sipa changed the topic of #bitcoin-wizards to: This channel is for discussing theoretical ideas with regard to cryptocurrencies, not about short-term Bitcoin development | http://bitcoin.ninja/ | This channel is logged. | For logs and more information, visit http://bitcoin.ninja
rusty has quit [Read error: Connection reset by peer]
rusty2 has joined #bitcoin-wizards
Zenton has quit [Ping timeout: 268 seconds]
rusty2 has quit [Ping timeout: 250 seconds]
AaronvanW has joined #bitcoin-wizards
AaronvanW has quit [Client Quit]
Aaronvan_ has quit [Ping timeout: 240 seconds]
nephyrin has quit [Ping timeout: 240 seconds]
nephyrin has joined #bitcoin-wizards
Chris_Stewart_5 has quit [Ping timeout: 245 seconds]
Chris_Stewart_5 has joined #bitcoin-wizards
pinheadmz has quit [Quit: pinheadmz]
Chris_Stewart_5 has quit [Ping timeout: 245 seconds]
Dean_Guss has quit [Ping timeout: 256 seconds]
tomtau[m] has joined #bitcoin-wizards
jtimon has joined #bitcoin-wizards
_whitelogger has joined #bitcoin-wizards
Spartan54 has quit [Client Quit]
pinheadmz has joined #bitcoin-wizards
pinheadmz has quit [Quit: pinheadmz]
sipa has quit [Remote host closed the connection]
sipa has joined #bitcoin-wizards
Murch has quit [Quit: Snoozing.]
Dean_Guss has joined #bitcoin-wizards
Murch has joined #bitcoin-wizards
TheoStorm has quit [Quit: Leaving]
pinheadmz has joined #bitcoin-wizards
Murch has quit [Quit: Snoozing.]
Belkaar has quit [Ping timeout: 244 seconds]
Belkaar has joined #bitcoin-wizards
Belkaar has quit [Changing host]
Belkaar has joined #bitcoin-wizards
Krellan has quit [Remote host closed the connection]
spinza has joined #bitcoin-wizards
pinheadmz has quit [Quit: pinheadmz]
alferz has joined #bitcoin-wizards
thomasan_ has joined #bitcoin-wizards
thomasan_ has quit [Remote host closed the connection]
alferz has quit [Ping timeout: 240 seconds]
Sam_ has joined #bitcoin-wizards
Sam_ has quit [Client Quit]
mn3monic has quit [Ping timeout: 250 seconds]
mn3monic has joined #bitcoin-wizards
hardforkthis has quit [Remote host closed the connection]
hardforkthis has joined #bitcoin-wizards
mn3monic has quit [Ping timeout: 252 seconds]
mn3monic has joined #bitcoin-wizards
mn3monic has quit [Ping timeout: 250 seconds]
mn3monic has joined #bitcoin-wizards
kenshi84 has quit [Ping timeout: 250 seconds]
kenshi84 has joined #bitcoin-wizards
pinheadmz has joined #bitcoin-wizards
kenshi84_ has joined #bitcoin-wizards
kenshi84 has quit [Ping timeout: 252 seconds]
go1111111 has quit [Ping timeout: 250 seconds]
go1111111 has joined #bitcoin-wizards
sdf_ has joined #bitcoin-wizards
sdf_ has quit [Client Quit]
jtimon has quit [Ping timeout: 250 seconds]
Murch has joined #bitcoin-wizards
mn3monic has quit [Ping timeout: 250 seconds]
mn3monic has joined #bitcoin-wizards
Dean_Guss has quit [Ping timeout: 256 seconds]
pinheadmz has quit [Quit: pinheadmz]
DeanGuss has joined #bitcoin-wizards
Chris_Stewart_5 has joined #bitcoin-wizards
schmidty_ has joined #bitcoin-wizards
schmidty has quit [Ping timeout: 245 seconds]
schmidty has joined #bitcoin-wizards
schmidty_ has quit [Read error: Connection reset by peer]
Chris_Stewart_5 has quit [Ping timeout: 250 seconds]
setpill has joined #bitcoin-wizards
Chris_Stewart_5 has joined #bitcoin-wizards
Krellan has joined #bitcoin-wizards
Zenton has joined #bitcoin-wizards
wpaulino has quit [Quit: leaving]
jungly has joined #bitcoin-wizards
spinza has quit [Quit: Coyote finally caught up with me...]
