2016-08-09.log

--- Log opened Tue Aug 09 00:00:20 2016
-!- rusty [~rusty@pdpc/supporter/bronze/rusty] has quit [Ping timeout: 264 seconds]00:05
-!- AusteritySucks [~Austerity@unaffiliated/austeritysucks] has joined #bitcoin-wizards00:06
-!- BashCo [~BashCo@unaffiliated/bashco] has joined #bitcoin-wizards00:08
-!- Sleepnbum [~Sleepnbum@173.55.57.163] has quit [Ping timeout: 250 seconds]00:17
-!- mryandao [~renlord@14-203-125-246.static.tpgi.com.au] has quit [Quit: leaving]00:18
-!- BashCo_ [~BashCo@unaffiliated/bashco] has joined #bitcoin-wizards00:19
-!- BashCo [~BashCo@unaffiliated/bashco] has quit [Ping timeout: 240 seconds]00:22
-!- ThomasV [~ThomasV@unaffiliated/thomasv] has quit [Ping timeout: 252 seconds]00:29
-!- AusteritySucks [~Austerity@unaffiliated/austeritysucks] has quit [Ping timeout: 252 seconds]00:36
-!- Alopex [~bitcoin@cyber.dealing.ninja] has quit [Remote host closed the connection]00:50
-!- Alopex [~bitcoin@cyber.dealing.ninja] has joined #bitcoin-wizards00:52
-!- pro [~pro@unaffiliated/pro] has joined #bitcoin-wizards01:06
-!- rubensayshi [~ruben@82.201.93.169] has joined #bitcoin-wizards01:08
-!- ThomasV [~ThomasV@unaffiliated/thomasv] has joined #bitcoin-wizards01:13
-!- yoleaux [~yoleaux@xn--ht-1ia18f.nonceword.org] has joined #bitcoin-wizards01:26
-!- AaronvanW [~ewout@unaffiliated/aaronvanw] has quit [Read error: Connection reset by peer]01:32
-!- AaronvanW [~ewout@198pc231.sshunet.nl] has joined #bitcoin-wizards01:37
-!- AaronvanW [~ewout@198pc231.sshunet.nl] has quit [Changing host]01:37
-!- AaronvanW [~ewout@unaffiliated/aaronvanw] has joined #bitcoin-wizards01:37
-!- jtimon [~quassel@55.31.134.37.dynamic.jazztel.es] has joined #bitcoin-wizards01:41
-!- AusteritySucks [~Austerity@unaffiliated/austeritysucks] has joined #bitcoin-wizards01:51
-!- BashCo [~BashCo@unaffiliated/bashco] has joined #bitcoin-wizards01:57
-!- BashCo_ [~BashCo@unaffiliated/bashco] has quit [Ping timeout: 260 seconds]01:59
-!- TheSeven [~quassel@rockbox/developer/TheSeven] has quit [Ping timeout: 250 seconds]02:00
-!- TheSeven [~quassel@rockbox/developer/TheSeven] has joined #bitcoin-wizards02:01
-!- tunafizz [tunafizz@c-71-207-55-31.hsd1.pa.comcast.net] has quit [Read error: Connection reset by peer]02:08
-!- Giszmo [~leo@ip5f5ac08d.dynamic.kabel-deutschland.de] has joined #bitcoin-wizards02:08
-!- Ylbam [uid99779@gateway/web/irccloud.com/x-dlmusiulhjcmbuoq] has joined #bitcoin-wizards02:32
-!- AusteritySucks [~Austerity@unaffiliated/austeritysucks] has quit [Ping timeout: 265 seconds]02:38
-!- ThomasV [~ThomasV@unaffiliated/thomasv] has quit [Remote host closed the connection]02:39
-!- BashCo [~BashCo@unaffiliated/bashco] has quit [Read error: Connection reset by peer]02:46
-!- ThomasV [~ThomasV@unaffiliated/thomasv] has joined #bitcoin-wizards02:46
-!- BashCo [~BashCo@unaffiliated/bashco] has joined #bitcoin-wizards02:46
-!- jaekwon [~jaekwon@75-101-96-71.dsl.static.fusionbroadband.com] has quit [Remote host closed the connection]02:51
-!- laurentmt [~Thunderbi@80.215.234.247] has joined #bitcoin-wizards02:55
-!- laurentmt [~Thunderbi@80.215.234.247] has quit [Client Quit]02:58
-!- freekevin [freekevin@gateway/shell/xshellz/x-dxzarrzyvrydvyqf] has quit [Ping timeout: 276 seconds]03:06
-!- freekevin [freekevin@gateway/shell/xshellz/x-cldncftnfsehoyra] has joined #bitcoin-wizards03:11
-!- blockzombie [~blockzomb@eth59-167-133-100.static.internode.on.net] has quit [Remote host closed the connection]03:44
-!- ThomasV [~ThomasV@unaffiliated/thomasv] has quit [Ping timeout: 258 seconds]03:44
-!- laurentmt [~Thunderbi@80.215.234.247] has joined #bitcoin-wizards03:47
-!- laurentmt [~Thunderbi@80.215.234.247] has quit [Client Quit]03:48
-!- proslogion [~proslogio@2.217.2.220] has joined #bitcoin-wizards04:02
proslogionthe NTRU keysize makes it not so interesting for Bitcoin04:04
proslogionbesides, it's patented, freely licensed for open source projects, but still patented04:04
proslogionsill it deserves to be singled out because almost anything else PQC is much worse04:07
-!- laurentmt [~Thunderbi@80.215.234.247] has joined #bitcoin-wizards04:13
-!- laurentmt [~Thunderbi@80.215.234.247] has quit [Client Quit]04:14
nsh;seen bramc04:15
-!- dEBRUYNE [~dEBRUYNE@unaffiliated/debruyne] has joined #bitcoin-wizards04:24
-!- thesnark [~mike@unaffiliated/thesnark] has joined #bitcoin-wizards04:25
fluffyponyholy backlog04:26
fluffyponyandytoshi should hang around more often04:26
-!- thesnark [~mike@unaffiliated/thesnark] has quit [Remote host closed the connection]04:30
-!- thesnark [~mike@unaffiliated/thesnark] has joined #bitcoin-wizards04:38
-!- jaekwon [~jaekwon@75-101-96-71.dsl.static.fusionbroadband.com] has joined #bitcoin-wizards04:57
-!- jaekwon_ [~jaekwon@75-101-96-71.dsl.static.fusionbroadband.com] has joined #bitcoin-wizards05:00
-!- jaekwon [~jaekwon@75-101-96-71.dsl.static.fusionbroadband.com] has quit [Ping timeout: 250 seconds]05:01
-!- jaekwon_ [~jaekwon@75-101-96-71.dsl.static.fusionbroadband.com] has quit [Read error: Connection reset by peer]05:01
-!- ThomasV [~ThomasV@unaffiliated/thomasv] has joined #bitcoin-wizards05:02
-!- Chris_Stewart_5 [~Chris_Ste@unaffiliated/chris-stewart-5/x-3612383] has joined #bitcoin-wizards05:37
-!- edvorg [~edvorg@14.169.57.10] has joined #bitcoin-wizards06:04
-!- jaekwon [~jaekwon@75-101-96-71.dsl.static.fusionbroadband.com] has joined #bitcoin-wizards06:09
