Quote from: fluffypony on September 24, 2014, 02:24:03 PM

Quote from: TheFascistMind on September 24, 2014, 09:21:07 AM

My response:

https://bitcointalk.org/index.php?topic=789978.msg8942201#msg8942201

You'll excuse the curt reply, but I'm just going to infodump from IRC, as we're quite tight on time -

[15:48:52] sarang: I can't prove a negative [15:48:54] sarang: that's the trouble [15:49:05] sarang: I can't say "there is no way to use three equations like that to recover x, here's proof" [15:49:11] sarang: I can only say "there are no known ways to do so" [15:49:36] sarang: The onus is on him. Unfortunately, if the world wants us to counter it with Magic Negative Proof, then they'll be disappointed [15:50:37] sarang: But, let me review out loud [15:50:45] sarang: We know I=xH(P) is one equation [15:51:36] sarang: We know r=q-cx is another [15:51:50] sarang: and we know x=H(aR)+b is a third

That is not what I sent to smooth in private. I said the attacker could have sent the coins to recipient thus attacker would know P = xG = H(rA)+B, since the public key is (A,B) and sender of the tx chooses r.

https://cryptonote.org/whitepaper.pdf#page=7

Quote from: fluffypony on September 24, 2014, 02:24:03 PM

[15:52:00] sarang: You have, indeed, three equations for x [15:52:19] sarang: How many unknowns is important here (though the security of ECDLP is important too) [15:53:25] sarang: Unknowns are x itself, q, c, a, b, and technically r since it's indexed

They forgot that using my proposed de-anonymization algorithm i == s can be known, thus c is known.

So we have 2 unknowns x and q and 3 equations.

Quote from: fluffypony on September 24, 2014, 02:24:03 PM

[15:53:40] sarang: Given three equations and six unknowns, he can go right back to the drawing board

Duh! Did they really assume I am that stupid. Hubris is the source of many failures.

Quote from: fluffypony on September 24, 2014, 02:24:03 PM

[15:56:43] sarang: So my answer to him would be that the private key is obscured in all cases by either the ECDLP or random affine goodness [15:57:06] sarang: and that the three equations means that you STILL have three extra degrees of freedom [15:57:41] sarang: and the degrees of freedom are carefully chosen from random distributions [15:57:55] sarang: If he has an actual attack or a suggestion of how to reduce the parameter space, fine, share it [15:58:21] sarang: But we don't spend our time proving negatives... we review carefully and hunt down any flaws we see that seem reasonable given our expertise [15:59:42] sarang: If he wants to argue with linear algebra or the ECDLP, he can go right ahead [15:59:48] sarang: Those are better listeners anyway [16:00:28] sarang: We don't need to explain how linear algebra works anyway... it's assumed the whitepaper is written for someone who knows what all those little symbols mean [16:02:56] sarang: Real mathematicians don't rub unknowns in people's faces. They point out flaws and offer constructive input

Thanks for dumping their condescending attitude in public. I guess you were hoping for revenge for the upthread exchange between you and I?

I aced college Linear Algebra in 1985. And I aced college Calculus I in night school at college while I was still in high school in 1983.

I sent my suggestion to smooth with the implied (from earlier discussion) caveat that I was not providing a complete analysis nor was I sure there is a vulnerability. So I was under no obligation to follow what "real mathematicians" do because I don't have skin in this game. I am not trying to prove myself in the math field. I was simply trying to help develop ideas for what could have any chance of being BCX's alleged exploit. It is not my role to take it further than that. I had already provided a real anonymity attack with pseudocode, thus this was off-the-cuff quick suggestion to smooth was purely me trying to help share ideas. Not to be used as fodder to insult me in public.

Quote from: fluffypony on September 24, 2014, 02:24:03 PM

[16:06:31] sarang: Oh, and the equations use different base points, so you gain no benefit from a common base point

I didn't see that. Where is that written or it just an assumption? I noticed the requisite mod l are implied and not written. So this must be one of those typical things you are supposed to know and is not explicit?

But note above we have 3 equations and afaics only 2 unknowns.