Quote from: bitcoiner422 on April 04, 2015, 10:49:54 AM

My impression of ring signatures is that only a limited number of people can participate in each ring signature

That is kinda correct. The more other outputs you select to mix with increases the tx size, which increases the fee you have to pay for this tx to get mined. There is also an instantaneous block size limit, which prevents "too large" transactions from being included, but that limit grows as usage grows.

There is a paper that can sign in O(N^1/2) I believe, which is being looked at by the Monero labs people (and maybe other CN coins). If this was to be found usable, you could then have huge mixins for a much more reasonable fee. There's also a proposal from... adam3us I think ? offering a linear size reduction (at the cost of a slightly larger constant IIRC).

For CN coins, the ring signature is made for a denomination, by the way, so this process is repeated for each denomination.

Quote from: bitcoiner422 on April 04, 2015, 10:49:54 AM

(I'm not sure of how it is arranged which ones participate). For example, in one instance when I tried only 10 could participate, so the probability is 1/10 that a member of the ring did the transaction, which is far less anonymous than the theoretical 1/N, where N=all users of the coin.

Choice is (theoretically) arbitrary. I believe it's currently a uniform distribution, but it could be anything. You could even select whatever outputs you like in the blockchain AIUI.

Quote from: bitcoiner422 on April 04, 2015, 10:49:54 AM

Also, I'm not sure to what extent one can analyze standard denominations and sums of them etc with Cryptonote coins. One problem is that some transaction sizes (small or large) might be less common than others, reducing anonymity. Is the transaction size hidden in a ring signature?

There are attacks. See https://lab.getmonero.org/ and in particular the 1 and 4, and the proposed changes in 4 to mitigate and prevent some.

Quote from: bitcoiner422 on April 04, 2015, 10:49:54 AM

Also, when ring signatures includes old transactions, can this be arbitrarily far back in time?

As far back as the first tx that includes an output of the size you need. Which is pretty much near the start of the chain, unless you happen to want a denomination that's 10% of the supply or so