Quote from: smooth on October 04, 2014, 02:20:55 AM

Certainly ring sigs don't automatically cause massive numbers of otherwise-unrelated transactions to suddenly depend on a rejected fork, especially if the fork is of limited duration. Granted there are slightly more dependencies, but that is quantitative difference not a qualitative one.

I posited to NewLiberty upthread that the development of a Gordian knot would depend on the duration of such an attack.

I argue it it also qualitative because my outputs get mixed in rings without my permission. Thus I can't spend in times of such an attack without incurring the risk that my spend must be unwound. Whether I know an attack is underway is irrelevant.

Quote from: smooth on October 04, 2014, 02:20:55 AM

Quote

Quote

Quote

3. Non-Cryptonote coins do not have throw away 20% of the timestamp information upon difficulty adjustment. I know you think the vulnerability I have broad-sketched above is not sufficiently detailed to warrant any concern, but nevertheless this is a risk that doesn't exist in other coins.

More vague uncertainty and doubt without some sort of positive statement.

I have described a specific set of steps for an algorithm upthread.

I missed that. Please quote it or summarize it.

I am so hungry. For example, I posited a way to continually increase the difficulty by always structuring the attackers blocks to make the fastest block solutions in the discarded 20% set, thus skewing the statistics of the hashrate. I wrote the caveat that I hadn't studied the implementation to see if this was feasible.

I posited this would cause the network hashrate to drop (because miner's profits depends on difficulty) thus increasing the attackers % of the network hashrate.

Btw, the selfish mining white paper shows the math for this effect, so you've just opened a window to make it easier with less hashrate. You can work through the equations there. I suppose 20% as BCX said wouldn't be far off because of my recent interaction with that math.

Quote from: smooth on October 04, 2014, 02:20:55 AM

Quote

Quote from: smooth on October 04, 2014, 01:30:58 AM

You actually did this in describing the existence of stronger-than-MRL-0001 deanonymation attack (though not its scope and practical effect).

Oh I see you are recognizing that. Thanks.

Exactly, and this is not meant to personalize the issue with respect to you or anyone else or Monero or any other project. Specific, well-supported and well-presented contributions are more valued than vague ones. Always and everywhere.

I agree they are valued, but I entirely disagree they are universally more valuable in every case. Sometimes just the inkling of an incredibly powerful idea is more valuable to me than some implementation of something.

I am 100% sure you agree there are such cases.

Quote from: smooth on October 04, 2014, 02:20:55 AM

Quote

It is very intuitive to me mathematically that you've got aliasing error in your difficult adjustment.

Show a specific example (or more general mathematical proof, but I'm guessing that proof-by-example might be easiest here).

Too hungry. Will see if something comes to me later.