Re: Gold collapsing. Bitcoin UP.

There may be bug (or luck to find some number) and then creating bitcoins out of nothing. And nobody can verify.

That is the risk - the scheme relies on the security of ECDSA to protect the currency supply.

We're already relying on ECDSA to protect our balances from overt theft, so I'm not sure how much it actually changes the security model to also rely on it to protect our balances from covert theft via counterfeiting.

The reason I'm interested in amount blinding is that my current project is working out a multi-step plan to kill graph analysis. With the right plan and without blinded amounts we can kill graph analysis, but with blinded amounts we can drive a stake through its heart to make sure it stays dead.

We are also using SHA-256 and RIPEMD-160 hashes to protect our balances. So even ECDSA is broken our balances can be safe and then ECDSA replaced.

Actually, the best path to a safe balance is not having a public balance at all.

http://i.imgur.com/fUVBvXK.png

http://i.imgur.com/FY7q54I.png

http://i.imgur.com/MUOwbae.png

One of the problems with making the amounts public in Cryptonote is that it makes transactions and wallets more complex (and consume more bandwidth) because mixing is done on equal denominations (of a power-of-10 in Monero case).

The value hiding protocols also require smallness and non-negativity proofs on the transaction outputs in order to restrain the printing of money out-of-thin-air, and these might have vulnerabilities in addition to the hardness of the discrete logarithm assumption of ECDSA. Today I introduced an idea for eliminating those extra assumptions at the cost of revealing the relative values but not the magnitudes.