CryptoNote technical discussion and Chess Challenge

[TPTB_need_war]

The inability to verify the number of coins in circulation with ZeroCoin scares me.  At least if something goes wrong with the money supply system with RingCT we would be able to tell.

[...8<...]

The relevant (to your stated concern) distinction from Zerocash (and a friendly reminder to not conflate Zerocoin with Zerocash because the former requires equal revealed values and doesn't integrate with hiding values) is that there isn't a global trusted master key (generated once at setup of the sytem) to be potentially abused (if the trusted setup was gamed some how). Yet in both systems, if you can muster enough computing resources even just once (and/or break/weaken the number-theoretic cryptographic assumptions security), you can create unlimited money out-of-thin-air and this can't be detected (unless detection means everyone has the same level of breakage capability and all values can be globally unmasked rendering value hiding useless).

Homomorphic values and ring signatures come with potentially huge anti-DDoS costs as I have been explaining in a thread I started in the Bitcoin Discussion forum. In that thread, I have alluded to we might be better off to just eliminate homomorphic (hiding) values and also eliminate Cryptonote's one-time ring signatures and move to something like CoinShuffle, because we are going to need to do a CoinShuffle any way. The details on this tradeoff need to be further mulled over and elucidated.

[...8<...]

Anonymity is very difficult to accomplish holistically especially at-scale (Monero is no where near accomplishing that at-scale) and it doesn't come for free.

[...8<...]

A generative essence realization is there is no possible way to obfuscate your IP address with an autonomous cryptographic protocol (such as RIngCT or Cryptonote). The only way to obfuscate IP addresses is with an interactive mixnet, which then either incurs a simultaneity requirement or the mixnet must generalize to many forms of internet traffic so a sufficient mix set always available. But especially generalized mixnets suffer from Sybil attacks because of the cost of scaling relaying nodes scales with traffic and DDoS. As smooth knows from our past private discussions (afair last year), my only idea on how to attack the Sybil problem of Tor and I2P is to pay the nodes you are want to relay through for an onion routing. But this comes with another set of holistic issues. So far, I haven't been able to design the system that is immune to the NSA. I am still working on this problem, but have deprioritized it, because to my consternation it is such an intractable quagmire (a.k.a. clusterfuck).

[...8<...]

[...8<...]

Well that is the sort of statistical pattern that I think it implausible to hide if the person who needs to know thus can afford the resources to know.

I don't think in this Technocracy age of Big Data, one can't hope to obscure patterns on large data sets. The generative essence of the implausibility is that the statistical patterns hidden at one layer, leak into the next layer, so it becomes a requirement for a globally leak-proof synergy of activity in cyberspace. It seems futile from that high-level perspective. And I stubbornly didn't want to accept that, but having really looked deeply at the technical issues, I now lean to that being the hard reality.

That is why I posit that the paradigm of wealth stored in forms that others can easily emulate, tax, and expropriate is dying.

[...8<...]

Zerocash does hide your identity on the block chain even if your IP address is correlated across multiple transactions that you send to the block chain, because in Zerocash the payer(s) and payee(s) are obscured and proven in a non-interactive zero knowledge proof (NIZKP). This is accomplished by proving that the machine ran a certain program (and no other program) on the inputs and that result was "true" (i.e. verified), rather than proving something algebraically about the variables to the program. This computational witness requires the global master key setup.

Whereas, Cryptonote one-time rings mix the payer amongst a group of payers with the requirement that it is publicly verifiable that each payer can only be spent one-time. The one-time key is manufactured by the Diffie-Hellman (ECDH) like exchange that creates a new stealth payee address on each spend and that stealth address can only be spent once. So the problem is that if your IP address is correlated across spends, it becomes possible to link stealth addresses together as the same payee and then start to unmask the anonymity set of the payer rings.

So it would seem that Zerocash is the solution, except read my discussion at the quoted link about anti-DDoS protection. The problem is the huge verification cost for each Zerocash transaction and thus giving the attacker a huge asymmetric advantage when sending invalid transactions, i.e. unprotected Zerocash can be DDoS'ed to death.

And if using my suggested technique to create a hash-based signature as a first line of verification of incoming transactions sent to the block chain, then you've got to incorporate a simultaneity mixnet such as CoinShuffle to detach these hash signatures (and the payee's IP address) from the Zerocash transaction being submitted to the block chain. But then your anonymity is reduced back to the mixnet again so you've lost the benefits Zerocash provides. Perhaps Zerocash could devise a quick check on invalid signatures. I don't enough about the "moon math" in the white paper to deduce whether that is possible, but I 95% doubt it based on my understanding that such NIZKPs are a holistic math affair.

