4 ms·

One possible application of this that NIST didn't discuss is mentioned in a new paper on accountable Bitcoin mixes: http://eprint.iacr.org/2014/077.pdf http://e

One possible application of this that NIST didn't discuss is mentioned in a new paper on accountable Bitcoin mixes: http://eprint.iacr.org/2014/077.pdf http://eprint.iacr.org/2014/077.pdf They use signed contracts combined with a novel mixing fee mechanism based on public randomness to ensure honest behavior by rational Bitcoin mixes. If you're interested in Bitcoin the full paper is worth a read.

TempleOSV2 13y ago
Fucken nigger.
dfc 13y ago
That does not fall under the Secure Multiparty Computation category?[^1] Or are you upset that they did not mention bitcoin mixes explicitly? [^1]: http://www.nist.gov/itl/csd/ct/beacon-secure-multi-party-computation.cfm http://www.nist.gov/itl/csd/ct/beacon-secure-multi-party-com...
randomwalker 13y ago
I'm one of the authors. It's interesting that you cite our paper as an application of the NIST beacon. Perhaps a better reason to cite our paper is that we actually design a beacon using the Bitcoin blockchain itself (Section 4.4), because the NIST beacon has many problems.
- dfc 13y ago
  Besides trusting NIST what are the other problem[s]?
  - randomwalker 13y ago
    The other major one is reliability (but that is encompassed by sufficiently broad interpretations of "trusting NIST.") Also, for our specific application it's not clear how to assign precise timestamps to Bitcoin blocks that everyone can agree on; this is necessary to be able to use a beacon that is external to the block chain.
    - dfc 13y ago
      Thanks for responding. I never thought about bitcoin+time problems. Are there any efforts/research into how to address the bitcoin+timestamp problem?
- swordswinger12 13y ago
  Ahhh, I forgot about that part of the paper. I read it a few weeks ago, my apologies :)
EthanHeilman 13y ago
NIST random beacons can also be used to defend against selfish mining https://eprint.iacr.org/2014/007 https://eprint.iacr.org/2014/007 Selfish mining requires strategically withholding blocks, the NIST random beacon gives you unforgeable timestamps, thus during block races you can prefer blocks that have newer unforgeable timestamps. Those older withheld blocks will lose blockraces punishing selfish miners.
- nullc 13y ago
  > you unforgeable timestamps, Unforgeable except by anyone who's able to order or trick NIST into doing something. If NIST is unimpeachable, why not just have them run the anti-double-spending database and dispense with this inefficient blockchain stuff? :) > prefer blocks that that have newer unforgeable timestamps This general class of solutions often runs into problems with creating incentives for large miners to continue to mine at your current height and ignore a third party block, because you know you'll beat it in a race even though you announced late.
  - EthanHeilman 13y ago
    >If NIST is unimpeachable, why not just have them run the anti-double-spending database and dispense with this inefficient blockchain stuff? :) Because even if NIST helps someone cheat, the cheaters only get a minor advantage and NIST runs a huge risk. Having an additional security measure which doesn't endanger the entire system if it is broken is not that same as trusting NIST. Furthermore you can also compose the NIST beacon with other random beacons so that they would all have to collude for any party to cheat. Imagine tomorrow, we find out a small (<33%) pool is selfish mining, what is a fix we can roll out in a few hours that will stop them while we examine longer term solutions (a long term solution might be asking every pool above 33% to provide a beacon and then having miners compose these beacons). >This general class of solutions often runs into problems with creating incentives for large miners to continue to mine at your current height and ignore a third party block, because you know you'll beat it in a race even though you announced late. Yes, we run into these problems at 33% of mining power. That being said, a 33% attack is better than the 0.5% attack.

TempleOSV2 13y ago

Fucken nigger.

dfc 13y ago

That does not fall under the Secure Multiparty Computation category?[^1] Or are you upset that they did not mention bitcoin mixes explicitly? [^1]: http://www.nist.gov/itl/csd/ct/beacon-secure-multi-party-computation.cfm http://www.nist.gov/itl/csd/ct/beacon-secure-multi-party-com...

randomwalker 13y ago

I'm one of the authors. It's interesting that you cite our paper as an application of the NIST beacon. Perhaps a better reason to cite our paper is that we actually design a beacon using the Bitcoin blockchain itself (Section 4.4), because the NIST beacon has many problems.

dfc 13y ago
Besides trusting NIST what are the other problem[s]?
- randomwalker 13y ago
  The other major one is reliability (but that is encompassed by sufficiently broad interpretations of "trusting NIST.") Also, for our specific application it's not clear how to assign precise timestamps to Bitcoin blocks that everyone can agree on; this is necessary to be able to use a beacon that is external to the block chain.
  - dfc 13y ago
    Thanks for responding. I never thought about bitcoin+time problems. Are there any efforts/research into how to address the bitcoin+timestamp problem?
swordswinger12 13y ago
Ahhh, I forgot about that part of the paper. I read it a few weeks ago, my apologies :)

EthanHeilman 13y ago

NIST random beacons can also be used to defend against selfish mining https://eprint.iacr.org/2014/007 https://eprint.iacr.org/2014/007 Selfish mining requires strategically withholding blocks, the NIST random beacon gives you unforgeable timestamps, thus during block races you can prefer blocks that have newer unforgeable timestamps. Those older withheld blocks will lose blockraces punishing selfish miners.

nullc 13y ago
> you unforgeable timestamps, Unforgeable except by anyone who's able to order or trick NIST into doing something. If NIST is unimpeachable, why not just have them run the anti-double-spending database and dispense with this inefficient blockchain stuff? :) > prefer blocks that that have newer unforgeable timestamps This general class of solutions often runs into problems with creating incentives for large miners to continue to mine at your current height and ignore a third party block, because you know you'll beat it in a race even though you announced late.
- EthanHeilman 13y ago
  >If NIST is unimpeachable, why not just have them run the anti-double-spending database and dispense with this inefficient blockchain stuff? :) Because even if NIST helps someone cheat, the cheaters only get a minor advantage and NIST runs a huge risk. Having an additional security measure which doesn't endanger the entire system if it is broken is not that same as trusting NIST. Furthermore you can also compose the NIST beacon with other random beacons so that they would all have to collude for any party to cheat. Imagine tomorrow, we find out a small (<33%) pool is selfish mining, what is a fix we can roll out in a few hours that will stop them while we examine longer term solutions (a long term solution might be asking every pool above 33% to provide a beacon and then having miners compose these beacons). >This general class of solutions often runs into problems with creating incentives for large miners to continue to mine at your current height and ignore a third party block, because you know you'll beat it in a race even though you announced late. Yes, we run into these problems at 33% of mining power. That being said, a 33% attack is better than the 0.5% attack.