Do people know how money is printed? But that does not stop notes from being an easy to use tool.

The underlying principle of this idea is not easy to understand. But to use it, you don't have to understand everything. In most cases, you just check wether it looks good or not like you check notes. And you will rarely need to use an Android phone with an easy to use app to tap it and the app will tell you how much Litecoin this card contains. You don't need any username or password. Just tap it. Nothing is really complicated, right?

I still go back to China sometimes. I know how convenient it is to use WeChat or Alipay. But cash is still a very important part of our daily lives. Do you know that in China there is still a big proportion of people that don't know how to use Internet? They don't even know how to use a bank ATM card. They have no idea of what username and password are. How do you expect them to understand something like Litecoin if it is not in a physical form? Even many of my college classmates in computer science major think it's complicated to use. Maintaining a wallet for normal users is a big headache. What if they lose their phone or wipe their hard disk? Do you expect everyone to know how to backup a wallet properly? How many Bitcoins were reported to be lost because of backup issues?

You can also read this article https://www.reddit.com/r/litecoin/comments/5518gc/bringing_litecoin_to_the_masses/ written by a guy who knows the situation in South America.

Yes, all these will be improved in the future. But this is the situation right now. Whether you like it or not, you just cannot expect everyone is as smart and well educated as you. And physical Litecoin is definitely suitable for this situation. Are we going backwards in time? No, we are just trying to satisfy users' need.

Also, given the low cost of it, what can be wrong of doing it?

Also, it's a better replacement for OpenDime.

I just don't buy your logic. Privacy is important to many other people although it may not be important to you. But how do you handle fungibility? You don't need fungibility as well?

no feedback?

It can also be used as kind of commemorative coins. Perhaps we can make some for the 5th anniversary Litecoin?

Litecoin is not even considered an altcoin in China. So it's not second-rating altcoin.

Red envelope could be a very good way between younger generations.

Those who are not very familiar with Internet can buy these as an investment like gold.

You don't know how popular LTC is in China.

Verification of the private key can be easily done by using a smart phone send a string to the smart card to sign. If the smart card produces a valid signature, and the signature's corresponding address contains so much Litecoins, then it is good. Because the communication is done through NFC, it is very convenient.

This is not divisible like cash. They can give you smaller ones as changes.

LoafWallet, Jaxx, and soon a few hardware wallets.

Hard-to-fake and tamper-evident envelopes that contain Litecoin private keys can be used as cash and could enable easy adoption of Litecoins. Two versions are proposed: one is easy to use and cheap but less secure; the other is based on smart cards, which offers very high security and convenience and still remains cost effective.

1. EASY AND CHEAP VERSION
1.1 Description
On the surface of the envelope, there should be some textures like those on dollar notes to prevent it from being faked and the amount of Litecoins contained in the private keys to indicate the value it contains. The technology involved is called Security Printing [1]. The cost of printing one piece can be as low as 0.18 USD [2].

In most cases, you just need to check the appearance of the envelop like you check notes to make sure it is not faked. If you don't trust, you can simply open it and check the private keys.

1.2 Legal Status
Although purchasing from stores using these envelopes could cause legal issues, trading them between fiat money is no different from trading LTC directly and thus should have no problem. Interestingly, in many countries including the U.S, using this as currency can actually be legal [3, 4, 5].

1.3 Discussion
The advantages are: It is cheap. It works like cash and requires no mobile devices in most cases, so it is easy and convenient to use.
While dollars are used to be backed by gold but got changed later, this kind of Litecoin backed envelops are always backed the Litecoins contained inside. Moreover, the fact that those Litecoins can easily be redeemed gives it a big advantage compared with other private currencies like Digital gold currency [5].
Envelopes are just a metaphor. As long as we hide the private keys in a tamper evident way and we use security printing to prevent faked ones and we make them durable and easy to carry, we should be good.

2. ADVANCED BUT STILL COST EFFECTIVE VERSION
2.1 Description
For higher value ones containing like more than 10 Litecoins, we can create a more secure version using smart cards.
Instead of directly putting the private key of the Litecoins inside the envelope, we put inside the envelope a password and a NFC based smart card containing 1) the private key of the Litecoin, and 2) the private key of the issuing organization. We design the smart card in such a way that to read the private key of the Litecoins from the smart card, you will need the password contained in the envelope, and once the read is finished, the private key of the Litecoins will be automatically destroyed by the smart card immediately. So you cannot read the private key twice from the smart card.

