Quote from: TPTB_need_war on June 13, 2015, 08:53:14 PM

Quote from: fluffypony on June 13, 2015, 08:22:41 PM

Quote from: TPTB_need_war on June 13, 2015, 07:15:28 PM

If the actual input to a transaction (in Monero terminology this is the output of the prior transaction) is not also an input to another transaction's ring signature (and when all the other inputs to the ring are spent) or if it is also the input to a subsequent ring in which all the other inputs were outputs created after the said transaction was created, then the anonymity of the said transaction is entirely unmasked.

This is really what MRL-0004 deals with (the section on Temporal Association attacks).

A lot of this changes with the recommendations MRL4 made, which will come in a hard fork later this year (once we've established a forking strategy, per this forum post).

I don't check this thread, so if you reply and don't hear back from me in a couple of days just send me a PM nudging me:)

The MRL4 imperfect heuristic mitigations notwithstanding, the only absolute solution is to require that sets of outputs be mixed with and only with each other (and the number of inputs per ring must be constant). This also enables pruning the Cryptonote block chain. There I have just given away one of my prior design "secrets" (that I no longer need to keep secret because I stumbled onto a consensus network design which no longer needs pruning and is transaction technology agnostic). Perhaps others already suggested this?

P.S. for those who have already spent their coins to a third party, your hard fork will come too late. Hope you can make necessary improvements sooner.

The following should have been implied, but let me make it more explicit, which may also resolve the issue with exchanges and getting this fix into Monero asap (although I have not studied that issue, only heard about it second hand).

The only sane way my above suggestion can be implemented is that outputs eligible for fixed size mixins must be marked as such by the transaction that created them, otherwise if the fixed size (and outputs) mixins were global then there is no way to merge the leftover change from several transactions into one transaction. I believe BoolBerry had a conceptually similar mechanism to mark outputs with some specific attribute for mixing. So the marked outputs must be mixed with and only with the "next N outputs of same denomination on the block chain" when they are spent.

Thus when you want to mix your outputs with assurance against unmasking due to Combinatorial Cascade and Temporal Association, then you mark the output for fixed size mixing.

In my opinion, this is an emergency fix because afaics the anonymity is broken as it is now, but I can't say that I've done any deep analysis on how likely the unmasking is on existing patterns in the Monero block chain.

Hope this helps, displays my gratitude to those who rewarded me for my effort during the BCX incident, and most importantly hope Monero can implement it asap because I would like to make my best attempt to create a use case gift to XMR HODLers soon and this fix may be required. Perhaps someone else had already suggested this idea, I don't know.

The pruning comes from the fact that if the mixes are fixed size then after N transactions of the same ring have been seen, those outputs (that are inputs to those N rings) can be pruned from the UXTO.