I am sorry to have to explain this bad news to you, because I understand you have good intentions. It is better you know as early as possible. Apologies I didn't see your thread until now, otherwise I would have told you sooner.
It appears the technical design of this DarkCoin is fundamentally flawed and can't be fixed.
There must be some proof that senders sent transactions for all peers on the network to verify before they can accept the block and begin working on the next block solution. Such proof must exist otherwise balances could be stolen by rogue peers.
Thus I must assume you are doing a CoinJoin-like proof for all senders that in that block. And I assume these proofs are transmitted with the block, even if you purge them later (using a proof-of-work chain such as in the mini block chain design).
The problem is that CoinJoin is subject to denial-of-service attack in that if any sender fails to sign in the second step, then no senders can send.
Thus CoinJoin can't scale to a larger number of senders joined. It works best with a few senders and the probability of denial-of-service (rogue sender) is low.
My proposed solution to this issue is to have a deterministic master and slave node based on each block that is solved.
Any thing deterministic violates the Byzantine General's solution of proof-of-work and can be defrauded. What will happen is the fraudsters will game this deterministic selection to put themselves in control. Understand that the fundamental genius of Satoshi's invention is that nothing can be known about the next block winner a priori. I explained in great detail why all non-PoW systems, e.g. proof-of-stake, are thus not secure. If you introduce determinism (e.g. a pseudorandom number generator is controlled by whom ever controls the initial seed) then you've lost that key attribute of PoW w.r.t. to your use in controlling the denial-of-service of enjoining transactions in the CoinJoin algorithm.
When entering the pool, a user will be required to make out a multisig 2 of 2 payment to master and slave nodes. So for example, User A wants to pay User B 50DRK, to enter the pool the user must provide the 2 of 2 multisig transaction for $1 to the master and slave. Only in the case that the user doesn't provide outputs or sign will that check be cashed and it must be redeemed by both parties. This process would be deterministic and tamper proof and would add great cost to messing with the network.
I considered this approach and may have even written about it in my comments in the CoinJoin thread. I dismissed it because anything deterministic can be gamed. The problem of gaining consensus in untrusted networks is precisely what the Byzantine General's problem is all about. From 1975 when it was discovered no one had a solution until Satoshi published.
Not understanding this, is fundamentally not understanding Bitcoin and decentralized crypto-currency.
This is not a small mistake. It is fundamental.
And as far as I can see, most altcoins are created by amateurs who do not have the mathematical ability and should not be entrusted with such a task. Primecoin is an exception and a genuine advance, although I feel prime chains may be less secure due to the hidden order in them which could be found one day.
There is a second insoluble flaw that
CoinJoin does nothing to obscure IP address and thus you have no anonymity against powerful entities.
There is no reliable anonymity possible in Bitcoin against the NSA+GCHQ+G20 tax and law enforcement. Forget it.
There is anonymity in Bitcoin against other less powerful entities.
First off Darkcoin uses a peer-to-peer protocol layer for DarkSend, so the inputs/outputs/signatures are broadcast at different stages then relayed through the network. It’s impossible to tell if you’re getting the input/output/signature from the one who originated it. So you seem to be implying that some government would have packet sniffing technology recording everything happening in Darkcoin. That’s pretty crazy and far fetched and completely invalidated if your traffic is coming through encrypted channels.
No it is not crazy nor far-fetched.
https://blog.torproject.org/blog/one-cell-enoughLow-latency Chaum mix-nets are in fact very easy to foil with traffic analysis, sometimes even only needing to see the entry and/or exit nodes.
Encrypting the packets doesn't stop the traffic analysis from working. And especially so in this case, because the recipients (who can decrypt the packets) of the encrypted packets are not trusted websites, but rather untrusted nodes on the P2P network.
However, the goal of Darkcoin is not to do illegal things, the goal is to make a “dark blockchain” , that is less visible and improves privacy. I think you're taking this overboard. If you're wanting to do something and you're scared the government is going to put the pieces together then you shouldn't be doing it, that's not what this was designed for.
Okay if you are saying this is for anonymity against everything except the very powerful entities such as the intelligence services of governments, then I can agree with you that your mixer
probably adds anonymity (but I reserve a caveat that I haven't see your code nor all the details of your design in order to know if it might actually be worse, i.e. the security hole I mentioned above and ability of the I guess the pool to decrypt the packets).
But I am exactly concerned about the ability of governments to take over crypto-currencies due to the fact they can identify the owners of the coins. So for me, I am not satisfied with your design.
Also as I said above, you have a serious flaw in the security of your design.
This whole arguement is a false dichotomy, we're not talking black and white here but shades of grey. Darkcoin still adds 95% to the privacy of users and in the future that will only increase. I don't have the perfect solution, but I have the best one that currently exists. Darkcoin’s anonymity is still worlds ahead of every other crypto, so I’m not sure what you’re complaining about.
It adds probably only 5% if we are talking about the capabilities of the NSA. For less powerful adversaries, I can agree to the conceptual figure of 95%.
You are not ahead of my crypto on mixing. But mine is not released.
Show Posts
