Quote from: Melbustus on April 02, 2015, 05:48:26 PM

Quote from: Anon136 on April 02, 2015, 04:11:01 PM

the government should be freaking out about the potential implications of this tech. but they aren't. at all. not even a wiff of it. firmly in the ignore stage.

Well, there *is* a "whiff" of it, so to speak. During the Jan 2013 NYDFS BitLicense exploratory panels, Lawsky made some comment to the effect of: "...maybe we need to require that all virtual currencies use a transparent ledger" (paraphrasing). Remember, Zerocash has been on the radar for a while.

In any event, I think Bitcoin kind-of luck-boxed into being something that govs can accept. There's some quote from Satoshi where he basically outlines something akin to ring-signatures as a desirable design, but didn't have an implementation for it. If he had, and Bitcoin had been launched with native robust privacy, I fear it's path would've been *much* more difficult. As is, I think it's path is workable and probably leads to much higher market cap. Some people around here seem to underestimate the degree to which truly aggressive widespread multi-government legal action would curtail adoption and value.

So I think Bitcoin kinda stumbled into this (from a practical perspective) best of both worlds scenario, where it *can* afford reasonable privacy via various techniques, yet is palatable to govs because it *is* an open ledger.

That said, I think the native-privacy niche is the big one to be filled by an alt, and Monero has a nice shot at eating the market-caps of many of the other top-10 coins.

Relevant:

Quote from: satoshi on August 13, 2010, 07:28:47 PM

I'm not grasping your idea yet. Does it hide any information from the public network? What is the advantage?

If at least 50% of nodes validated transactions enough that old transactions can be discarded, then everyone saw everything and could keep a record of it.

Can public nodes see the values of transactions? Can they see which previous transaction the value came from? If they can, then they know everything. If they can't, then they couldn't verify that the value came from a valid source, so you couldn't take their generated chain as verification of it.

Does it hide the bitcoin addresses? Is that it? OK, maybe now I see, if that's it.

Crypto may offer a way to do "key blinding". I did some research and it was obscure, but there may be something there. "group signatures" may be related.

There's something here in the general area:
http://www.users.zetnet.co.uk/hopwood/crypto/rh/

What we need is a way to generate additional blinded variations of a public key. The blinded variations would have the same properties as the root public key, such that the private key could generate a signature for any one of them. Others could not tell if a blinded key is related to the root key, or other blinded keys from the same root key. These are the properties of blinding. Blinding, in a nutshell, is x = (x * large_random_int) mod m.

When paying to a bitcoin address, you would generate a new blinded key for each use.

Then you need to be able to sign a signature such that you can't tell that two signatures came from the same private key. I'm not sure if always signing a different blinded public key would already give you this property. If not, I think that's where group signatures comes in. With group signatures, it is possible for something to be signed but not know who signed it.

As an example, say some unpopular military attack has to be ordered, but nobody wants to go down in history as the one who ordered it. If 10 leaders have private keys, one of them could sign the order and you wouldn't know who did it.

Quote from: satoshi on August 11, 2010, 12:14:22 AM

This is a very interesting topic. If a solution was found, a much better, easier, more convenient implementation of Bitcoin would be possible.

Originally, a coin can be just a chain of signatures. With a timestamp service, the old ones could be dropped eventually before there's too much backtrace fan-out, or coins could be kept individually or in denominations. It's the need to check for the absence of double-spends that requires global knowledge of all transactions.

The challenge is, how do you prove that no other spends exist? It seems a node must know about all transactions to be able to verify that. If it only knows the hash of the in/outpoints, it can't check the signatures to see if an outpoint has been spent before. Do you have any ideas on this?

It's hard to think of how to apply zero-knowledge-proofs in this case.

We're trying to prove the absence of something, which seems to require knowing about all and checking that the something isn't included.

Btw, did you know that Monero can also be transperant optionally and/or on-demand?

PS: There is another post from satoshi where he is speaking about ring-signatures, but unfortunately I can't find it now. If I recall correctly, another Monero supporter has that quote in his sig, but can't remember exactly who it was.