From: Adam Back <adam@cypherspace•org>
To: Drak <drak@zikula•org>
Cc: "bitcoin-development@lists•sourceforge.net"
<bitcoin-development@lists•sourceforge.net>
Subject: [Bitcoin-development] reusable address privacy problems & fuzzy bait limitations (Re: Stealth Addresses)
Date: Thu, 16 Jan 2014 12:12:20 +0100 [thread overview]
Message-ID: <20140116111220.GA30175@netbook.cypherspace.org> (raw)
In-Reply-To: <CANAnSg0iE_ZdbXbkBwsafUJ6_ck4jETQM0o0RY-0am-o7=6Xbg@mail.gmail.com>
On Thu, Jan 16, 2014 at 10:14:24AM +0000, Drak wrote:
> On 16 January 2014 00:05, Jeremy Spilman <[1]jeremy@taplink•co> wrote:
> > Might I propose "reusable address".
>
> The problem is all addresses are reusable and to an average user,
> addresses are already reusable so there is little to distinguish the
> address format.
> It might be better to call it a "public address" in common terminology.
Yeah I called my variant "(unlinkable) public" but I also think I prefer
Jeremy's "reusable address" which has the added bonus of being yet another
implied admonishment not to reuse the non-reusable ones :)
Anyway my primary concern so far is that the reusable addresses/(unlinkable)
public addresses are actually worse for privacy than SPV bloom mechanism by
any reasonable definition. So I think we have some work to do yet, on a
tough problem which may not have an efficient index precomputable solution
(or a solution period.) I would also have been promoting this as an
alternative solution to bloom privcy mechanism and address-reuse, if I
could've found a mechansim for the unlinkable public proposal...
Whats different so far I think is that Peter just went with it anyway
despite that problem, where as I put it in the pile of interesting but not
quite workable for privacy reasons ideas. (Bearing in mind that my bloom
bait concept is the same as the prefix concept so I had functional
equivalence). The additional feature of Peter's variant is to stealthify
the payment, which I do think is a useful additioanl consideration, however
as I said I think its fair to say it so far largely fails to do that,
because the exposed P parameter. (And using the input instead of the P
parameter breaks CoinJoin, which is also thereby damaging to privacy).
So also about Greg Maxwell's improved prefix/bloom bait (lets call it fuzzy
bloom bait), while I agree that H(nonce)[rand(32)] ^ prefix is an
interesting incremental improvement, over raw bloom bait/prefix (with an
example 8-bit prefix, and [] being byte index, ^=xor), it is
index-precomputable, but it still publicly allows statistical elimination
which is still nearly as dangerous in lieu of the remarkable success people
have had doing statistical network flow analysis. ie with probability
(255/256)^32=88% it eliminates you as a payee of any given reusable payment.
(And that effect remains with any parameter set and conflicts with bandwidth
efficiency for the requestor - ie lower elimination probability seems
unavoidably to imply higher false positive match, right down to the point of
downloading the entire set, giving with 0 probability).
Thinking-hats time people.
(As I said I still like reusable-addr for full-node recipient scenarios.)