-!- jaekwon [~jaekwon@75-101-96-71.dsl.static.fusionbroadband.com] has quit [Ping timeout: 252 seconds]06:13
-!- Chris_Stewart_5 [~Chris_Ste@unaffiliated/chris-stewart-5/x-3612383] has quit [Ping timeout: 244 seconds]06:21
-!- laurentmt [~Thunderbi@80.215.178.68] has joined #bitcoin-wizards06:37
-!- ThomasV [~ThomasV@unaffiliated/thomasv] has quit [Ping timeout: 240 seconds]06:38
-!- dEBRUYNE [~dEBRUYNE@unaffiliated/debruyne] has quit [Quit: Leaving]06:38
-!- laurentmt [~Thunderbi@80.215.178.68] has quit [Client Quit]06:39
-!- jaekwon [~jaekwon@75-101-96-71.dsl.static.fusionbroadband.com] has joined #bitcoin-wizards06:45
-!- jaekwon [~jaekwon@75-101-96-71.dsl.static.fusionbroadband.com] has quit [Ping timeout: 252 seconds]06:50
-!- contrapumpkin is now known as copumpkin07:00
-!- Sosumi [~Leon@bl10-113-190.dsl.telepac.pt] has joined #bitcoin-wizards07:08
-!- xissburg_ [~xissburg@unaffiliated/xissburg] has joined #bitcoin-wizards07:15
-!- xissburg_ [~xissburg@unaffiliated/xissburg] has quit [Read error: Connection reset by peer]07:16
-!- xissburg [~xissburg@unaffiliated/xissburg] has quit [Read error: No route to host]07:16
-!- xissburg [~xissburg@unaffiliated/xissburg] has joined #bitcoin-wizards07:20
-!- tromp [~tromp@ool-944bc34f.dyn.optonline.net] has joined #bitcoin-wizards07:20
-!- tromp [~tromp@ool-944bc34f.dyn.optonline.net] has quit [Ping timeout: 240 seconds]07:24
-!- dEBRUYNE [~dEBRUYNE@unaffiliated/debruyne] has joined #bitcoin-wizards07:24
-!- proslogion [~proslogio@2.217.2.220] has quit [Ping timeout: 260 seconds]07:35
-!- nonaTure [~nonaTure@p4FEB907D.dip0.t-ipconnect.de] has joined #bitcoin-wizards07:36
-!- cyphase [~cyphase@unaffiliated/cyphase] has quit [Ping timeout: 258 seconds]07:39
-!- nonaTure [~nonaTure@p4FEB907D.dip0.t-ipconnect.de] has quit [Quit: Leaving]07:42
-!- nonaTure [~nonaTure@p4FEB907D.dip0.t-ipconnect.de] has joined #bitcoin-wizards07:42
-!- cyphase [~cyphase@unaffiliated/cyphase] has joined #bitcoin-wizards07:44
-!- zooko [~user@73.95.137.99] has joined #bitcoin-wizards07:56
-!- ThomasV [~ThomasV@unaffiliated/thomasv] has joined #bitcoin-wizards08:10
-!- Ylbam [uid99779@gateway/web/irccloud.com/x-dlmusiulhjcmbuoq] has quit [Quit: Connection closed for inactivity]08:25
-!- BashCo [~BashCo@unaffiliated/bashco] has quit [Ping timeout: 244 seconds]08:31
-!- rubensayshi [~ruben@82.201.93.169] has quit [Remote host closed the connection]08:47
-!- Guyver2 [~Guyver2@guyver2.xs4all.nl] has joined #bitcoin-wizards08:48
-!- jaekwon [~jaekwon@75-101-96-71.dsl.static.fusionbroadband.com] has joined #bitcoin-wizards08:55
-!- proslogion [~proslogio@130.159.65.131] has joined #bitcoin-wizards08:58
-!- BashCo [~BashCo@unaffiliated/bashco] has joined #bitcoin-wizards09:30
-!- mdavid613 [~Adium@cpe-104-172-191-85.socal.res.rr.com] has joined #bitcoin-wizards09:30
-!- ThomasV [~ThomasV@unaffiliated/thomasv] has quit [Ping timeout: 258 seconds]09:36
-!- bildramer [~bildramer@ppp-94-67-125-5.home.otenet.gr] has quit [Ping timeout: 244 seconds]09:38
-!- Sleepnbum [~Sleepnbum@72.67.47.196] has joined #bitcoin-wizards09:41
-!- bildramer [~bildramer@ppp-94-69-93-203.home.otenet.gr] has joined #bitcoin-wizards09:43
-!- Guyver2 [~Guyver2@guyver2.xs4all.nl] has quit [Remote host closed the connection]09:52
-!- iwilcox [~iwilcox@unaffiliated/iwilcox] has joined #bitcoin-wizards09:54
-!- mdavid613 [~Adium@cpe-104-172-191-85.socal.res.rr.com] has quit [Quit: Leaving.]09:56
-!- Guyver2 [~Guyver2@guyver2.xs4all.nl] has joined #bitcoin-wizards10:00
-!- mdavid613 [~Adium@cpe-104-172-191-85.socal.res.rr.com] has joined #bitcoin-wizards10:01
-!- edvorg [~edvorg@14.169.57.10] has quit [Remote host closed the connection]10:08
-!- edvorg [~edvorg@14.169.57.10] has joined #bitcoin-wizards10:26
-!- MoALTz [~no@78-11-183-124.static.ip.netia.com.pl] has joined #bitcoin-wizards10:40
-!- byteflame [~byteflame@70-89-65-45-little-rock-ar.hfc.comcastbusiness.net] has joined #bitcoin-wizards10:41
-!- dgenr8 [~dgenr8@unaffiliated/dgenr8] has quit [Ping timeout: 250 seconds]10:43
-!- edvorg [~edvorg@14.169.57.10] has quit [Ping timeout: 244 seconds]10:43
-!- dgenr8 [~dgenr8@unaffiliated/dgenr8] has joined #bitcoin-wizards10:43
-!- laurentmt [~Thunderbi@176.158.157.202] has joined #bitcoin-wizards10:46
-!- Chris_Stewart_5 [~Chris_Ste@unaffiliated/chris-stewart-5/x-3612383] has joined #bitcoin-wizards10:47
-!- laurentmt [~Thunderbi@176.158.157.202] has quit [Client Quit]10:48
-!- zooko [~user@73.95.137.99] has quit [Ping timeout: 276 seconds]10:57
-!- bildramer [~bildramer@ppp-94-69-93-203.home.otenet.gr] has quit [Ping timeout: 265 seconds]11:07
-!- bildramer [~bildramer@ppp-94-67-123-74.home.otenet.gr] has joined #bitcoin-wizards11:15
-!- proslogion [~proslogio@130.159.65.131] has quit [Ping timeout: 258 seconds]11:16
waxwinghttps://www.usenix.org/system/files/conference/woot16/woot16-paper-wustrow.pdf11:17
waxwingTLDR prove you DDoSed a server by using returned server sigs as proof of work, heh11:17
-!- mdavid613 [~Adium@cpe-104-172-191-85.socal.res.rr.com] has quit [Quit: Leaving.]11:21
-!- tromp [~tromp@ool-944bc34f.dyn.optonline.net] has joined #bitcoin-wizards11:22
katu_cute :)11:22
-!- mdavid613 [~Adium@cpe-104-172-191-85.socal.res.rr.com] has joined #bitcoin-wizards11:24
