@teukon's observation seems relevant. However if Alice includes some random data along with her address, but Dave only publishes a list of addresses (without the extra random data) them Bob couldn't determine Alice's address.
This was my first thought. I checked out the paper to see if something along these lines had been included but found nothing. I'd add to this and suggest that all participants add some random data to each level of the layered encryption. If they add random data just to their address at the beginning, then Bob and Dave, working together, could determine Alice's (and therefore also Charlie's) address. There seems to be a misconception about encryption in general. Every secure* encryption scheme always uses randomness for the encryption to make sure that encrypting the same message twice does not yield the same ciphertext. This is exactly to exclude attacks like the one described above; such attacks are a general problem in cryptography, not only in this protocol. The added randomness is built in the encryption algorithm itself, one does not have to add randomness manually to the message before giving it to the algorithm. One typically leaves the randomness implicit: When I write enc(ek, m), I actually mean enc(ek, m, r), where r is fresh randomness. Try it: Take any encryption tool and try to encrypt the same message twice.  * This holds for every standard cryptographic definition of "secure". In particular, it holds for IND-CCA, the security definition that we require to be achieved by the used encryption scheme. Aha, ok. I suspected something like this had been baked in at a low level. I was just surprised when I didn't see something like your "enc(ek, m, r)" in Section 5.2, or a note in Section 5.1 explaining that this was included in the definition of "Enc", or even a note about this in the otherwise quite verbose Section 6.1 - Unlinkability. I think I was thrown off the scent a little by the use of "the ciphertext" from Section 5.1. We denote by Enc(ek; m) the ciphertext that encrypts the message m with the encryption key ek.
Anyway, thanks for the explanation. I was sure it wasn't a problem; I just wanted to understand. |
|
|
|
I think a trusted third party approach is required to nullify this attack...
Perhaps your idea of a trusted third party in this situation is just a special case of an honest 5th party, called Erik say. |
|
|
|
@teukon's observation seems relevant. However if Alice includes some random data along with her address, but Dave only publishes a list of addresses (without the extra random data) them Bob couldn't determine Alice's address.
This was my first thought. I checked out the paper to see if something along these lines had been included but found nothing. I'd add to this and suggest that all participants add some random data to each level of the layered encryption. If they add random data just to their address at the beginning, then Bob and Dave, working together, could determine Alice's (and therefore also Charlie's) address. I assume something in the presented method tackles this, for if everyone is able to rebuild and compare in this way, then there's simply no point to the layered encryption in the first place. Participants could pass unencrypted addresses with the same result. Another potential remedy is to undergo multiple rounds, where each participant has a chance to be somewhere in the middle of the chain. Assuming no more than one dishonest node, I'm fairly sure "maximum mixing" can be achieved in O(log(n)) rounds (where n is the number of participants) but it's not clear to me how devastating colluding members would be in this model. Clarification would be appreciated. |
|
|
|
If you have lots of users making tiny payments, why not look into a "probabilistic payments" algorithm. The idea is, instead of paying 100 satoshi, you pay 100`000 satoshi with a probability of 0.1% (some fun with crypto and proofs to be had here). This will reduce your Bitcoin footprint (and therefore fees) 1000-fold while having negligible effect on users.
That sounds like a good approach, I'll have to check it out ASAP, thank you for bringing it up. No problem. I think your situation is suitably uncommon/extreme that you won't find much more than theory. Try searching for things like "provably fair coin flips" in this sub-forum. If you do decide to take this route, some of the encryption techniques commonly used in provably fair gambling or decentralised mixing solutions could be useful too. I lack the time to create a working implementation myself (it's on my to-do list but quite low down), but might be able to help out if you have further questions. |
|
|
|
|
With reference to the overview diagram given above and assuming all participants are honest and all communications secure:
Once the procedure is complete and everyone receives the shuffled addresses from Dave, it appears that Bob can determine Alice's new address by encrypting each of the new addresses first with Dave's key, then with Charlie's, and comparing the results with the data he received from Alice. What is it that I'm missing?
|
|
|
|
|
If you have lots of users making tiny payments, why not look into a "probabilistic payments" algorithm. The idea is, instead of paying 100 satoshi, you pay 100`000 satoshi with a probability of 0.1% (some fun with crypto and proofs to be had here). This will reduce your Bitcoin footprint (and therefore fees) 1000-fold while having negligible effect on users.
|
|
|
|
|
I have to admit I expected to see Peter Todd on the list.
Also, you misspelled "Gavin Andresen" and "Erik Voorhees".
|
|
|
|
I would prefer this man to be the face of Bitcoin,  than this guy:  And I'd prefer this face  But even more, I'd prefer no face at all. |
|
|
|
All my fiat's value is simply being eroded by inflation and if the UK government defaults on its huge amounts of debt, the £ could be worth next to nothing.