Adam
next prev parent reply other threads:[~2014-01-16 11:12 UTC|newest]
Thread overview: 87+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-01-06 12:03 [Bitcoin-development] Stealth Addresses Peter Todd
2014-01-08 10:20 ` Jeremy Spilman
2014-01-10 10:20 ` Peter Todd
2014-01-10 11:28 ` Drak
2014-01-10 12:00 ` Peter Todd
2014-01-12 10:33 ` Jeremy Spilman
2014-01-12 12:51 ` Mike Hearn
2014-01-12 18:20 ` Jeremy Spilman
2014-01-12 18:26 ` Mike Hearn
2014-01-13 9:13 ` Jeremy Spilman
2014-01-14 14:15 ` Peter Todd
2014-01-14 17:54 ` Odinn Cyberguerrilla
2014-01-12 21:18 ` Gavin Andresen
2014-01-13 9:52 ` Gregory Maxwell
2014-01-13 10:39 ` Mike Hearn
2014-01-13 13:37 ` Roy Badami
2014-01-13 15:58 ` Mike Hearn
2014-01-13 20:11 ` Roy Badami
2014-01-14 22:53 ` Roy Badami
2014-01-15 0:19 ` Drak
2014-01-15 20:22 ` Ben Davenport
2014-01-15 20:38 ` Gregory Maxwell
2014-01-15 20:44 ` Jeff Garzik
2014-01-15 22:38 ` [Bitcoin-development] Static addresses on chains encouraging address *RE* use Troy Benjegerdes
2014-01-15 23:01 ` [Bitcoin-development] Stealth Addresses Mike Hearn
2014-01-15 23:04 ` Roy Badami
2014-01-15 23:07 ` Jeff Garzik
2014-01-15 23:17 ` Roy Badami
2014-01-15 23:19 ` Roy Badami
2014-01-15 23:09 ` [Bitcoin-development] unlinakble static address? & spv-privacy (Re: Stealth Addresses) Adam Back
2014-01-16 1:02 ` Jeremy Spilman
2014-01-16 1:32 ` Gregory Maxwell
2014-01-18 17:44 ` Troy Benjegerdes
2014-01-18 20:25 ` Christophe Biocca
2014-01-20 11:11 ` Peter Todd
2014-01-21 4:00 ` Jeremy Spilman
2014-01-24 9:17 ` Peter Todd
2014-01-16 11:42 ` Adam Back
2014-01-16 18:19 ` Troy Benjegerdes
2014-01-16 0:05 ` [Bitcoin-development] Stealth Addresses Jeremy Spilman
2014-01-16 0:10 ` Gregory Maxwell
2014-01-16 0:24 ` Mark Friedenbach
2014-01-16 0:44 ` Eric Martindale
2014-01-16 6:26 ` Gary Rowe
2014-01-16 9:48 ` Wladimir
2014-01-16 1:16 ` Odinn Cyberguerrilla
2014-01-16 10:14 ` Drak
2014-01-16 10:19 ` Mike Hearn
2014-01-16 11:12 ` Adam Back [this message]
2014-01-16 21:28 ` Peter Todd
2014-01-17 2:30 ` Johnathan Corgan
2014-01-17 3:13 ` Jeremy Spilman
2014-01-17 7:49 ` Drak
2014-01-17 9:15 ` Mike Hearn
2014-01-17 9:19 ` Mark Friedenbach
2014-01-17 9:23 ` Natanael
2014-01-17 9:59 ` Drak
2014-01-17 20:16 ` Cameron Garnham
2014-01-17 14:46 ` Peter Todd
2014-01-17 19:21 ` Ben Davenport
2014-01-18 4:55 ` Alan Reiner
2014-01-18 5:09 ` Gregory Maxwell
2014-01-18 23:12 ` Jeremy Spilman
2014-01-18 23:50 ` Gregory Maxwell
2014-01-20 11:08 ` Peter Todd
2014-01-13 19:53 ` Roy Badami
2014-01-13 19:57 ` Mike Hearn
2014-01-13 20:01 ` Roy Badami
2014-01-13 19:40 ` Roy Badami
2014-01-13 19:44 ` Drak
2014-01-13 19:59 ` Alan Reiner
2014-01-13 20:10 ` Gregory Maxwell
2014-01-13 20:15 ` Peter Todd
2014-01-13 22:02 ` Jeremy Spilman
2014-01-14 14:19 ` Peter Todd
2014-01-14 19:12 ` Jeremy Spilman
2014-01-14 20:48 ` Peter Todd
2014-01-14 21:51 ` Adam Back
2014-01-14 22:34 ` Jeremy Spilman
2014-01-13 20:14 ` Peter Todd
2014-01-13 20:41 ` Alan Reiner
2014-01-13 20:47 ` Gregory Maxwell
2014-01-13 21:02 ` Roy Badami
2014-01-13 21:15 ` Alan Reiner
2014-01-13 21:27 ` Peter Todd
[not found] ` <op.w9ne31oqyldrnw@laptop-air.hsd1.ca.comcast.net>
2014-01-14 12:10 ` Peter Todd
2014-03-06 12:23 ` Dan Carter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140116111220.GA30175@netbook.cypherspace.org \
--to=adam@cypherspace$(echo .)org \
--cc=bitcoin-development@lists$(echo .)sourceforge.net \
--cc=drak@zikula$(echo .)org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox