Hacker News Reader

Comment by knocte | Hacker News Reader

When you compared ZCash and MimbleWimble, you forgot to mention that the latter doesn't need a trusted setup like the former needed.

View on HN

The trusted setup is the major problem with Zcash, but it’s much more private than MW (assuming you believe the setup).

I’m not gonna spend a lot of time arguing on here, but I think it’s worth closely studying these systems as they’re fascinating. All anonymity focused systems have tradeoffs, just like more commonly understood distributed systems.

The big privacy concern I see with MW is the exchange of blinding factor, and there are some arbitrarily good solutions to that if you make other tradeoffs.

With ZCash I'm willing to trust the trusted setup (even if it was imperfect); the issue is that people don't actually use shielded addresses/privacy protecting transactions much.

Zksnarks is an incredible pile of research. It’s actually stunning.

Out of band blinding factor transfer is interesting, also relay/mix nets are interesting. I think it’s all a super cool area that’s worth studying closely.

There is no need for exchange of blinding factors.

The mailing list message https://lists.launchpad.net/mimblewimble/msg00091.html explains how any possible multi-party transaction can be done safely without exchanging blinding factors.

The biggest privacy issue with grin is it doesn't hide the transaction graph. See their own write up[0] which offers a very good and nuanced privacy discussion. This means, for example, you can be tracked by colluding vendors. Or can be identified when trying to accept payments anonymously.

I don't think blinding factors are as much of an issue.

Zcash setup doesn't matter for privacy. The larger issue is as you said, adoption of private transactions.

[0]https://github.com/mimblewimble/docs/wiki/Grin-Privacy-Prime...

RSA accumulators is an active area of research that will help with unlinking inputs and outputs, see the grin forum thread for more discussion:

https://www.grin-forum.org/t/benedikt-bunzs-utxo-commitments...

It really doesn't help with that unless you use a completely different protocol and assume trusted setup. At which point, just use zcash, it will have smaller and faster to verify transactions. Trust me, I've been working with RSA accumulators for privacy in Bitcoin since 2011.

Ah, I didn't see how the blinding factor was being used (the code is actually easier to understand than the paper). This has approximately the same linkability as monero, inferior to zcash (complex) or chaumian tokens (hyper-efficient, but centralized per-currency, although currencies can be permissionless).

Why can’t you just do self to self transactions before/after each external transaction, and split/aggregate to standardized values (to start, let’s assume the entire system only allows payments of exactly 100 units each).

Self to self txs could help obscure the tx graph when held at Dandelion nodes ready to aggregate with any other tx passing through the stem.

Standardizing values makes no sense since amounts are already invisible.

Let’s assume Alice is an antagonist coordinating with Carol to unmask bob.

How many self to self tx does bob need to do to hide from Alice and carol?

I believe it depends on how much of the network the adversary can monitor, and high a confidence Alice/Carol need in Bob’s identity to take action. If the action is “subject him to additional off-chain scrutiny”, the bar is presumably lower than “criminal conviction or assassination solely on this evidence”.

The more I learn about MW the less suitable it seems for my goals.

I think Alice and Carol need knowledge of 2 tx with Bob to coordinate a common ancestor; that's it.

If you imagine the ledger like a deck of cards, there is probably a point where all txo's are shuffled (and we can likely make a conjecture that after N shuffles, the position of any txo is unknown, it's just hard to gauge how many shuffles we need to do for real privacy guarantees. If you want 6 sigma privacy, you might need to wait a very long time).

Privacy of Zcash doesn't depend on the setup, only the soundness (preventing people from creating money out of thin air)

Privacy of zcash depends entirely on the setup.

Please reread the paper.

I work with SNARKs on a regular basis. Soundness depends on the setup; zero-knowledge is unconditional.

What's the trusted setup with zcash?

A group of people came up with the initial parameters (some random numbers). If they kept these numbers, they’d be able to anonymously, silently print unlimited amounts of zcash coins, and no one would know.

Interesting, are you aware if there's research on a trustless way to create a trusted setup? Basically a way to generate these random number without others knowing and to prove they no longer exist?

Monero doesn't need a trusted setup as well!

Reply on news.ycombinator.com