Then, without opening it, we can use a mobile phone to verify that the envelope is indeed produced by the organization because it signs using the issuing organization's private key. Also, we can verify that the smart card indeed contains so much Litecoins because it signs using the private key of the Litecoins.
Also, we can see the envelope and the smart card need to be used together to retrieve the Litecoins. Without the envelope, you lack the password to retrieve the private key from the smart card. Without the smart card, the password inside the envelope is simply useless.

2.2 Discussion
The envelope including the password is required. There are two cases if we use only a smart card without the envelope.

• If any user can read the private key from the smart card, the smart card is basically useless. It's the same as printing out the private key on a paper and send it directly to another guy.
• If the private key in the smart card cannot be read by anybody and can only be used to sign, people then need to absolutely trust the issuing organization that it does not write the same private key into multiple smart cards.

Faking/duplicating the smart card is impossible as you don't have the private key of the organization. Opening the envelope and retrieve the private key of the Litecoins and then put the smart card into a faked envelope will not work as the private key has already been destroyed after you read it, so a mobile phone can verify that easily. And normal envelopes can be used. There is no need for money printing technologies.
For normal paper wallets or the one above, once you verify, they cannot be used anymore as you've already got the private keys. But it is good for small amounts.

Mobile wallets need network connection to send and receive Litecoins. It's good when both you and the receiver have network connection and wallets.

With this, the sender needs no network connection. And the receiver can verify within 2-3 seconds both the amount and the issuing organization if he/she has network connection. If there is no network connection, the receiver can still use a phone to verify whether it is from a trustworthy organization or not. If it is from a trustworthy one, and if the envelope seems OK, the receiver can pretty confidently accept it if the amount is within a few hundreds of dollars.

Many Chinese guys just want to buy Litecoins and store there and wait for the news about Litecoin price. It should be as easy as buying and storing gold. Right now, it's too difficult for them to download a mobile wallet and generate an address. And they have no idea about how to use a wallet securely. What if they lose their phones or reformat their hard disks? Making it physical is important. With this, they just need buy and lock them in their cabinets and forget about it.

Also, it provides absolute anonymity.

The cost of one smart card can be as low as 0.2 USD [6]. So the total cost should be less than 0.18 (security printing) + 0.2 (smart card) = 0.38 USD.

3. MAKE SURE NO ONE HAS EVER SEEN THE PRIVATE KEY
In Section 2, it appears that the issuing organization will have access to all private keys, which thus makes it the single point failure. Actually, it needs not be so. When the smart card is initialised, it randomly generates a password, which can be read out once and written down on the inside of the envelope, then it generates a pair of Litecoin public key and private key itself and keep the private key confidential until someone uses the password to retrieve it, upon which the private key gets destroyed as described in Section 2.

Therefore, during this setup process, no one has access to the Litecoin private key including the issuing organization, and thus this solves the Schrodinger's private key problem.

The organization can still keep the password and thus is able to read out the private key without tampering the envelope. But they need to have physical access to the smart card, which makes the whole process much harder. To make this process even harder, we can use very short range contactless smart cards, so a guy passing by is unlikely to get your private key. As always, you can use your smart phone to check whether it still contains a valid private key or not without opening the envelope or connecting to the Internet within seconds.

In this case, the issuing organization is needed only to make sure the security printing format is standardised and well accepted. It is not convenient to have too many kinds of envelopes.

4. COMPARISON WITH OPENDIME
https://opendime.com/ offers a USB based device that has less functionality but much higher cost. Basically, the USB device randomly generates a Bitcoin public/private key pair and the private key is kept secrete until you break the USB device physically. But because it is based on USB, it cannot work with phones conveniently. This is especially inconvenient when you are receiving it but have no computer to verify the Bitcoins inside it.

Please notice that the ideas above shall not be used commercially without a consensus. Opensource efforts are welcome. Thanks.

References
[1] https://en.wikipedia.org/wiki/Security_printing
[2] http://dgyongsheng.en.made-in-china.com/product-group/qehQugzjCRcB/Coupon-vouchers-security-printing-catalog-1.html
[3] https://en.wikipedia.org/wiki/Private_currency
[4] http://www.treehugger.com/culture/how-to-print-your-own-money-build-community-not-get-arrested-by-the-feds.html
[5] https://en.wikipedia.org/wiki/Digital_gold_currency
[6] https://www.alibaba.com/trade/search?fsb=y&IndexArea=product_en&CatId=&SearchText=contactless+smart+card

For someone who thinks fungibility is still a problem, check a new article that I just wrote: https://bitcointalk.org/index.php?topic=1635845.0

CT and onchain CoinJoin together can give Litecoin really good privacy.

