Dear all,
There is now a MW coinshuffle protocol[1] that claims to improve scalability over any other current true privacy preserving protocols by orders of magnitude. Because this protocol does not add any additional computational complexity to the MW Protocol and because it uses non-interactive proofs it will be faster and therefore more scalable than circuit evaluation based methods like Prio[2], we simply have an aggregated transaction that needs to be verified. The aggregation is now based on a 24 hour timeframe that can be brought down to hourly aggregations and possibly even down to the minute based on the amount of transactions. The above are my personal opinions and are not reflected of the original authors. Please join us in trying to break it.
Original Authors:
by John Tromp, antioch, oryhp, vegycslol
Quoting Dr. Tromp in a similar post:
Mimblewimble allows for a very simple coin shuffling protocol [1] with the following properties:
* Users submit self-spends throughout the day. No interaction needed for shuffling.
* Shuffling is performed at the end of the day by a set of mixnodes that cannot steal any coins.
* Invalid self-spends are automatically filtered out. No need to abort or restart the shuffling.
* As long as at least one mixnode is honest, then no one learns the input output links.
* The size of the shuffle is limited only by blocksize and could easily be over a thousand.
* Each shuffle only grows the chainsize by a small constant (~100 byte per mixnode), thanks to MW cut-through.
Widespread use of the protocol would leave the transaction graph mostly obscured.
We welcome review of the proposal.
[1]
https://forum.grin.mw/t/mimblewimble-coinswap-proposal[2]
https://crypto.stanford.edu/prio/paper.pdf
