockchain state machine, and I gather the ZK commitments, are simply not opaque with respect to the VM state - the opaqueness provided by ZK commitments is opaqueness in the intermediate transaction state (essentially irrelevant information - perfect candidate to be optimised away). The problem of double-spending is never relevant within a single chain of block commitments, as any second-spending of resources is simply an invalid transaction and is rejected, given the (necessarily public) hitherto state reached by consensus (- the problem of which, is precisely what the blockchain mechanism was designed to solve). Disclaimer: I have no idea what I'm talking about with respect to ZK, and may be completely wrong.
    - krackers 4y ago
      > more about how consistency of state can be maintained across completely opaque commitments of transaction validity. I have the same confusion as you, and I'm not sure I understood your last paragraph. The prover (person submitting a new transaction) can provide a ZKP that the transaction he is making is valid, and the blockchain will adopt it if indeed it's a valid proof. So then the onus of preventing the double-spend here effectively on the prover: he can only provide a valid ZKP for a valid transaction, and a double-spend would not be a valid transaction. But then at the end of the day, seems like the underlying balance needs to be accessed somehow (otherwise how would the prover even know if he has enough funds avaliable?). I guess the prover (and only the prover) can do this because he presumably has access to the right private keys?

lawn 4y ago

You should look up how Monero and ZCash work.

bilsbie 4y ago
Can those be built onto eth?
- flotzam 4y ago
  Aztec already is: https://zk.money/ https://zk.money/ It's like the Zcash shielded pool, but as an Ethereum L2.
- lawn 4y ago
  Monero can't for the simple reason that for privacy to work well it needs to be on by default, not opt-in like ZCash does it.
  - rahen 4y ago
    However Monero has shortcomings, the main one being its auditability. Some Monero developers have created a new project which tries to solve those issues, and add zero knowledge proof to the mix: https://pirate.black https://pirate.black
    - lawn 4y ago
      You can audit Moneros math and source code, therefore you can audit the supply. It's more work than with Bitcoin to be sure, but it's still possible. Monero already uses zero knowledge proofs, but in a different way than eg ZCash.
  - Ar-Curunir 4y ago
    The opt-in nature of Zcashs privacy mechanism is not inherent. You can just flip a switch and disallow private transactions.
- tiluha 4y ago

dopidopHN 4y ago

My bet is that a zero knowledge algorithm is what is hinted at. You can prove that you have the keys to sign. Without having to produce the key. Or something of that effect. Cryptocurrencies are bunker. Zero Knowledge is a big deal.

swalsh 4y ago

A reply you got already mentioned zk functions, which is the best answer (cool tidbit, Avalanche's custom VM allows you to build these functions and anything else you want as precompiled code. More gas efficient.) My second reply would be a hybrid system. I've been tossing around this idea in my head for what I call a decentralized PBM. At first I struggled with the privacy idea. Then I had the realization that it was unnecessary to bring PHI on chain. I could accomplish all the stuff that would benefit from a chain without it. You can realize a lot of value from blockchains even if you're not purely decentralized.

xrd 4y ago

Look at this code: https://docs.zama.ai/concrete/getting-started/quick_start https://docs.zama.ai/concrete/getting-started/quick_start This is a rust based Fully Homomorphic Encryption (FHE) example. That is to say, you can encrypt two numbers, do a mathematical calculation on them without decrypting them, and then, only the person with the private key can decrypt the result to get the value. If you add something like FHE to blockchains (it's coming) then you can get anonymous transactions on the blockchain directly. By the way, Zero knowledge proofs are not what is needed to get anonymous transactions. When you use ZK, you are issuing the proof AND have knowledge of the inputs. The prover needs to know the inputs, but does not need to reveal them to the verifier (which happens on chain). This means the transaction can assert that the mathematical operation occurred without doubt, but when you need to get at the numbers, you are back to a transparent value on the chain.

cto_of_antifa 4y ago
DSingularity 4y ago
Given the high complexity of FHE, surely there be limits to FHE based transactions?
- xrd 4y ago
  Definitely. And, the founder of Zama says there are new chips which will optimize these types of calculations and make them more mainstream. For the record, no clue how true that assertion is, but seems like now that the calculations are possible, Moore's law will solve that problem one way or another. FHE is going to make things interesting and it seems like it is only a matter of time before they are workable on existing blockchains. Plus, these types of calculations are not susceptible to side-chain attacks, since no private keys are used in the calculations.
  - tsimionescu 4y ago
    FHE computations are hundreds of thousands of times slower than non-encrypted computations, and are non-parallelizable, and Moore's law is long since dead for single-core performance.

kirevmaco 4y ago

There is a solution called DECO: https://invidious.snopyta.org/watch?v=zWTx1iQOCDM https://invidious.snopyta.org/watch?v=zWTx1iQOCDM Backup video link: https://www.youtube.com/watch?v=zWTx1iQOCDM https://www.youtube.com/watch?v=zWTx1iQOCDM Original paper: https://arxiv.org/abs/1909.00938 https://arxiv.org/abs/1909.00938

baby 4y ago

Check zero-knowledge proof based blockchains. They provide ways to build privacy-enhanced applications with smart contracts (called zkapps). I wrote about it a bit here: https://www.cryptologie.net/article/575/whats-the-deal-with-zkapps/ https://www.cryptologie.net/article/575/whats-the-deal-with-...

hanniabu 4y ago

https://github.com/EYBlockchain/nightfall_3 https://github.com/EYBlockchain/nightfall_3