spinza has joined #bitcoin-wizards
root has joined #bitcoin-wizards
root is now known as Guest94198
Guest94198 has quit [Client Quit]
root__ has joined #bitcoin-wizards
Chris_Stewart_5 has quit [Remote host closed the connection]
root__ has quit [Client Quit]
wpaulino has joined #bitcoin-wizards
enemabandit has joined #bitcoin-wizards
Murch has quit [Quit: Snoozing.]
rh0nj has quit [Remote host closed the connection]
rh0nj has joined #bitcoin-wizards
ddustin has quit [Remote host closed the connection]
ddustin has joined #bitcoin-wizards
TheoStorm has joined #bitcoin-wizards
ddustin has quit [Ping timeout: 245 seconds]
Guyver2 has joined #bitcoin-wizards
ghost43 has quit [Remote host closed the connection]
ghost43 has joined #bitcoin-wizards
AaronvanW has joined #bitcoin-wizards
Chris_Stewart_5 has joined #bitcoin-wizards
spinza has quit [Quit: Coyote finally caught up with me...]
drexl has quit [Read error: Connection reset by peer]
drexl has joined #bitcoin-wizards
spinza has joined #bitcoin-wizards
Chris_Stewart_5 has quit [Ping timeout: 240 seconds]
Chris_Stewart_5 has joined #bitcoin-wizards
Chris_Stewart_5 has quit [Ping timeout: 250 seconds]
<cjd>
so looks like the ones eliminatd are BIG QUAKE, CFPKM, Compact LWE, DAGS, Ding Key Exchange, DME, DRS, DualModeMS, EMBLEM, Giophantus, Gravity-SPHINCS, Guess Again, Gui, HiMQ-3, KCL, KINDI, LAKE, Lepton, LIMA, Lizard, LOCKER, LOTUS, McNie, Mersenne-756839, pqNTRUSign, Odd Manhattan, Post-quantum RSA-Encryption, Post-quantum RSA-Signature, pqsigRM, QC-MDPC KEM, RaCoSS, Ramstake, RLCE-KEM, Titanium, Wal
<cjd>
nutDSA
<cjd>
excluding the ones withdrawn or merged
Aaaaand has joined #bitcoin-wizards
<Aaaaand>
Can somebody direct me to good information on why bitcoin can stay secure and reliable when the block reward becomes negligible? (or how the future fee market can guarantee bitcoin's security?)
<nsh>
someone please correct me but i would venture that at the moment it's still a mixture of hope [economic arguments] and some empirical results which are slightly more promising than doomsaying
<nsh>
it's a gradual transition to a game-theoretic equilibrium that is more complex and less supported by algorithmic driving than under the block reward. as a result it will required collective self-organisation which is difficult to reason about
<nsh>
but maybe people have data from test models in other systems that can be brought to bear
Chris_Stewart_5 has quit [Ping timeout: 272 seconds]
<Aaaaand>
yeah, it looks a big transition for bitcoin and not much is written about it (or I am looking at the wrong places)
<nsh>
it could be seen as a minting mining subsidy being replaced by an adoption-utility subsidy i suppose but then that puts a systemic constraint on a window in which adoption-utility must increase to pick up the slack, but this is automatically recompensated as miners drop out
<Aaaaand>
It looks like there is no clear answer to it, and it looks like a dangerous gamble to me
<nsh>
as the fee dividend is then split less to remaining miners
<nsh>
so there's still an equilibrium-finding feedback in terms of voluntary participation
<nsh>
well, permanent inflation is considered another dangerous gamble and the context in which bitcoin was created should be remembered
<cjd>
when are we talking about ? 2050 ? 2100 ?