Government default might be the best thing for the pound. Without the debt, the incentive to debase the currency is diminished. |
|
|
|
|
Wouldn't this just shift the focus from number of hashes to number of nodes?
|
|
|
|
My own idea of balancing social ideals and long term economic growth for everyone, is to favor consumption taxes, not taxes on capital.
Yes, this would probably do the US economy a lot of good (I'm not American). Alas, despite the popular belief in the USA that the rich escape taxation, the burden of local, state and federal taxation progressively falls upon the wealthy. Almost half of US citizens pay no federal income tax, and the poor, disabled and elderly especially profit from government transfer payments.
Yes it does. Not only do most of the rich work very productively to become so rich in the first place (making the country a better place), but they shoulder the lion's share of the tax burden, and have to endure great hatred by the masses. Although capital gains and estate taxes will gain revenue from the sudden new bitcoin $billionaires and $trillionaires, that tax revenue will be realized only when they sell or die. I have a belief, growing stronger, that holders will regard bitcoin as precious to the extent that many large holders will be loath to sell. An analogy would be medieval land estates - never sold, only inherited.
That is why I believe taxes on bitcoin holdings will follow the precedent set by taxes on land property here in the USA.
Is it a problem if most of all Bitcoin wealth is never used, only inherited? I don't see the problem. |
|
|
|
Note that I am for fair taxation
I think everyone is for "fair" taxation. The problem is that people disagree as to what is fair. - For some, no taxes at all is the only fair system.
- For some, Fair taxes are where everyone pays in the same amount.
- For some, flat taxes (everyone pays in the same percentage of their wealth) are ideal.
- Some hold that progressive taxes (where the rich pay not only more than the poor, but a larger percentage of what they have) are best.
- Some say that the more even the wealth distribution is, the fairer it is, with communism being the only truly fair system.
|
|
|
|
TL;DR: The number of bitcoin holders has just surpassed 2 million mark! The growth is happening in the holdings of 70 bitcoins or less, especially in micro-holdings of 1 bitcoin or less.
Great news. So Bitcoiners are now 0.03% of the world population. Imagine what could happen when 3% of the world population becomes Bitcoiners. The exchange value can increase by 10 to 100 times. Don't get too excited. Some of the data used to support the 2 million claim has turned out to be false (Mt.Gox sources). This estimate is likely to be revised downwards, heavily! I think the evidence points out to 700k-1M users but would like to hear comments on the methods and not just "voting on the results" |
|
|
|
Making money with money is basically unethical.
Wow! Could you expand on the logic behind this one? I'm not taunting; I'm genuinely interested. I've often found myself in the minority when it comes to morals. Recently here I've defended tax cheats, condemned selling general election votes, and defending pimping. I certainly don't wish to write off a seemingly bizarre ethical notion without giving the person claiming it a chance to defend it. Still, if you can defend this claim: Wow! |
|
|
|
Oh what fun!
I think it's wrong to sell one's vote (voting a certain way to receive money) but am interested to see how this plays out. Not only the voters. In India sometimes the minor political parties also indulge in vote selling. In a constituency where the winning margin is 1% or 2%, minor parties having 3% or 4% of the vote can sell their votes for hundreds of thousands of $$$. Cool! I wonder whether or not having a functioning market for votes improves the situation over there. |
|
|
|
I don't understand this feeling of being entitled to increase your wealth by, say, 100 or 1000 times in few years, by doing nothing and just holding bitcoin.
Question: Do you think it's ethical to buy a lottery ticket and hope that it pays off? If it does, is it ethical to collect your winnings? I know this is not exactly the same thing as Bitcoin, but I'd like to probe a little into the idea that it's wrong to increase ones wealth without being "productive". Another: Is it ethical to accept a large inheritance? What about a small gift? |
|
|
|
|
Oh what fun!
I think it's wrong to sell one's vote (voting a certain way to receive money) but am interested to see how this plays out.
|
|
|
|
Untangling the anonymity aspects of Bitcoin’s source code to conform to these laws is unlikely and improbable.
I truly hope so. which is why i'm expecting a ton of regulations.. they can't change what bitcoin is but they can regulate businesses/people that deal with bitcoin tho.. technically the regulators aren't regulating bitcoin.. they're just regulating those who use it I'm expecting a ton of regulations regardless. I don't see "they're just regulating those who use it" as much of a silver lining; it's the people that wish to use Bitcoin that I care about. To me, Bitcoin is more valuable if it allows a user to more easily conform with or evade regulations/taxes as they wish. Efforts to improve Bitcoin's soundness in this regard are to me second only to tackling the scalability/decentralization issues; such efforts quite easily earn my moral and financial support. |
|
|
|
“Never put all eggs in one basket”
What would you have me do? One basket for each egg?
|
|
|
|
Bitcoin will do the exact opposite of what you think it will do.
Who is "you"? You? No, I think "you" means you here. |
|
|
|
|
Show Posts