cjdandytoshi: I am thinking that the problem you raised of the transaction payers robbing the miner later on is possibly acceptable in practice, if the miner creates his own transaction (e.g. paying money to himself) then he should be safe...11:24
cjdand the benefit of such a scheme is you can "sync the chain" by asking a peer for the most recent block and then asking for the txout set, then validating it and asking for (say) 1000 block headers or whatever it takes to make yourself happy that you are not being fed bullshit11:26
-!- tromp [~tromp@ool-944bc34f.dyn.optonline.net] has quit [Ping timeout: 250 seconds]11:26
cjdyou just take the block header number and calculate the amount of created money at that point, point multipliy that value and add it to all of the UTXOs11:27
andytoshicjd: by "asking for the txout set" you mean also all the kG values11:30
cjdyes11:30
cjdand I guess the header contains [ HASH(utxoSet), HASH(prevHeader), number, difficulty, time, nonce ]11:30
cjd*blockNumber11:30
cjdoh crap you can fiddle with the difficulty, that's annoying11:31
andytoshiwell the utxoSet needs to have proofs that the utxos have been committed to by the blockchain11:32
andytoshii think11:32
andytoshimaybe not, maybe the header commitment is sufficient11:32
cjdthe reason for the hash over the utxoSet is just so that somebody else cannot steal your mining fee11:33
cjdoh yeah also double-spend11:34
cjdthere might be still another way to compress the header chain, if the header with the highest "work" each day points at the header with the highest work from the previous day, I think you can just skip blocks11:36
cjdso since you don't know if you're going to be the winner of a "checkpoint" block, just every block points at the checkpoint from the previous 144 blocks or such11:38
andytoshicjd: are you familiar with compact SPV proofs?11:40
cjduhhh I have heard this before but my memory is not working11:40
andytoshihttp://blockstream.com/sidechains.pdf appendix B11:40
andytoshii'm still unsure if it's OK that utxo inclusion proofs point to blocks other than the one they were included in11:40
andytoshii guess so11:41
Taek[14:25:21] <cjd> andytoshi: I am thinking that the problem you raised of the transaction payers robbing the miner later on is possibly acceptable in practice, if the miner creates his own transaction (e.g. paying money to himself) then he should be safe...11:41
Taekwould the transactors have to do something similar to make sure the miners couldn't steal from them?11:41
Taeksupposing you ended up as the only transactor in a block11:41
@gmaxwellandytoshi: I don't see why a tip commitment isn't fine (other than perhaps performance reasons)11:41
andytoshiTaek: presumably you, the transactor, would put a kG value in here11:42
cjd> the presence of lower-than-necessary hashes is in fact statistical evidence of more work done in the chain[Mil12].  <-- ok we're on the same page here11:42
andytoshigmaxwell: yeah, i think it's fine11:42
instagibbscan someone reiterate the problem being discussed? I don't see in backlog11:42
cjdinstagibbs: optimizations to mimblewimble11:43
instagibbscjd, a little more than that :)11:43
cjdcrap maybe we need to start a pad to keep track of the backstory here :|11:43
instagibbs> I am thinking that the problem you raised of the transaction payers robbing the miner later11:43
Taek(andytoshi is going to write a paper never fear)11:44
andytoshilol. yeah, i'll write something, once things stop being in such flux11:45
cjdbasically I'm proposing an optimization wherein each transaction is broadcast with the sum-of-secrets and the leftover money (fee) and the miner is the one who makes the signed emptystring rather than the transactors11:45
cjdinstagibbs: ^^11:45
instagibbsoh i see, a problem with an optimization11:45
instagibbsI was confuzzled11:45
cjdyes, we're going over optimizations to try to make it require O(n) storage (n being unspend outputs) :)11:46
andytoshicjd: if you make a transaction and broadcast the "sum-of-secrets" which is just your secret you can be robbed11:46
instagibbscjd, I think you will lose a lot if you drop the chain stuff11:46
@gmaxwellIt's useful to take a step back and consider what MW actually does.11:47
@gmaxwellIt's constructs a proof interactively that (under relevant assumptions) no theft except double spending could have happened.11:48
instagibbsand inflation, at least in a particular history11:48
@gmaxwellI don't think that property can be maintained if coin creation doesn't introduce new randomness.11:48
andytoshiinstagibbs: no inflation can happen within a single tx11:49
cjdCan you elaborate? "new randomness" ?11:49
instagibbsandytoshi, no current inflation ;P11:49
cjdoh I think I get it, you're arguing that block rewards could be ripped off unless we check each block11:50
instagibbsyep11:51
cjdI need to showerthink about that one, I really want to not sync block headers :|11:52
instagibbsthe newly generated coins also probably need to be blinded, otherwise they can just be extracted11:53
andytoshicjd: i think you can decrease the block header length to log(n) as long as you commit to everything in each block11:53
andytoshiusing the compact SPV stuff in the sidechains paper11:53
-!- Chris_Stewart_5 [~Chris_Ste@unaffiliated/chris-stewart-5/x-3612383] has quit [Ping timeout: 250 seconds]11:56
