Avatar
waxwing
675b84fe75e216ab947c7438ee519ca7775376ddf05dadfba6278bd012e1d728
Bitcoin, cryptography, Joinmarket etc.

I see it through JM lens where you can't reliably renegotiate the CJ due to ephemeral coordination so I've always just ignored RBF there, (and nor can you stop someone retrospectively cancelling the coinjoin contract by double spending their input). Of course CPFP exists but since there's no penalty mechanism I don't think the whole pinning thing is so relevant?

Maybe with adversarial makers in a taker maker model? It seems unrealistic.

But with redesigned cj protocol maybe other issues arise.

To be clear I really don't know.

Replying to Avatar Filipe Martinho

I read about it here https://bips.dev/431/ but didn't fully understand it yet. Can you ELI5?

First, my knowledge of this area is very sparse. Second, my response would depend on what you're asking: do you need to know about the issue this is trying to address? I could suggest bitcoin optech on pinning: https://bitcoinops.org/en/topics/transaction-pinning/ (optech is good as a library/reference on these technical concepts in bitcoin, generally; you can also follow links from there). Are you asking how exactly the rules in BIP431 will work? I don't know, but the basic concept is: we have this complicated bunch of rules to decide whether a transaction can be received into our mempool. These rules try to make sure a node can't get DOSed with infinite replacements; try to make it so that what gets into the mempool is "incentive compatible" with mining, i.e. that a rational miner would actually choose these transactions, and try to make it so that pinning as described above is either impossible .. or really hard? (not sure). This TRUC thing will be a new tx type which, if you opt into it, you can't have a chain of unconfirmed txs .. like tx1 is unconfirmed, then you add tx2 which spends from tx1, then tx3 spends from tx2 etc. etc.; TRUC would only allow tx2, not the ones after. That will make some versions of pinning not work, if I understand it correctly. Perhaps someone can expand on that last bit.

My original comment was along the lines of 'trying to understand and reason about whether a transaction can confirm is just getting more and more complex the more we understand it, which just illustrates that relying on penalty mechanisms like in current LN is really painful because of the game theory stuff'. not a criticism of this proposal, as I said, it does at least *try* to *restrict* how complex things can be, but it's arguable whether it achieves that goal, I think (because it's adding another way for txs to work .. but .. if everyone takes up this new ruleset for LN stuff then perhaps not? I don't know).

Just discovered BIP431.

My reaction is to be reminded of Shakespeare's "oh what a tangled web we weave, when first we practise to ... use game theory instead of cryptographic verification."

At least *restricting* scope (TRUC) makes the scope of the problem.. less intractable? Even that seems debatable.

Sorry only just noticed this ping.

Well, I think so, yes.

ZkSNARKs approach will be better for small, defined groups (more efficient).

For cases of very large spontaneously defined anon set from blockchain that isn't possible hence aut-ct is worth looking at.

Christof Paar does indeed seem like a good recommendation... i remember skimming that book but not getting it for some reason, but his lecture course on YouTube is really good and quite popular.

For EC stuff I'd recommend Washington ("Elliptic Curves Number Theory and Cryptography 2nd ed " easily accessible online). Stuff by Silverman and Galbraith is more thorough and i guess suitable for graduate mathematician researchers, but Washington is already pretty heavy in mathematics. To be clear, it's often better to treat EC as a black box (discrete log hard group is mostly all we care about, except some details like serialization).

Not sure on history. Simon Singh's 'the Code Book' was decent on that, but it's popsci, so fairly light.

For learning fundamentals of modern crypto in practice I'd recommend Serious Cryptography by J P Aumasson.

Boneh and Shoup give you a lot of solid grounding for serious study (e.g. security arguments) in toc.cryptobook.us

Work through the cryptopals challenges if you like hands on learning.

Thanks.

Not sure it's easy to improve, but esplora lookups aren't as good as monitoring with home node, right? Kinda intrinsic to not having a home node. Just a first thought. Also this model used by phoenix and alby of single channel connection to LN obv has huge advantages but has a privacy tradeoff right.

Just installed #alby hub alongside my home node.

https://guides.getalby.com/user-guide/alby-account-and-browser-extension/alby-hub/alby-hub-flavors/desktop

Interesting experience; I did not opt for the purist route of own LN and BTC node (not sure how purist that actually is, in the end) but the more 'default' option of LDK talking to esplora (as I understood). Very interesting how different the modern onboarding experience is.

Of course even this is a bit too much responsibility for most users most of the time (an always on PC!). Cloud hosting makes sense, but I think the fee will put people off, a bit (no judgment).

All of this is super lax privacy wise to be clear. Even more so than my every day expenses LN wallet, Phoenix.

As a result I've finally reenabled zaps for myself after more than a year's hiatus 😄

Bitcoin Core.