Introduction
CoinJoin provides a useful, non-intrusive, and convenient way for anonymizing transactions by mixing users' inputs and outputs in one transaction and thus obfuscating the source and destination of each individual user's transaction. Although current CoinJoin protocol can work in a decentralised way, it becomes convenient only when there is a central server. However such centralised service faces potential legal issues and service maintenance time, which limit its availability.

In this article, we introduce a fully decentralised and always available onchain CoinJoin service based on the Litecoin blockchain.

Method
The main idea is to use the always online Litecoin blockchain to facilitate communication between users that want to conduct CoinJoin together. It works as the following.

Phase 1
Each user submits their request including the source address and the amount of Litecoins they want to mix to the Litecoin blockchain. This can be done by sending to the blockchain an OP_RETURN transaction with a mark indicating that this is a CoinJoin request. The source Litecoin address of the OP_RETURN transaction needs to be the one containing the Litecoins to be mixed.

In order to collect enough requests, phase 1 ends after a fixed number of Litecoin blocks are generated, e.g. 5 blocks.

Phase 2
In this phase, an unsigned transaction including all inputs and outputs need to be created. To break the tie, this is done by the one who sends the last request in Phase 1.

Please notice that in Phase 1, each user does not need to include the destination Litecoin address in the OP_RETURN data. This is because once the address is included, everyone will be able to see the destination, and thus it defeats the purpose of CoinJoin.

To solve the problem, the transaction creator generates an address for each user, and makes sure this user is also the only one knows the private key of the newly generated address. This can be done in the following way:

Suppose Litecoin's elliptic curve base point is G, and the public key of this user's Litecoin address is P. The transaction creator randomly chooses a random non zero integer a and calculate aG + P, which is the pub key of the new address, and then takes HASH160 of the pub key and gets the new address.

Please also notice that if the original private key for P is x, i.e. P = xG, the private key for the new address is then x + a, because (x+a)G = P + aG.

To tell this user his/her new address, the transaction creator still needs to send him/her a in a secrete way. This can be done by encrypting a using the user's public key first and then including the encrypted a in a OP_RETURN output immediately after the normal output for this user.

This phase should be fast because it only requires an OP_RETURN transaction containing the unsigned transaction including all users' inputs and outputs and all encrypted as. Suppose the number of blocks this phase takes is 1.

If after one block there is no transaction created, to avoid DDoS attack, the one before the last one should create the transaction excluding the last one's input and output. This should continue until the transaction is seen on the blockchain.

A small fee can be paid to the transaction creator to motivate the user to complete the whole process.

Phase 3
Every user checks whether he/she is included in the outputs with the correct amount or not. If everything is OK, the user signs the transaction and send the partially signed transaction to the blockchain using another OP_RETURN transaction.

This phase can take 1 block. If anyone refuses to sign, to avoid DDoS attack, his/her input and output should be excluded from the transaction and a new transaction should be created in the next block. This continues until everyone signs the transaction.

Phase 4
The user who created the transaction in Phase 2 collects all signed transactions and combine them into a complete signed transaction and broadcast it to the Litecoin network. Actually this step can be done by anyone, so no DDoS attack is possible.
For this phase, one block should be needed.

Discussion
In the above description, one round starts immediately after the end of the previous round. However, pipelining and parallelism can be used to boost the throughput of this protocol. The length of each phase can be modified accordingly during implementation.

Confidential transactions (CT) do not hide the source of a transaction, while this onchain CoinJoin can. Therefore, the two can complement each other and can be used together to enhance privacy.

The main reason is that I believe in Litecoin so I invested quite a lot personally.

No, I consider no interest of Coinut when I am working on Litecoin. You worried too much about it. I am not like Blo****em guys.

Nope. Did you read the ratings and my answers? It's not easy to run a business with 100% customer satisfaction.

Reusing Litecoin addresses reduces privacy. There is an effective way for avoiding that. Suppose your friend gives you an address L already used to send out transaction, and thus its pub key is known, denoted as P.

Then you can generate a new address for him to avoid using the old one following the method below. And only he knows the private key of the new address.

Suppose Litecoin's elliptic curve base point is G. Then you randomly choose a number a, and calculate aG + P, which is the pub key of the new address, and then take HASH160 of the pub key and you get the new address.

After sending Litecoins to the new address, you tell him a. And then he can calculate the new private key as x+a, where x is the private key of the original address L.

The reason is: since the original private key for P is x, i.e. P = xG, the private key for the new address is then x + a, because (x+a)G = P + aG.

Next, I am going to introduce how to use this trick to create a decentralised Litecoin Blockchain based CoinJoin service for Litecoin.