-!- Ylbam [uid99779@gateway/web/irccloud.com/x-eaiaeaobfdtlryxx] has joined #bitcoin-wizards12:03
-!- byteflame [~byteflame@70-89-65-45-little-rock-ar.hfc.comcastbusiness.net] has quit [Ping timeout: 264 seconds]12:06
cjdI'm thinking you might get away with just downloading headers until the sum of difficulty goes over K (some comfort factor)12:11
cjdbecause in order for any money to be stolen as gmax suggests, the mining fees would have to have been stolen which is equivilant to mining a fake chain and you have reached your comfort factor of difficulty which is warranting that this did not happen12:12
-!- dEBRUYNE_ [~dEBRUYNE@unaffiliated/debruyne] has joined #bitcoin-wizards12:13
-!- dEBRUYNE_ [~dEBRUYNE@unaffiliated/debruyne] has quit [Read error: Connection reset by peer]12:13
-!- dEBRUYNE [~dEBRUYNE@unaffiliated/debruyne] has quit [Ping timeout: 265 seconds]12:15
cjdI have to think about it more, in simplistic contexts I feel like I understand it but when I take it to bigger contexts I'm completely lost about it's security properties12:15
nshwhat's the fee-stealing attack against miners?12:16
cjdso this is an attack against an imagined optimization of mimblewimble only12:18
-!- dEBRUYNE [~dEBRUYNE@unaffiliated/debruyne] has joined #bitcoin-wizards12:19
cjdmy optimization is when you create a transaction and you calculate  ( (secretKeyInput + valueInput) - (secretKeyOutput + valueOutput + secretKeyChange + valueChange) )12:19
cjdinstead of signing the emptystring with that result (as a secret key) you instead bcast the result along with the value of any leftover money12:20
cjdthen the miner needs constructs a block knowing sum-of-secrets from each transaction and thus can create only 1 signature for the whole block12:21
cjdyou following ?12:21
nshroughly12:21
-!- Chris_Stewart_5 [~Chris_Ste@unaffiliated/chris-stewart-5/x-3612383] has joined #bitcoin-wizards12:21
nshhow many signatures would be required otherwise for mining a block?12:22
cjdone per transaction12:22
cjddid you read MW ?12:22
nshoh, you mean this obviates the need for the signing at all when authenticating receipt of transaction?12:23
nshonly the miner signs?12:23
cjdyou read mimblewimble? I just want to make sure we're talking about the same thing here...12:23
* nsh nods12:23
nshwe were talking about it notverymany hours ago12:23
cjdok so right, you can get to 1 signature per block if we are ok to bcast the sum-of-secrets and the remaining value (fee) to the miner12:24
cjdbecause the miner merges everything12:24
nshhmm12:25
cjdnow for my next trick, I want to replace the signature which the miner creates with a simple output, now andytoshi reminds me that I have created a bug because now all of the outputs by the miner sum to a value which the creator of the transaction knows12:25
nshah, okay. took me a moment to understand this still authenticates12:26
cjdbasically the creator of the transaction (knowing the sum of secrets, change amount, block reward and that the final sum is zero) can just deduce a transaction which spends all of the outputs from the miner12:27
nshcreator of which transaction?12:27
cjdlets imagine there is only 1 transaction being created in this block12:28
cjd1 person paying 1 other person and 1 miner12:28
* nsh nods12:28
cjdthe payee knows the sum of secrets and if the final sum is zero, this implys he also knows the miner's secret and cna steal the fee12:28
-!- byteflame [~byteflame@70-89-65-45-little-rock-ar.hfc.comcastbusiness.net] has joined #bitcoin-wizards12:28
nshi think you need external-to-pederson consensus logic for blocks anyway12:29
nsh(for e.g. maturing block subsidies)12:30
cjdBut I respond that if the miner includes an *input* for which only he knows the private key, he has masked the result and the creator of this single transaction cannot rob him12:30
nshah, right12:30
nsh(i think this problems goes away when you have lots of transactions anyway, or it's a very tight lottery)12:30
nshno transaction recipient is especially privileged in being able to infer the final excess12:31
cjdhaving no signature per block may seem unimportant but once I have convinced you that this works, I go on to suggest that validating the chain does not require downloading even the whole chain of headers12:31
nshheh, i think we need to process moonleaps one at a time12:31
cjdjust download the "unspent txo set" (the commitments) and the most recent block header and as many block headers as you like, then calculate based on the block number the amount of money in circulation, point multiply that and add this to all commitments and expect zero12:32
* nsh nods12:32
nshyou can have some security comfort parameter; falsification of the past can still be made dependent on a fast-growing function of hashpower12:33
nshjust not clear exactly what needs to be committed yet12:33
cjdbut gmax points out that I'm now violating some basic assumption of MW because I've completely dropped validation of who gets the block rewards and so I am wrestling with that as we speak12:34
cjdit makes so much sense the way I go but taking a different path it sounds so broken :)12:34
nshhmm12:34
cjdit is as though any ring of commitments can be valid as long as it adds up to zero and spends X money12:35
cjdso you must only create 1 block to fool someone12:35
nshno party with merkle12:35
cjdI think there is a very simple bypass of that issue but I need to think more12:35