<cjd>
I'm gonna throw my money on either singularity or nuclear winter before then
<Alanius>
money denominated in what, cigarettes?
<Aaaaand>
But I don't think there is a certain correlation between value of the bitcoin network and on-chain tx fees.
<Aaaaand>
We're currently at the same block fees as in begin 2016
<Aaaaand>
in terms of bitcoin
<Aaaaand>
which is an issue if you want to prevent 51% attacks
Chris_Stewart_5 has joined #bitcoin-wizards
<Aaaaand>
and second layer tech might even make this worse
<Aaaaand>
cjd: 10 years?
<Aaaaand>
fixed mining reward is then 1.5 btc
<Aaaaand>
It's coming fast
<cjd>
hmm, 10 years is a bit close, but that's double it's current age... so I wouldn't be at all surprised to see a network of lightning nodes which look a lot like banks but with transparency... I could easily imagine them setting their nodes to reject deep reorgs
<Aaaaand>
So you're moving away from total POW to determine the chain ?
<cjd>
I'm sitting in an armchair predicting things
<nsh>
holding my nose to say this, but it's worth remembering that 'society' (ie governments, banks, corps) subsisise the financial sector massively at present
<nsh>
and this willingness to part with a fraction of wealth-generation/value to ensure the good running of an international settlements system is likely to endure
<nsh>
but we'd prefer it to be written in somehow algorithmically and not dependent on politics
<cjd>
transparency
* nsh
nods
<cjd>
If I could snap my fingers and blockchain would cease to exist, but the banks as we know them would all become completely transparent and electronically auditable, I would
<Aaaaand>
Bitcoin was supposed to be a trustless system, but looks current implementation becomes flawed when miners have to rely on tx fees
<Aaaaand>
Chance that governments will protect the bitcoin system is very low, def in a time span of 10 years
<Aaaaand>
imo
<cjd>
"trustless" -> bitcoin's a hack to bypass the fact that no such system can actually exist
<Aaaaand>
I mean in 5 years, fixed reward is 3 BTC. Will it be enough? Hard to tell. You can 51% at any reward of course
<cjd>
sort of a loophole in the rules
<Aaaaand>
and it works when miners have guaranteed pay
<cjd>
in any case, I'm not worried
<Aaaaand>
but relying on a fee market becomes highly unreliable imo
<Aaaaand>
what if there is a small period of low tx count?
<Aaaaand>
for whatever reason
<Aaaaand>
51% attacks will become trivial
<cjd>
doesn't make the first page of my list of concerns
<Aaaaand>
not today no
<cjd>
not in my list of concerns between now and singularity
<Aaaaand>
but in 5 years, it will start to play I think, and it doesn't look like there is a clear solution for it
<Aaaaand>
cjd: then what is top on your list?
<cjd>
nuclear war
<Aaaaand>
this is a bitcoin channel..
<cjd>
you asked :)
<Aaaaand>
I mean, regarding to bitcoin
<cjd>
internet collapses and then people can't send blocks because of ^^
<Aaaaand>
More talking about the protocol itself
<Aaaaand>
there is always blockstream satellite cjd
<cjd>
But if you want a concern which is narrowly related to bitcoin and not related to things other than bitcoin... maybe quantum computers is an answer you prefer
<cjd>
satellite is only as good as it's uplink
<Aaaaand>
cjd: Difficulty will just increase? Or are you talking about finding the private keys of a bitcoin address ?
<Aaaaand>
You can always add new address formats
<Aaaaand>
don't think that's much of an issue
<Aaaaand>
it will be for old coins of course
<cjd>
What if cryptography stops working entirely ? I don't think there is consensus on what quantum computers *definitely cannot* do
<nsh>
was just thinking about that in ##crypto
<nsh>
(settled that lamport sigs are robust afawk but raw asymmetric encryption/decryption is toast and everything will be done by [q]key-distribution and at least 2x keylength symmetric encryption primitives
<nsh>
which isn't a really big difference from today really)
<nsh>
otoh i occasionally habour ideas about post-[classical]-turing-computing which are far more scary than people's current understanding of immanent QC
<cjd>
underpinning hashes is an implicit assumption that mixing + losing bits is something that cannot be preimaged...
