Post
Topic
Board Archival
Re: delete
by
smooth
on 04/10/2014, 11:25:54 UTC
Mixing whether it be done by centralized exchanges or by large anonymity sets increase the threat of domino cascade

Exchanges are just an example of a commerce transaction...

Incorrect. The distinction is an exchange acts (by its Terms Of Service) as an unallocated pool for all participants thus it warrants that every coin in the pool is fungible, whereas without explicit anonymity mixing a vendor spends a traceable coin on a transparent block chain and the trail of culpability stays only with that coin, not with all the other coins spent to that vendor.


This is a distinction without an ultimate difference, most certainly to the affected party. You buy (or sell) socks, you get (or give) the socks, and coins end up other than with the person who sold the socks, then someone is screwed. Such a person doesn't really care about unallocated pools and other technicalities. If one person ends up with socks and coins, then double spending has occurred, and this is equally a potential problem on traceable and untraceable chains given chain forks and hash rate based attacks.

Quote
I am contemplating you imply effectively that rings may so radically cross-mixed that blacklisting anything blacklists everything.

Note the algorithm I did for the bounty. If that algorithm is worthy, then mixing is going need to be much less overlapping otherwise anonymity is lost.

I wasn't referring to overlapping at all, just the exponential growth of mixes. If one recipient mixes with 5 others and each of those mixes with 5 others, even if there is no overlap, then after a relatively small number of steps, a huge number of coins become mixed. (In fact wouldn't reduced overlap speed this up?) It is entirely possible that somewhere down in this wide swath of mixing, the original apparent owner has moved his coins somewhere far away on the chain before the original outputs were blacklisted, rendering the blacklist invisibly ineffective. But even if not, the number of outputs included in the downstream set is large enough that attempting to impose some tracing-based blacklist becomes equivalent to to a coin ban.

More study is always needed, but again we are back to "there might be a flaw." Yes there might be. Anywhere and everywhere. Provide actual analysis or just continue to make these vague sweeping generalities that signify nothing.

Quote
A significant feature of ring signatures is the spender decides (i.e. has autonomy of) what to mix with, thus the authorities can make the spenders culpable for mixing with blacklisted anonymity sets.

Not if the mixing occurred before the blacklisting. Thus the point that blacklisting is only relevant to fungibility if it occurs in a very narrow time window. Once the horse (and his DNA) is out of the barn, there is no turning back.

The original coins can possibly be blacklisted (though as you point out this depends on control over miners and other systemwide considerations) and with identical caveats people can be prevented from mixing with the original coins again, but an effect on fungibility of previous spends of those coins is impractical.

Quote
I've already covered my proposed solution to this in detail in the Longest Chain Rule thread in the Developers subforum. I don't want to repeat what I've already argued there about how to handle forks. Apparently gmaxell disagreed with me, but he refused to tell me why.

If I had to guess I would speculate something to do with the signal-to-noise issue I referenced earlier.