-!- rusty2 [~rusty@pdpc/supporter/bronze/rusty] has joined #bitcoin-wizards12:40
tromp_i just commented on https://news.ycombinator.com/item?id=1225629112:44
cjdanyway even if you put a signature in each block, what you need to download to reconstruct a block header is [ sig, time, nonce ], everything else can be inferred12:45
cjdso you're looking at like 4.2MB per year with a 10mn block rate12:46
cjd*10 minute12:46
-!- proslogion [~proslogio@2.217.2.220] has joined #bitcoin-wizards12:48
cjdactually 5.8 with the public keys which are also needed12:48
proslogionin MW, can i send someone some coins, then get around to manage to receive a tx from this pubkey of him as another identity so i can get his blinding factor, then next time when i do business with him, i would use the same blinding factor and amount as i used last time, so i can replay the second tx despite him not wanting to send the other identity coins this time?12:51
cjdare you assuming no change address ?12:51
proslogionyes12:52
cjdalso consider that a pubkey is never used twice12:53
-!- nonaTure [~nonaTure@p4FEB907D.dip0.t-ipconnect.de] has quit [Ping timeout: 250 seconds]12:54
proslogionwhat if somebody does? anything other than client-side check?12:54
cjdbecause you have to interact with his computer in order to make the transaction so it's the decision of the programmers, not of the user12:54
cjdside-effect: you can't get paid if your computer is turned off12:55
cjdbut that's part of MW that we can't seem to fix12:55
nsh(well, you could use pegs with another chain that allows interactionless payments for certain situations)12:56
cjdoh crap I have a problem with my whole optimization, once the payee reveals the sum-of-secrets the payer can rob him :(12:59
proslogionah, no, no, you cannot reuse the same r, like bitcoin, the r you use is dependent on the tx a pubkey receives as well!12:59
proslogionit's a chain12:59
cjdso we're back to 5:1 chain compression which is not great13:00
cjdunless the payee adds an input to the tx which is going to kill off some use cases13:01
andytoshiproslogion: yes, replay attacks are possible if you reuse addresses. but you create the addresses when you receive payments, and you're the one who'll get robbed. so don't reuse keys.13:04
andytoshis/address/keys/ everywhere, MW really doesn't have addresses13:04
cjdI'm really unhappy that we can't get rid of sig-per-tx, not only does that mean a large chain but it also means that anyone who downloads each block (a miner for instance) can reconstruct the transactions from that block and effectively de-anonymise the money flows13:07
@gmaxwellhuh?!13:07
instagibbsthe original MW paper allows this, but it's not necessary at all13:08
cjdMaybe I'm talking shit but my approach would be to try to fit groups of cancelled inputs and created outputs with signatures13:08
cjdit's computationally expensive but I don't feel like it's expensive enough13:08
instagibbs<andytoshi> ah, there's a simple fix, publish k1G and k2, sign with k1G but make the transaction excess be (k1 + k2)G13:08
instagibbs<andytoshi> and when combining transactions all the k2's just get added together13:08
-!- Chris_Stewart_5 [~Chris_Ste@unaffiliated/chris-stewart-5/x-3612383] has quit [Ping timeout: 265 seconds]13:09
cjdis that not a variant of publish   k1G and k2G  ?   in which case I just need to fit 2 sigs together with a handful of inputs and outputs...13:10
-!- Chris_Stewart_5 [~Chris_Ste@unaffiliated/chris-stewart-5/x-3612383] has joined #bitcoin-wizards13:11
andytoshicjd: no, there is no sig with k213:11
andytoshiit's an explicit value13:11
cjdahh right, so you just add up k2 every time you merge transactions in memory13:12
cjdvery good :)13:12
-!- dEBRUYNE [~dEBRUYNE@unaffiliated/debruyne] has quit [Ping timeout: 244 seconds]13:12
proslogionandytoshi: i don't get it, your r is determined partially by the r of your sender, i wonder if reusing a r is at all possible13:13
andytoshiheh, yeah, this was what i had before MW came out (without the k1G, so it was insecure for the same reason your optimization was). i realized my mistake when MW came out, but i feel a bit better that voldemort made the opposite mistake :P13:13
andytoshiproslogion: i think you'd be able to do it, at the very least by creating two outputs, skewing one to reuse r, and skewing the other in the opposite direction13:14
cjddammit why do we need these signatures floating around everywhere :|13:15
proslogionandytoshi: right you can just adjust the k value to achieve that effect, i forgot13:19
-!- dEBRUYNE [~dEBRUYNE@unaffiliated/debruyne] has joined #bitcoin-wizards13:21
cjdso what makes the signature-over-emptystring work is the fact that it's not cancellable13:22
cjdyou can point to a utxo (a commitment) and cancel that when you are spending another transaction but the signature is forever13:22
cjdif you could cancel a signature then the spender can still rob the recipient13:23
andytoshicjd: well if you can aggregate the proof of discrete logs that's still not possible .. so it's not as morose as you make it seem13:24
andytoshiwe could use BLS sigs for the kG values, in a pairing-friendly group, and then you could aggregate all the sigs into one and it'd still be ok13:24
cjdok, aggregatable sigs, that would be cool13:25
andytoshihmm actually maybe there is still a risk here, unsure13:25
cjdbut I fear the more cool math we use, the more difficult it will be to take this to post-quantum13:25
andytoshiyeah13:26
cjdbut 5:1 compression means a 16GB blockchain assuming every tx in bitcoin was replayed into this chain...13:27
andytoshiso we need two things right now: commitments that can be shown to sum to 0 (we don't need full homorphism, just sum to 0); some overflow prevention (right now we use a rangeproof); some extra randomness and a way to prove knowledge of the randomness13:27
cjdIMO overflow prevention is not needed, we just need to prove knowledge of r13:27
cjda.k.a prove that they're not making up garbage to balance the books13:28
andytoshicjd: but then the outputs themselves could overflow. i make a 10BTC output and a -10BTC output and just never spend the latter13:29
andytoshi(and put zero in)13:29
andytoshithis is why we have the overflow protection in "traditional C"13:29
andytoshi"traditional CT"13:30
cjduhh why would you use signed integers?13:30
andytoshicjd: everything works in finite rings13:30
cjdoh I see, you're protecting against overflow of the whole 256 bit number13:30
andytoshiif you take the group order minus n, that's -n13:30
cjdgot it13:30
andytoshiyep13:30
andytoshinone of the quantum stuff i've seen changes this (i don't see that anything could be zero-knowledge without it actually)13:30
cjdchanges what?13:31
andytoshichanges the fact that every number is modulo something, and can thus be "negative" in a way that's not intrinsicly definable13:32
cjdahh ok13:32
-!- rusty2 is now known as rusty13:35
cjdanything I can read about the types of range proofs used here ?13:36
andytoshicjd: https://people.xiph.org/~greg/confidential_values.txt basically .. gmaxwell might know what sources he based this on13:45
andytoshialso there is an optimized ring signature construction used in that, https://www.reddit.com/r/Bitcoin/comments/386vh0/borromean_ring_signatures_new_research_by_greg/ but this is a bit of an implementation detail13:45
cjdahh I didn't read the whole thing13:46
cjdyeah, I was looking really for the gritty detail of the rangeproof13:46
@gmaxwellyou could redesign it from the text file, and borromean paper; though you'd miss some of the optimizations.13:47
cjdall right, thanks, going to get some food and then I'll take a look13:55
waxwinggmaxwell: shame in MW you lose the whole data-embedding thing 'cos can't share the blinding factors, right13:58
@gmaxwellwaxwing: correct.13:58
proslogionthe data embedding sounds like a weird sales pitch though13:58
waxwingproslogion: well useful for amount, too13:58
waxwingaltho' not necessary13:58
proslogioncan you give that space to counterparty people etc?13:59
waxwingwhen you consider how loudly people complain about not being able to embed stuff in blockchain :)13:59
waxwingyeah you beat me to it :)13:59
waxwingalthough, hmm, it's private to sender/receiver by default14:00
@gmaxwellit _must_ be private.14:00
@gmaxwellor it blows up the ZK property of the proof.14:00
waxwingi was just thinking of auditors14:00
@gmaxwellthe reason in works in CT is that the value being sent and blinding factor is non-private to both the sender and reciever.14:01
@gmaxwellso the proof doesn't need to be ZK with respect to them. :)14:02
@gmaxwellfor MW it does, so no data storage in it.14:02
andytoshiwell you do still have free s values, you can bastardize some storage into them if you've got an out-of-band key. but you'd need to structure the data heavily so your recipient can determine which s-value is forced (and therefore has no data)14:04
andytoshidoing so will reveal the value to anyone who can decrypt, though not directly14:04
-!- Chris_Stewart_5 [~Chris_Ste@unaffiliated/chris-stewart-5/x-3612383] has quit [Ping timeout: 264 seconds]14:04
andytoshiwaxwing: as for auditors, if i've got a commitment C = vH + rG, i can give them v and sign with rG and that'll prove the value14:06
@gmaxwellyes you could carry a tiny amount of data to people who knew the value without meaningfully disclosing the blinding factors.14:06
andytoshiif people already know the value, you can use every free s value as an encryption channel, that doesn't reveal anything about the blinding factor14:06
proslogionjust curious, do you guys read every link drop? someone just show up on this channel and send one message is so easy to miss14:06
-!- Giszmo [~leo@ip5f5ac08d.dynamic.kabel-deutschland.de] has quit [Quit: Leaving.]14:07
andytoshiproslogion: probably every link drop gets noticed, that's pretty weird behaviour. and this one happened to be on a quiet time.. then it was forwarded around a lot outside of IRC14:08
proslogionandytoshi: gotcha, tks14:09
-!- rusty [~rusty@pdpc/supporter/bronze/rusty] has quit [Ping timeout: 250 seconds]14:10
-!- nonaTure [~nonaTure@p4FEB907D.dip0.t-ipconnect.de] has joined #bitcoin-wizards14:11
kanzure"Blinded outsourcing of channel monitoring" https://lists.linuxfoundation.org/pipermail/lightning-dev/2016-August/000565.html14:14
proslogionlol i thought it was about IRC channel monitoring14:15
-!- Chris_Stewart_5 [~Chris_Ste@unaffiliated/chris-stewart-5/x-3612383] has joined #bitcoin-wizards14:21
-!- byteflame [~byteflame@70-89-65-45-little-rock-ar.hfc.comcastbusiness.net] has quit [Ping timeout: 244 seconds]14:28