Perhaps instead of my hash suggestion (and as suggested by Gregory Maxwell at the aforementioned linked thread), each Zerocash (or RingCT) could require some PoW be attached to every transaction to rate limit spam, but the problem is the attacker has an asymmetric advantage by being able to place his hashing resources in venues with the cheapest electricity (e.g. 3 - 4 cents per kWh in WA State or China near hydropower) and leverage the latest ASIC efficiencies whereas the legitimate payer is running on retail electricity that costs 4 times more and non-optimum hardware that is at at least an order-of-magnitude disadvantage in power and speed. So the delay (or the transaction fees if the full nodes speed more on hardware to increase their spam bandwidth) will increase for legitimate payers asymmetrically to the attacker's costs. And that asymmetry will be amplified by the systemic ratio of the resources of the legitimate payers to the attacker's resources, thus if the anonymous system is only used infrequently then the cost of using it will be radically amplified (perhaps too high to be of practical use, although I haven't done some sample calculations yet). And for the system to be widely used (e.g. for microtransactions) the extra costs imposed by the attacker disincentivize its use when the legitimate participants don't value anonymity as a concern. Also the PoW required could vary per full node and vary in time (even in real time!) depending which nodes are receiving the most incoming DDoS spam, which complicates the determination where to submit a transaction and how much PoW is required to be submitted with it. So then it appears any any such Zerocash + PoW anti-DDoS system is going to be used only for anonymous mixing and not all transactions, but then the problem is the anonymity leaks as these anonymous mixes are then traded for coins in a system that is used in everyday commerce (e.g. microtransactions).

Even though I haven't thoroughly understood every technical aspect of it, the other problem with Zerocash appears to be that it can't merge the entirely opaque block chains, e.g. if there are two major chains fork due to a network split. Transparent block chains can be re-merged to the extent that double-spends are not intertwined. The major fault for Zerocash (that is not present for transparent block chains) being that I believe it is not possible to prove which coins were double-spent on both of the block chains. Normally this isn't a problem for an orphaned chain because you just throw away the orphans, but this is perhaps a problem in a major network split.

[TPTB_need_war]

Disagree. Real business and corporate money will struggle greatly with transparent blockchains. They don't have the same exact privacy goals as individuals and freedom advocates, but they have their own. In particular, not wanting to be spied on by competitors nor front run in markets. That's why, for example, CT is critically important even in Blockstream's closed blockchain Liquid.

I believe you're saying that under an assumption that corporations will adopt a form of blockchain that is already available on the market. I'm not so sure. Banks and certain IT companies do express their interest in blockchain, but judging from what I've heard them talk, it's more about permissioned blockchains.

It is a entirely different paradigm of privacy. You still have blockchain, which is easily auditable and verifiable for any party that might have such rights, but a competitor would not be able to even connect to the blockchain.

I assume this may prove to be more efficient for corporate goals than using permissionless anonymous blockchains, or even permissioned anonymous blockchains. I don't see big urge for the companies to be adopting open blockchains or particular cryptocurrencies, at least for now. There are of course certain cases when that can still be beneficial (e.g. on-chain bonds for smaller companies).

To say it in another way, the technology has converged on the market, but its tested application seems to be diverging from the original libertarian/anarchistic/openness ideas proposed by free-thinkers. Well, the time will say.

However, a real huge problem is parallel to what we might be discussing here. I bet nobody can point to a company or a particular painful use case that CryptoNote or Monero can be serving. The real market I mean, not our dreams of such. We've all been involved in creating a new better economy, while the course of history shows that we rather need the traditional economy upgraded instead.

I am not trying to say that privacy is an irrelevant issue. It surely is. I'd agree with TPTB_need_war. The big data and surveillance may actually drag us into techodark ages. However, I don't see how private cryptocurrencies can be incorporated into real markets. There's no decabillion market value here. And unfortunately, I would remain pessimistic on the perspectives: I doubt that there will ever be such a market.

Your point about private block chains (which I don't think will work well for similar concerns that corporations are learning not to depend on closed source), ties back into another distinction I want to make about public block chains.

Hide Data, Not IP

If we accept my studied intuition (which I detailed over my past few posts in this thread) that anonymity is untenable (because leakage is catastrophic to the point of doing anonymity, i.e. anonymity assumes 100% perfection otherwise don't bother with the flimsy/undetectable assurance of it), this doesn't mean that for example Confidential Transactions (CT) hiding of value is untenable.

So in general the privacy we want, may be to hide the data and not who is doing it. This data can also leak into layers where it is not hidden, but that would be the same as what we have now in the current world.