Most of Electrum is command line usable as I recall. A little less detailed documentation.

Core CLI is the closest you'll get to the 'swiss army knife' experience, though it can be very arcane.

Satoshi Nakamoto wrote code that was not usual. He had many quirks. We can find him by comparing his code with others, but no one did that yet.

When I first saw their code, I thought "Satoshi is not a programmer" because of how weird it was. He didn't follow normal code practices that were modern at that time.

He made big use of locks when it was out of fashion. He used Hungarian notation which was no longer used. He made spaghetti function recursion and never used objects to encapsulate processes. He also targeted Windows.

All of this indicate an older person, possibly not a software dev but from a close domain like engineering or physics. His whitepaper hinted at a background with a practical focus but not a mathematician.

The code was highly idiosyncratic and personal including the style itself. Analysis of the code will tell us everything.

You can even compare the code from 2008 with the code in 2010, and the way Satoshi writes code doesn't change. You can actually see the change from proof of concept to hacked up Satoshi node.

Whenever anyone says X is Satoshi, my first response is always "show me the code". This should be our default position.

But no Bitcoin coder (including myself) cares enough to do this. We're all so busy with real work. And I guess we also respect Satoshi-kun's wishes. Even writing this post showing how we can find him feels almost like a betrayal.

To be fair to Peter Todd, he handled it well and didn't try to claim undue credit.

#Nostr #Bitcoin

Isn't this Amir Taaki's tweet?

Replying to Avatar waxwing

New blog post

https://reyify.com/blog/adaptors-generalised/

... been thinking a lot about this topic, on and off. Not sure about potential applications to onchain verification of ZKPs, but *any* ability to lock bitcoin state transitions/payments to proofs of statements that are not restricted to a single generator G, feels like it could lead to some important new protocols. But this being interactive is clearly not as good.

I've rewritten the second half of this substantially, since it had several non-trivial errors; sorry for anyone who got that far 😄. I think it makes considerably more sense now ...

nostr:nevent1qqsry5z086u85wadrk32mxysdz8n94kl0fmkf3q6c9qz4r7ggty4wpcpzpmhxue69uhkummnw3ezuamfdejsygr8twz0ua0zz64eglr58rh9r898wafhdh0stkklhf3830gp9cwh9qpsgqqqqqqs3p2fxx

Replying to Avatar Cyph3rp9nk

About coinjoin coordinators.

There is a difference to be made between privacy on-chain and privacy at the network level.

Even if you have chain privacy you can tag the addresses with their respective ips and trace the user. Obviously this can only be done by the coordinator.

This is why Samourai and Whirpool have always sucked.

Whirpool:

- If you used the mobile wallet without your node, the coinjoin was useless because your public keys were exposed to the backend and with them all your past, present and future addresses.

- If you used your own node or sparrow it was also of little use, since both samourai and sparrow reuse the tor circuit, they only generate a new one if you close the application, and therefore the coordinator can tag the incoming and outgoing addresses at the time of registration and ruin the coinjoin. Whirpool has never been zerolink, the coordinator knew everything.

Wabisabi:

- It creates new connections for both input and output addresses, so the coordinator sees distinct identities, although I think it has flaws in its design due to the delay. We can consider it to be zerolink, at least they tried and were honest.

Joinmarket:

- Since there is no centralized coordinator it is much less important to create new tor circuits for each connection, still the coordinator (the taker) will know the ips of the incoming and outgoing addresses. I don't know if they are mitigating this in any way.

Joinstr:

- Use Riseup VPN for logging, everyone uses the same VPN, there is no possibility of tagging inbound and outbound addresses across relays.

For the JM part, the taker will always know the maker linkages, independent of the network level isolation. There is no Chaumian blinding.

Part of that price we pay for true permissionlessness. There is no foundation, org, or person to stand up for them.

Decent people have always recognised that what you say is correct, but not all people are decent.

Unfortunately had to migrate recently, so most are currently not online, but i will bring them back (sadly cannot migrate purely automatically).

New blog post

https://reyify.com/blog/adaptors-generalised/

... been thinking a lot about this topic, on and off. Not sure about potential applications to onchain verification of ZKPs, but *any* ability to lock bitcoin state transitions/payments to proofs of statements that are not restricted to a single generator G, feels like it could lead to some important new protocols. But this being interactive is clearly not as good.

Pretty bad/sloppy takes mixed in with decent analysis there. 'Joinmarket is an old version of ZL' .. no, not even a little bit true. 'Joinmarket is not usable except by devs' that one's more just a matter of opinion, but it's pretty bad to not even mention JAM plus the other client(s) joininbox of nostr:npub14tq8m9ggnnn2muytj9tdg0q6f26ef3snpd7ukyhvrxgq33vpnghs8shy62.

Hmm could be Ukrainian though .. that would make that combination slightly less surprising.