Quote from: TheFascistMind on September 21, 2014, 03:14:49 PM

Quote from: TheFascistMind on September 21, 2014, 03:08:12 PM

I think I know what the mitigation is for anonymity aspect of the exploit. I will tell you I think it can be fixed going into the future, but we can't restore the anonymity from the past. It is fucked. Meaning if you thought you were anonymous you were not. The NSA can compute the intersections.

The best we could do (if I am correct) is to quickly checkpoint the code and get it out to 51% of the miners so we can prevent BCX's Time Warp attack. But fluffypony says we don't have to do anything rushed and he is at beach any way.

Then we put the mitigation in place so the future anonymity isn't broken.

However my mitigation proposal may still fail in the future when the attacker (NSA?) owns many inputs to many rings on the block chain. I haven't gotten that far in my very rushed analysis. So maybe I can devise a solution (but unlikely because I won't know which inputs the attacker owns) or it doesn't scale well for the attacker (our best hope but I am not optimistic).

So I would say yes ring signatures may be doomed, but I am not sure yet. Maybe not also. I hope not.

If only XMR was affected, there is one of my emotions that would love to see it destroyed. But on rational thought, I don't want to hurt the innocent parties who invested, some of whom are my friends (including but not just Rpietila).

As shown in MRL 0001 I think with a really high base mixin it will be hard, even for an sophisticated attacker, to be able to completely isolate the spender in a ringsig.

http://lab.monero.cc/pubs/MRL-0001.pdf

Smooth also did a while ago some calculations of the cost of such an attack in the Altcoin observer, but I can't currently find the post