So I have been thinking to give up on anonymity of IP addresses (and thus Cryptonote, RingCT, and the ring aspect of my Zero Knowledge Transactions are not needed), but retain end-to-end encryption of the data. CT enables hiding of the values that are being traded.

So the government can still identify who is making those transactions and compel you to reveal your private keys or face the gulag, but in the normal use of the public block chain privacy is retained (to the extent it doesn't leak into non-hidden layers but that is the current world situation any way, so no worse).

Governments and police agencies will feel less threatened, yet some of the NSA-gone-amok indiscriminate big data collection will be foiled (which is a good thing since that crap has been argued to be entirely ineffective and puts the data at-risk of abuse ... remember the stories of TSA agents masturbating to nude airport scanner images and also I believe I read about GHCQ collecting Yahoo Messenger videochats and perhaps some agents were growing hair on their palms as well).

I believe this epiphany (separation-of-concerns) is foundational and very important.

So next we try to find ways to hide the data of smart contracts on the block chain. Actually my Zero Knowledge Transactions white paper also has innovations on hiding value that are not present in CT nor CCT, so if those are correct, I am already making progress on this paradigm.

Mix Data, Not Identity

Perhaps if it is possible to somehow mix currency data with smart contract data, it would make each more fungible in the sense that one can't construct a blacklist based on IP address of who is sending to the block chain if they don't even know which class of data they are black listing.

Also in general, I explained in the thread I linked to (and my coming research writeup will explain in more detail) why blacklisting by IP address in untenable any way. Thus I think the argument that anonymity of IP is essential for fungibility is being vacated.

I need to write up all this in a more technically detailed exposition so I can see how it all fits together in detail. I may have holes in this high-level overview. For example, need to work through the details of how identity of payer and payee on a block chain differs from the notion of IP address identity.

[boolberry]

Current position
Based on the votes in this thread Team Monero has chosen to play Rf1. Now it is time for Team Boolberry to respond. I will plan to count votes again tomorrow at approximately 0:00 UTC.

Team Monero (white pieces) vs. Team Boolberry (black pieces)
black to move


Game PGN:

Code:

1.e4 c5 2.Nf3 d6 3.d4 cxd4 4.Qxd4 a6 5.c4 Nc6 6.Qe3 g6 7.Nc3 Bg7 8.Be2 Nf6 9.O-O O-O 10.h3 Nd7 11.b3 Nc5 12.Bb2 f5 13.exf5 Bxf5 14.Rad1 Qa5 15.Rd2 Rf6 16.Nd5 Re6 17.Qf4 Ne4 18.Bxg7 Kxg7 19.Rb2 Nc3 20.Nd4 Re5 21.Bf3 Nxd5 22.Bxd5 Qc3 23.Nxf5+ Rxf5 24.Qd2 Qxd2 25.Rxd2 Rb8 26.a3 e5 27.Be6 Rf6 28.Bd5 Nd4 29.b4 b6 30.Rb2 g5 31.a4 Rff8 32.Rfb1 Rfc8 33.f3 Kf6 34.g3 Rc7 35.Rf1

[languagehasmeaning]

Re8

It indirectly defends e2 for our knight (and therefore indirectly defends f4). I prefer Re8 over Re7 because if the g file opens later our c7 rook can move there while our b8 rook cannot (g8 is covered by whites bishop). Our most passive piece is currently our rook on b8.

1 vote Re8 (languagehasmeaning)

[languagehasmeaning]

This game of chess finally got interesting!   

It seems very even. The bishop is maybe slightly better than the knight but I doubt that it´s meaningful. I´d say a draw is practically certain.

Welcome to the game my friend. I agree it is getting more interesting but also agree with galdur that a draw is most likely if both sides avoid major mistakes.  There definitely are still some tricks in the position.

[galdur]

This game of chess finally got interesting!   

It seems very even. The bishop is maybe slightly better than the knight but I doubt that it´s meaningful. I´d say a draw is practically certain.

Welcome to the game my friend. I agree it is getting more interesting but also agree with galdur that a draw is most likely if both sides avoid major mistakes.  There definitely are still some tricks in the position.

Thank you. Nothing wrong with Re8 that I see but I´ll try Nf5. There could be some tricks if white plays f4 and the g-file opens.

1 vote Re8 (languagehasmeaning)
1 vote Nf5 (galdur)

[newb4now]

This game of chess finally got interesting!  

It seems very even. The bishop is maybe slightly better than the knight but I doubt that it´s meaningful. I´d say a draw is practically certain.

Welcome to the game my friend. I agree it is getting more interesting but also agree with galdur that a draw is most likely if both sides avoid major mistakes.  There definitely are still some tricks in the position.

Thank you. Nothing wrong with Re8 that I see but I´ll try Nf5. There could be some tricks if white plays f4 and the g-file opens.

1 vote Re8 (languagehasmeaning)
1 vote Nf5 (galdur)

1 vote Re8 (languagehasmeaning)
2 votes Nf5 (galdur, newb4now)

I like tricks in chess games!

[newb4now]

Whereas, Cryptonote one-time rings mix the payer amongst a group of payers with the requirement that it is publicly verifiable that each payer can only be spent one-time. The one-time key is manufactured by the Diffie-Hellman (ECDH) like exchange that creates a new stealth payee address on each spend and that stealth address can only be spent once. So the problem is that if your IP address is correlated across spends, it becomes possible to link stealth addresses together as the same payee and then start to unmask the anonymity set of the payer rings.

What is wrong with the planned solution of I2P integration to deal with this issue?

[smooth]

Whereas, Cryptonote one-time rings mix the payer amongst a group of payers with the requirement that it is publicly verifiable that each payer can only be spent one-time. The one-time key is manufactured by the Diffie-Hellman (ECDH) like exchange that creates a new stealth payee address on each spend and that stealth address can only be spent once. So the problem is that if your IP address is correlated across spends, it becomes possible to link stealth addresses together as the same payee and then start to unmask the anonymity set of the payer rings.

What is wrong with the planned solution of I2P integration to deal with this issue?

He doesn't think that I2P and Tor are NSA-proof. That's hardly an outlier point of view.

[boolberry]

1 vote Re8 (languagehasmeaning)
3 votes Nf5 (galdur, newb4now, boolberry)

[TPTB_need_war]

On the Cryptonote technical discussion and my recent thoughts about anonymity:

I also agree with anonymints recent line of thinking and thats what led me to code up private certificates with provable ownership and history with encrypted data to your public key!

Check out my implementation https://github.com/syscoin/syscoin/blob/devstaging-servicesync/src/cert.cpp

+1

I always experience a twinge of annoyance whenever I see a link like this.
Hey check out my cool idea.
Click link... Critical Error ... You lack the skills necessary to continue.

He should have a readme file if he doesn't already.

I believe the purpose of his work is to make it so you have a traceable HTTPS (TLS/SSL) certificate for a secure website which the NSA can't evesdrop on unless the authorities have issued a demand for your private key. It is well known that the NSA has probably backdoored most major HTTPS certificate companies, so they can snoop on encrypted traffic on the internet.

A certificate is an authority which says you can trust that the stated public key is the entity it claims to be.

I should explain more technical details of that to you, but I don't have the time to type it up.

P.S. now you know how I feel when I encounter math notation that I am not familiar with. Arghh. I can easily understand the concepts, but the notation is the barrier. I have been gradually pulling myself back up to speed on math notation, remembering some that I had forgotten (e.g. from Linear Algebra) and learning that I hadn't studied (e.g. that which comes from higher maths in number theory and algebraic geometry).

[boolberry]

20 more minutes until the current vote is final.

Check this game out. It just got really interesting IMHO. Should team bitcoin accept the exchange sacrifice? We chose the Marshall Attack so that we could be the the aggressor but the last move of letsplayagame 18.a4 caught me (and probably others) by surprise:

https://bitcointalk.org/index.php?topic=1148538

[boolberry]

1 vote Re8 (languagehasmeaning)
3 votes Nf5 (galdur, newb4now, boolberry)

Current position
Based on the votes in this thread Team Boolberry has chosen to play Nf5. Now it is time for Team Monero to respond. I will plan to count votes again tomorrow at approximately 0:00 UTC.

Team Monero (white pieces) vs. Team Boolberry (black pieces)
white to move


Game PGN:

Code:

1.e4 c5 2.Nf3 d6 3.d4 cxd4 4.Qxd4 a6 5.c4 Nc6 6.Qe3 g6 7.Nc3 Bg7 8.Be2 Nf6 9.O-O O-O 10.h3 Nd7 11.b3 Nc5 12.Bb2 f5 13.exf5 Bxf5 14.Rad1 Qa5 15.Rd2 Rf6 16.Nd5 Re6 17.Qf4 Ne4 18.Bxg7 Kxg7 19.Rb2 Nc3 20.Nd4 Re5 21.Bf3 Nxd5 22.Bxd5 Qc3 23.Nxf5+ Rxf5 24.Qd2 Qxd2 25.Rxd2 Rb8 26.a3 e5 27.Be6 Rf6 28.Bd5 Nd4 29.b4 b6 30.Rb2 g5 31.a4 Rff8 32.Rfb1 Rfc8 33.f3 Kf6 34.g3 Rc7 35.Rf1 Nf5

[XMRpromotions]

36.Kf2

At first glance it appears forced. There are no other good alternatives to prevent both Nxg3 and Ne3

[ArticMine]

36. Kf2

[TPTB_need_war]

Question for languagehasmeaning, if he is willing to answer. Or anyone who can offer an insight for me.

I am curious. How many moves ahead can you calculate all the possibilities? And is that even a useful computation in playing the game, or is the useful computation probabilistic? Apologies I am ignorant and I am curious about from someone of your caliber, what you can actually do mentally that enables you to win. I suppose I could learn this from books and I haven't researched it.

[languagehasmeaning]

Question for languagehasmeaning, if he is willing to answer. Or anyone who can offer an insight for me.

I am curious. How many moves ahead can you calculate all the possibilities? And is that even a useful computation in playing the game, or is the useful computation probabilistic? Apologies I am ignorant and I am curious about from someone of your caliber, what you can actually do mentally that enables you to win. I suppose I could learn this from books and I haven't researched it.

That is a common question with no easy answer.

Short answer: As many moves as is required for me to evaluate the strength of one move compared to the most promising alternatives in the current position.

Long answer: It really is situation specific. If there is a forced checkmate in 3 moves I will likely find it and my answer will be 3. In a king and pawn endgame I often may calculate 10-15 moves ahead (I will stop my calculation once it appears that one side will be able to promote a pawn while the opponent cannot or once it is clear that neither side can make progress).  In the current game if I was on the Monero team my answer might be 2 or 3 moves as that is really all that is required to reject the alternative moves as inferior to Kf2.  If I have a king and two bishops against a king I will win easily without much thought. If I have a king, bishop and knight against a king I will win but will think more carefully (more moves ahead) to ensure I win before the 50 move rule applies (some K+B+N vs K positions require over 30 moves to force checkmate with perfect play).

Early in a game there really is no answer (you may have the first 20 most popular moves of a common opening memorized but you are not "calculating" that over the board and you cannot memorize all the possible alternatives to that variation. Being able to play an entire game in your head (which I and many others can) does not mean you can calculate to the end because there are far too many possibilities for anyone to calculate:
https://en.wikipedia.org/wiki/Shannon_number

Of course the Shannon number discussed above includes many ridiculous moves that do not merit calculation. I seriously doubt anyone on team Monero wasted any time looking at 36.Bf7. Similarly in a game most possible moves are rejected instantly (based on the experience of the player) as not being worthy of thought. Nevertheless there will always be too many possibilities to look at every reasonable variation in most positions: https://www.youtube.com/watch?t=650&v=Km024eldY1A

When there are many reasonable possibilities to consider calculating one unforced line 20 moves ahead is wasteful if there were multiple promising variations that could have forked from that variation on move 5. If you see a sacrifice that will surely lose unless you can force checkmate, that would be an appropriate time to calculate as far ahead as possible. Some players do not like sacrificing material unless they can calculate a positive result. Others such as Mickal Tal have no problem doing so, frequently relying on his intuition in cases where he could not calculate everything in advance. https://en.wikipedia.org/wiki/Mikhail_Tal

In general it is easier to calculate many moves ahead when the line is forcing (a king is being chased around with checks, is in danger of being checkmated, or necessary captures are being made) or if there is limited material remaining than when there are many plausible options for either side. Because of the time limit in chess games, it is wasteful to calculate as far ahead as you can on every move.  

If you ask a computer to find the best moves in a game that a strong player is already winning, the computer will often find a line that wins faster. This does not prove the human was incapable of finding the optimal variation. It just means that once a human finds a forced win they will often stop thinking and play the winning variation they found instead of wasting time to find something better. Winning is good enough.

[8XMR]

Kf2

[LucyLovesCrypto]

4 votes for Kf2: XMRpromotions, ArticMine, 8XMR, LucyLovesCrypto

[languagehasmeaning]

20 more minutes until the current vote is final.

Check this game out. It just got really interesting IMHO. Should team bitcoin accept the exchange sacrifice? We chose the Marshall Attack so that we could be the the aggressor but the last move of letsplayagame 18.a4 caught me (and probably others) by surprise:

https://bitcointalk.org/index.php?topic=1148538

This may be relevant to the TPTB question. It is hard to calculate all possible variations far enough ahead to say decisively that Bxe4 is a mistake. So while I may be able to calculate certain lines many moves ahead, there are too many possible lines for me to evaluate them all thoroughly. Instead will cast my vote based on intuition. My intuition tells me white will have more than sufficient compensation for the exchange sacrifice after Bxe4.