Quote from: TierNolan on February 21, 2016, 06:04:29 PM

Quote from: TPTB_need_war on February 21, 2016, 05:44:36 PM

I don't understand the mechanism. Please explain how the protocol accomplishes the goal.

This just looks at half of the cut and choose system.

Bob picks 1000 key pairs and sends Alice hash(1000 public keys)

Bob also spends 10 cents in fees, which he loses if he cheats.

Alice picks a number from 1 to 1000 and select one of the key pairs.

Bob then sends Alice the 1000 public keys and 999 of the private keys.

Alice checks that the public keys hashes to hash(1000 public keys) from before. She also checks that the 999 private keys match the public keys.

She doesn't know if private key N actually hashes to public key N, but she assumes it does.

There is no point in Bob lying about the 1000 public keys, since he will have to show them.

If he does lie about the private keys, there is no point in having more than 1 false private key. If he has 2 or more private keys that don't match, then he is guaranteed to be caught.

So, Bob has two choices

- He can honestly create the 1000 key pairs

In that case the protocol works as required.

- He can have one of the private keys not match the public key

In this case, there is a 99.9% chance of being caught. He loses any fee he has committed.

There is a 0.1% chance he will get away with it. At best, this means that he gets all the money (other than the deposit, since there is no hold-up risk there).

This gives an expected payout of (value of the trade) * 0.001 - fee * 0.999. If the trade is less than 990 times larger than the fee, then the expected value of cheating is negative.

Increasing the size of the fee would help.

The key for the cut and choose to work is that Bob must commit to 1000 pairs(pay the fee) before Alice tells him her choice.

But afaics this doesn't bind Bob to release or sign with the one private key which was not revealed. So it seems the cut and choose adds nothing that just asking Bob for a single public key for the 2 of 2 multi-sig would accomplish or what am I missing Huh

Also fees don't work, because the attacker can run a DE as I explained upthread.

Afaics the generative essence is inviolable. Both parties must provide a reference point at the start of a protocol by having both parties sign their hash (or public key for 2 of 2 multi-sig) as I suggested upthread.