-!- ThomasV [~ThomasV@unaffiliated/thomasv] has joined #bitcoin-wizards14:44
-!- davec [~davec@cpe-24-243-251-52.hot.res.rr.com] has quit [Ping timeout: 265 seconds]14:45
-!- davec [~davec@cpe-24-243-251-52.hot.res.rr.com] has joined #bitcoin-wizards14:49
-!- rusty2 [~rusty@pdpc/supporter/bronze/rusty] has joined #bitcoin-wizards14:56
-!- blockzombie [~blockzomb@eth59-167-133-100.static.internode.on.net] has joined #bitcoin-wizards14:56
-!- rusty2 [~rusty@pdpc/supporter/bronze/rusty] has quit [Ping timeout: 258 seconds]15:01
-!- mkarrer [~mkarrer@142.red-83-47-107.dynamicip.rima-tde.net] has quit []15:04
-!- Guyver2 [~Guyver2@guyver2.xs4all.nl] has quit [Quit: :)]15:08
-!- MoALTz [~no@78-11-183-124.static.ip.netia.com.pl] has quit [Read error: Connection reset by peer]15:12
-!- murch [~murch@p4FE38D69.dip0.t-ipconnect.de] has joined #bitcoin-wizards15:12
-!- davec [~davec@cpe-24-243-251-52.hot.res.rr.com] has quit [Read error: No route to host]15:19
-!- ThomasV [~ThomasV@unaffiliated/thomasv] has quit [Ping timeout: 244 seconds]15:21
-!- davec [~davec@cpe-24-243-251-52.hot.res.rr.com] has joined #bitcoin-wizards15:21
-!- FNinTak [~jonhbit@tsarviajado.media.mit.edu] has joined #bitcoin-wizards15:38
-!- afk11 [~afk11@109.255.154.81] has joined #bitcoin-wizards15:59
-!- afk11 [~afk11@109.255.154.81] has quit [Changing host]15:59
-!- afk11 [~afk11@unaffiliated/afk11] has joined #bitcoin-wizards15:59
-!- renlord [~renlord@14-203-125-246.static.tpgi.com.au] has joined #bitcoin-wizards16:02
-!- renlord [~renlord@14-203-125-246.static.tpgi.com.au] has quit [Quit: Lost terminal]16:17
-!- murch [~murch@p4FE38D69.dip0.t-ipconnect.de] has quit [Quit: Leaving.]16:18
-!- tromp [~tromp@ool-944bc34f.dyn.optonline.net] has joined #bitcoin-wizards16:19
-!- pro [~pro@unaffiliated/pro] has quit [Quit: Leaving]16:37
-!- Alopex [~bitcoin@cyber.dealing.ninja] has quit [Remote host closed the connection]16:39
-!- FNinTak [~jonhbit@tsarviajado.media.mit.edu] has quit [Ping timeout: 244 seconds]16:39
-!- tromp [~tromp@ool-944bc34f.dyn.optonline.net] has quit [Remote host closed the connection]16:40
-!- Alopex [~bitcoin@cyber.dealing.ninja] has joined #bitcoin-wizards16:41
-!- jaekwon [~jaekwon@75-101-96-71.dsl.static.fusionbroadband.com] has quit [Remote host closed the connection]16:47
-!- FNinTak [~jonhbit@dhcp-18-111-16-181.dyn.mit.edu] has joined #bitcoin-wizards16:54
-!- bildramer [~bildramer@ppp-94-67-123-74.home.otenet.gr] has quit [Ping timeout: 240 seconds]17:02
-!- tromp [~tromp@ool-944bc34f.dyn.optonline.net] has joined #bitcoin-wizards17:07
-!- VMazz [~VMazz@unaffiliated/mazznilla] has joined #bitcoin-wizards17:10
-!- VMazz [~VMazz@unaffiliated/mazznilla] has quit [Quit: HydraIRC -> http://www.hydrairc.com <- Wibbly Wobbly IRC]17:20
-!- rusty2 [~rusty@pdpc/supporter/bronze/rusty] has joined #bitcoin-wizards17:44
-!- Chris_Stewart_5 [~Chris_Ste@unaffiliated/chris-stewart-5/x-3612383] has quit [Ping timeout: 265 seconds]17:45
-!- Chris_Stewart_5 [~Chris_Ste@unaffiliated/chris-stewart-5/x-3612383] has joined #bitcoin-wizards17:49
-!- Alopex [~bitcoin@cyber.dealing.ninja] has quit [Remote host closed the connection]17:53
-!- Alopex [~bitcoin@cyber.dealing.ninja] has joined #bitcoin-wizards17:55
-!- CrazyTruthYakDDS [uid67551@gateway/web/irccloud.com/x-ejufbktegtghhnkj] has joined #bitcoin-wizards17:57
-!- Ylbam [uid99779@gateway/web/irccloud.com/x-eaiaeaobfdtlryxx] has quit [Quit: Connection closed for inactivity]18:15
-!- Sleepnbum [~Sleepnbum@72.67.47.196] has quit [Ping timeout: 240 seconds]18:19
-!- Alopex [~bitcoin@cyber.dealing.ninja] has quit [Remote host closed the connection]18:23
-!- Alopex [~bitcoin@cyber.dealing.ninja] has joined #bitcoin-wizards18:25
-!- FNinTak [~jonhbit@dhcp-18-111-16-181.dyn.mit.edu] has quit [Ping timeout: 250 seconds]18:28
-!- dEBRUYNE [~dEBRUYNE@unaffiliated/debruyne] has quit [Quit: Leaving]18:32
-!- Alopex [~bitcoin@cyber.dealing.ninja] has quit [Remote host closed the connection]18:34
-!- Alopex [~bitcoin@cyber.dealing.ninja] has joined #bitcoin-wizards18:36
-!- renlord [~renlord@14-203-125-246.static.tpgi.com.au] has joined #bitcoin-wizards18:39
-!- Nightwolf [~Nightwolf@unaffiliated/nightwolf] has quit [Read error: Connection reset by peer]18:46
-!- Nightwolf [~Nightwolf@unaffiliated/nightwolf] has joined #bitcoin-wizards18:46
-!- nonaTure [~nonaTure@p4FEB907D.dip0.t-ipconnect.de] has quit [Ping timeout: 258 seconds]18:51
-!- nonaTure [~nonaTure@p4FEB8B5B.dip0.t-ipconnect.de] has joined #bitcoin-wizards18:51
-!- FNinTak [~jonhbit@tsarviajado.media.mit.edu] has joined #bitcoin-wizards18:51
-!- mdavid613 [~Adium@cpe-104-172-191-85.socal.res.rr.com] has quit [Quit: Leaving.]19:03
-!- aalex [~aalex@64.187.177.58] has quit [Ping timeout: 244 seconds]19:09
-!- aalex [~aalex@64.187.177.58] has joined #bitcoin-wizards19:13
-!- dstadulis [~dstadulis@c-73-189-234-152.hsd1.ca.comcast.net] has joined #bitcoin-wizards19:17
-!- proslogion [~proslogio@2.217.2.220] has quit [Ping timeout: 264 seconds]19:26
-!- Chris_Stewart_5 [~Chris_Ste@unaffiliated/chris-stewart-5/x-3612383] has quit [Ping timeout: 252 seconds]19:30
-!- renlord [~renlord@14-203-125-246.static.tpgi.com.au] has quit [Ping timeout: 244 seconds]19:36
-!- nonaTure [~nonaTure@p4FEB8B5B.dip0.t-ipconnect.de] has quit [Ping timeout: 240 seconds]19:47
-!- dstadulis [~dstadulis@c-73-189-234-152.hsd1.ca.comcast.net] has quit [Quit: ZZZzzz…]19:57