<nsh>
yes, well, exactly this
TheoStorm has quit [Ping timeout: 268 seconds]
<cjd>
Also consider that your PRNG is losing bits all of the time, so how much entropy does it really have ?
<nsh>
but i'm obliged to keep mum about some of my thoughts this direction until i can have confidence that the cat which might come out of the bag won't become a meowzilla and destroy civilisation as we know it
<cjd>
every time you hash, you give a few bits up to make it irreversible...
<cjd>
I wouldn't worry about it, 100 monkies, someone else is thinking what you're thinking
<nsh>
there are confusing results here that i don't understand fully
<nsh>
e.g. left-over hash lemma and things like tihs suggest you can stretch entropy
<nsh>
but basic counting arguments suggest otherwise and i don't know how to settle the difference
<cjd>
"stretch entropy" sounds like perpetual motion to me
<nsh>
and worse in quantum information as we understand it nothing can be lost by diktat of unitarity and time-reversibility
<nsh>
so kinda we have to hope that quantum mechanics is just a metaheuristic for some underlying physics which does involve convergence of histories (loss of information, time irreversibility)
<nsh>
luckily there is some light in that direction
<nsh>
it may turn out that there are quaint... physical solutions. ie we send out some probe to far end of solar system and it has to physically house a bunch of dangerous entropy at some physical remove from earth systems that might be undone by its leaking
<nsh>
but this is scifi :)
<nsh>
'Imagine that you have a secret key X that has n uniform random bits, and you would like to use this secret key to encrypt a message. Unfortunately, you were a bit careless with the key, and know that an adversary was able to learn about t < n bits of that key, but you do not know which. Can you still use your key, or do you have to throw it away and choose a new key? The leftover hash lemma tells us that we can produce a key of about n - t bits, over
<nsh>
which the adversary has almost no knowledge. Since the adversary knows all but n - t bits, this is almost optimal. '
<cjd>
if we get safely to singularity day, doesn't matter that much
<nsh>
do bulletproofs vector commitments use merkle trees? i don't seem to recall this but i didn't grok to long term memory all of the details
* nsh
rereads waxwing's notes
<waxwing>
nsh, no vector pedersen commitments are just curve points (made by summing other curve points, of course)
<nsh>
so it seems, by a cursory reading of the bohen et al paper above that two approaches are complementary
<nsh>
multi-NUMS generators and merkelised vector commitments
<nsh>
oh but actually the pederson approach may just be superior due to constantcy of membership proof size
* nsh
shouldn't make comments on papers while half way down page 3 anyway
<nsh>
of 49
<nsh>
oh the paper is with Bünz anyway so there won't be reduplication
<nsh>
yeah i just guessed badly. bulletproofy inner products here are being proposed to replace merkle trees
jungly has quit [Remote host closed the connection]
<nsh>
"In slight deviation from the soundness definition used in statistically sound proof systems, we do not universally quantify over the instance x (i.e. we do not require security to hold for all input instances x). This is due to the fact that in the computationally-sound setting the instance itself may encode a trapdoor of the crs pp (e.g. the order of a group of unknown order), which can enable the adversary to fool a verifier."
ddustin has quit [Read error: Connection reset by peer]
ddustin has joined #bitcoin-wizards
<sarang>
The cloak transaction flow was interesting due to its relative simplicity relative to range proofs alone, especially due to the verification scaling of Bulletproofs
<nsh>
--
<nsh>
Ed25519 has different behavior between single and batch verification. Two implementations are freely allowed to disagree about which signatures are valid, which might be a problem for some kind of blockchain.
<nsh>
Tor had an issue like this, where onion service addreses in tor had to add extra validation, the cofactor problem had 8 addresses for the same server.
<nsh>
Monero had a critical vulnerability due to cofactors where having a cofactor 8 meant that you could spend 8 times.
<nsh>
-- references for all three of these would be heartily appreciated [by myself]
<nsh>
sarang might graciously point me toward the lattermost
<sarang>
Yes, I'll hunt down the announcement of that. It was quite fascinating (and, to be fair, before my time!)
<waxwing>
i'm pretty sure i saw at least one other similar cofactor fail, i think it might have been JWT or something.
<sarang>
I don't particularly like the explanation FWIW
<waxwing>
heh, "blag post" :) btw i think jonas nick nickler also did a write up of that monero problem. or am i getting confused with the other issue (the one that didn't make it to prod). maybe he did both actually.
<sarang>
It affected all "standard" CryptoNote-based projects
<sarang>
I believe he did one
<waxwing>
ah yes, i remember now, bytecoin pumped 100% on the day the exploit was announced lol.
<nsh>
ty again
<nsh>
hah
<sarang>
We skirted the issue with our ed25519 Bulletproofs implementation by having the prover do a 1/8-offset on points that's undone by the verifier
<nsh>
well why shouldn't a minor cryptotragedy to some be a minor cryptowindfall to others... seems nicely symmetrical :)
<nsh>
hmm
<nsh>
interesting hack/mitigation
<nsh>
is it annotated somewhere?
<sarang>
Monero code is terribly commented
<waxwing>
in short: DJB lied to us.
<nsh>
someone should really make a short academic course lecture / talk series on bulletproof implementations from the trenches
<sarang>
That's a great idea
<nsh>
and make available online for housebound people like myself
<nsh>
:)
<nsh>
or countrybound
<sarang>
Our goal was to avoid a full group-order scalarmult of course
Murch has joined #bitcoin-wizards
theunderground has joined #bitcoin-wizards
<sarang>
I know the dalek folks were interested in a Bulletproofs implementation modification to remove the power-of-2 requirement for the inner product proof... anyone know if that's happened?
<sarang>
This becomes relevant in the constraint system case for large constraint sets
<nsh>
i thought the theory wasn't filled on on that yet
<nsh>
at least i seem to recall the paper saying power-of-2 isn't required but simplifies the proof
<nsh>
and not elaborating especially or at all
<sarang>
Earlier drafts didn't address it at all, IIRC
<nsh>
i might be misremembering also
pinheadmz has joined #bitcoin-wizards
pinheadmz has quit [Client Quit]
<nsh>
there may be a 'traditional' mathsy result that applies
<nsh>
i'm too ignorant to think of one
<sipa>
sarang: afaik there is no known solution for the power-of-2 rounding
Chris_Stewart_5 has quit [Ping timeout: 250 seconds]
<sarang>
that's unfortunate
laurentmt has joined #bitcoin-wizards
<nsh>
oh i read perhaps overgenerously "we assume without loss of generality that n is a power of two because g,h,a,b can be padded" [paraphrasing mildly]
<nsh>
that's not the same as "this simplification can be removed"
<nsh>
"extending this work to something called bulletproofs by taking the existing Bootle 2016 inner product argument, simplifying it, the original Bootle paper allowed you to split a number into arbitrary factorizations and then you would use various polynomials based on the size of the different factors and it was quite an event to understand this... Anyway, they simplified this to only work with powers of 2, and they also made it smaller, in a way to drop
<nsh>
it from group elements per bit, down to 2, so it was a 3x space savings."
<nsh>
the power-of-2 seems like a cost-of-doing-business to simplify the original bootle construction
<nsh>
well, maybe if you switch to a higher or rather to multiple base systems then you can avoid it but at the cost of the complexity popping up in the rebasing
<nsh>
might still yield savings for constrained systems idk
<nsh>
okay oleganza's proposal is smarter than that, it seems