We have a well accepted innovation plan. But execution is surely the most important part! So we are now focusing on coding, and Charlie Lee will lead. Updates will be published frequently. As usual, C++ programmers are welcome to join! Let's make Litecoin even more awesome! Guys, stay tuned!

Research on confidential transactions (CTs) is being continued. As we think the theory behind it is solid enough for implementation, we start to think about the detailed plan.

Confidential transactions have been implemented in the Elements Alpha project [1], which is intended to work as a sidechain of Bitcoin eventually. While I personally feel sidechains are very useful, CT is much more convenient to use when it is integrated into the Litecoin main chain. And because we now have reference code done by the Elements Alpha project, implementing CT on Litecoin probably becomes much easier.

According to [2], we will need SegWit to implement CT as a softfork. This should not be too far away because we are planing to release a new Litecoin Core with SegWit soon.

Confidential transactions will increase the size of the Litecoin blockchain, but there is no need to worry much about it. Although each confidential transaction has a nearly 1.8 KB proof (the total transaction size is a little bigger than that), which is quite a few times bigger than a normal transaction, since it can be put into the witness part by modifying the current SegWit slightly [2], the actual number of transactions of each block will not decrease much. Of course, more disk space will be needed to hold the whole blockchain, but that should not be a big problem given the cheap hard drives. Also, more transaction fee may be charged for a CT.

When we were researching CT and checking its cryptography method, we saw elliptic curve is being used, which is not quantum resistant. This may not be a problem in the near future, but given the fast pace in the quantum computing field [3], we may have to plan ahead. Upgrading CT to a quantum resistant version, i.e., quantum resistant confidential transaction or QRCT named by @coblee, is possible by replacing the elliptic curve based method with quantum resistant ones like lattice based methods.

Further on, we realised that Litecoin itself is also not quantum resistant, because spending coins requires putting the public key in the transaction, and a quantum node can discover the private key based on the public key and modify the transaction's destination address. But this can be fixed without much effort [4].

The ideas about quantum resistance above are obviously still in a very early stage. However, given that all the upgrades can be implemented as soft forks, we see no reason that they are something unrealistic. Actually, we see very good hope that Litecoin could take the initiative and lead the whole blockchain community into considering this for the reason that Litecoin has a unified development team and a huge user base.

We need more developers. Please contact us if you are interested.

[1] https://elementsproject.org/
[2] https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2016-January/012194.html
[3] http://news.mit.edu/2016/quantum-computer-end-encryption-schemes-0303
[4] https://bitcoinmagazine.com/articles/bitcoin-is-not-quantum-safe-and-how-we-can-fix-1375242150

Litecoin, being a very successful digital currency, has many superior aspects than its predecessor Bitcoin such as faster confirmation time, nearly zero blockchain congestion, and no pre-mining. However, as we know, each Litecoin transaction consists of at least one input and output, and for now, the amount of each input and output is clearly shown to the public, causing privacy issues and potential loss of fungibility. To make Litecoin even more attractive as a digital currency, we are planning to add the confidential transactions feature into it.

The basic idea of confidential transaction is to obfuscate the amount of Litecoins in all inputs and outputs and at the same time guarantee all outputs equal to the inputs in a cryptographically verifiable way using a technique named Pedersen commitment. More details can be found in [1, 2, 3].

According to [1], confidential transaction requires only a soft fork, so the deployment requires only a consensus from the miners, and the resulting new Litecoin Core will be backward compatible. Therefore, confidential transactions is also the most practical way of upgrading the anonymity of Litecoin at this moment.

Ring signatures [3, 4] can further improve anonymity but requires a hard fork to our best knowledge, which thus requires an almost unanimous decision from the whole Litecoin community in order to avoid a split of the Litecoin blockchain.

Regarding the plan, @coblee has clearly shown his interest in supporting the confidential transaction feature, and I have been working on it since two weeks ago. Now that the survey has been done, we will come up with a concrete implementation plan as soon as possible. If anyone outside the Core team wants to participate, kindly contact us.

[1] https://bitcoinmagazine.com/articles/confidential-transactions-how-hiding-transaction-amounts-increases-bitcoin-privacy-1464892525
[2] https://people.xiph.org/~greg/confidential_values.txt
[3] https://eprint.iacr.org/2015/1098.pdf
[4] http://research.microsoft.com/en-us/um/people/yael/publications/2001-Leak_Secret.pdf

Right, check https://www.reddit.com/r/litecoin/comments/53c0v6/confidential_transaction_for_litecoin/