-!- dstadulis [~dstadulis@c-73-189-234-152.hsd1.ca.comcast.net] has joined #bitcoin-wizards19:59
-!- Alopex [~bitcoin@cyber.dealing.ninja] has quit [Remote host closed the connection]20:14
-!- jtimon [~quassel@55.31.134.37.dynamic.jazztel.es] has quit [Ping timeout: 244 seconds]20:15
-!- Alopex [~bitcoin@cyber.dealing.ninja] has joined #bitcoin-wizards20:16
-!- CrazyTruthYakDDS [uid67551@gateway/web/irccloud.com/x-ejufbktegtghhnkj] has quit [Quit: Connection closed for inactivity]20:21
-!- Alopex [~bitcoin@cyber.dealing.ninja] has quit [Remote host closed the connection]20:27
-!- Alopex [~bitcoin@cyber.dealing.ninja] has joined #bitcoin-wizards20:29
-!- renlord [~renlord@14-203-125-246.static.tpgi.com.au] has joined #bitcoin-wizards20:32
-!- afk11 [~afk11@unaffiliated/afk11] has quit [Quit: ZNC 1.6.3 - http://znc.in]20:32
-!- Alopex [~bitcoin@cyber.dealing.ninja] has quit [Remote host closed the connection]20:40
-!- Alopex [~bitcoin@cyber.dealing.ninja] has joined #bitcoin-wizards20:42
-!- Sleepnbum [~Sleepnbum@173.55.57.163] has joined #bitcoin-wizards20:43
-!- mdavid613 [~Adium@cpe-172-251-161-231.socal.res.rr.com] has joined #bitcoin-wizards20:45
-!- dstadulis [~dstadulis@c-73-189-234-152.hsd1.ca.comcast.net] has quit [Quit: Textual IRC Client: www.textualapp.com]20:50
-!- Alopex [~bitcoin@cyber.dealing.ninja] has quit [Remote host closed the connection]20:51
-!- Alopex [~bitcoin@cyber.dealing.ninja] has joined #bitcoin-wizards20:53
-!- Alopex [~bitcoin@cyber.dealing.ninja] has quit [Remote host closed the connection]21:14
-!- Alopex [~bitcoin@cyber.dealing.ninja] has joined #bitcoin-wizards21:16
-!- bildramer [~bildramer@ppp-94-67-126-179.home.otenet.gr] has joined #bitcoin-wizards21:22
-!- Alopex [~bitcoin@cyber.dealing.ninja] has quit [Remote host closed the connection]21:29
-!- ThomasV [~ThomasV@unaffiliated/thomasv] has joined #bitcoin-wizards21:31
-!- Alopex [~bitcoin@cyber.dealing.ninja] has joined #bitcoin-wizards21:31
-!- Alopex [~bitcoin@cyber.dealing.ninja] has quit [Remote host closed the connection]21:43
-!- Alopex [~bitcoin@cyber.dealing.ninja] has joined #bitcoin-wizards21:45
-!- Alopex [~bitcoin@cyber.dealing.ninja] has quit [Remote host closed the connection]21:54
-!- Alopex [~bitcoin@cyber.dealing.ninja] has joined #bitcoin-wizards21:56
-!- davec [~davec@cpe-24-243-251-52.hot.res.rr.com] has quit [Quit: leaving]22:03
-!- renlord [~renlord@14-203-125-246.static.tpgi.com.au] has quit [Ping timeout: 244 seconds]22:07
-!- rusty2 [~rusty@pdpc/supporter/bronze/rusty] has quit [Ping timeout: 240 seconds]22:13
-!- renlord [~renlord@14-203-125-246.static.tpgi.com.au] has joined #bitcoin-wizards22:13
-!- Alopex [~bitcoin@cyber.dealing.ninja] has quit [Remote host closed the connection]22:14
-!- Alopex [~bitcoin@cyber.dealing.ninja] has joined #bitcoin-wizards22:16
-!- Cloudflare [~cloudflar@unaffiliated/cloudflare] has joined #bitcoin-wizards22:18
CloudflareI was told there would be free bitcoins22:18
CloudflareHi renlord22:18
Cloudflare(pls no ban, I don't want any free btc)22:20
sipawhy would you not want free btc?!22:21
Cloudflaresipa: because I am Satoshi22:21
Cloudflare😂22:21
-!- Alopex [~bitcoin@cyber.dealing.ninja] has quit [Remote host closed the connection]22:32
CloudflareMy rigs got hacked the other day22:32
CloudflareThey stole my ethereum22:33
CloudflareBut only a little bit of it22:33
-!- ThomasV [~ThomasV@unaffiliated/thomasv] has quit [Ping timeout: 252 seconds]22:34
-!- Alopex [~bitcoin@cyber.dealing.ninja] has joined #bitcoin-wizards22:34
-!- Alopex [~bitcoin@cyber.dealing.ninja] has quit [Remote host closed the connection]22:43
-!- Alopex [~bitcoin@cyber.dealing.ninja] has joined #bitcoin-wizards22:45
-!- execut3 [~shesek@bzq-84-110-32-196.cablep.bezeqint.net] has quit [Ping timeout: 250 seconds]22:48
-!- shesek [~shesek@bzq-84-110-32-196.cablep.bezeqint.net] has quit [Ping timeout: 244 seconds]22:48
-!- Sleepnbum [~Sleepnbum@173.55.57.163] has quit [Ping timeout: 244 seconds]22:49
-!- davec [~davec@cpe-24-243-251-52.hot.res.rr.com] has joined #bitcoin-wizards23:09
-!- jannes [~jannes@178.132.211.90] has quit [Ping timeout: 276 seconds]23:10
-!- davec [~davec@cpe-24-243-251-52.hot.res.rr.com] has quit [Remote host closed the connection]23:39
-!- ThomasV [~ThomasV@unaffiliated/thomasv] has joined #bitcoin-wizards23:49
-!- BashCo [~BashCo@unaffiliated/bashco] has quit [Remote host closed the connection]23:50
-!- jannes [~jannes@178.132.211.90] has joined #bitcoin-wizards23:50
-!- xeon-enouf [~xeon-enou@unaffiliated/xeon-enouf] has quit [Ping timeout: 244 seconds]23:51
-!- xeon-enouf [~xeon-enou@unaffiliated/xeon-enouf] has joined #bitcoin-wizards23:53
-!- Alopex [~bitcoin@cyber.dealing.ninja] has quit [Remote host closed the connection]23:55
-!- mdavid613 [~Adium@cpe-172-251-161-231.socal.res.rr.com] has quit [Quit: Leaving.]23:55
-!- mdavid613 [~Adium@cpe-172-251-161-231.socal.res.rr.com] has joined #bitcoin-wizards23:56
-!- mdavid613 [~Adium@cpe-172-251-161-231.socal.res.rr.com] has quit [Client Quit]23:56
-!- Alopex [~bitcoin@cyber.dealing.ninja] has joined #bitcoin-wizards23:57
-!- tucenaber [~tucenaber@unaffiliated/tucenaber] has quit [Ping timeout: 264 seconds]23:59
--- Log closed Wed Aug 10 00:00:21 2016

Generated by irclog2html.py 2.15.0.dev0 by Marius Gedminas - find it at mg.pov.lt!