Date: Wed, 17 Mar 2021 04:11:26 +0000
To: DA Williamson <damian@willtech.com.au>
From: ZmnSCPxj <ZmnSCPxj@protonmail.com>
Reply-To: ZmnSCPxj <ZmnSCPxj@protonmail.com>
Message-ID: <4ltFpTt8QxX44nedimzJ7J4F1bIhwxb9rbqf1DeGlYX8W7CduYCy64miuq2IIjee_K5rBV6ofEPzdYQniEq6IR4I7ZO5ENlk9z-mQPs-YZE=@protonmail.com>
In-Reply-To: <932f2f2866cac087a207f8757c9df4b776ccdb04.camel@willtech.com.au>
References: <SL2P216MB0089B70AEDD58F2EBC46B4309D9A9@SL2P216MB0089.KORP216.PROD.OUTLOOK.COM>
 <A326C6D2-7C6E-42A2-93C9-DC7647BB09B6@voskuil.org>
 <170b27c0-436f-c440-e3c3-f9577b764972@riseup.net>
 <SL2P216MB00896086AA80DE1A98293C469D989@SL2P216MB0089.KORP216.PROD.OUTLOOK.COM>
 <Wz83obOLCjtbO-rIDw9mHM0ObBrE10y1rLg8vbEyp5BIxtfzlUJyLlnPZ-RWnvsKzJaKRe4bo7hnjlJnwL4-g7HyRNa6TvL_Y-gBQ12ifCg=@protonmail.com>
 <932f2f2866cac087a207f8757c9df4b776ccdb04.camel@willtech.com.au>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Taproot NACK
Precedence: list

Good morning JAMES,

> Good Afternoon,
>
> Verifiable and independantly verifiable are not the same. Independantly
> scrutinable means any public can scrutinise blockchain to determine it
> is honest. It does not rely on involved parties but insistently on the
> data published in the blockchain.

The involved parties ultimately publish the data on the blockchain, and the=
 result is independently validatable.
All that each involved party has to do is validate for itself that it does =
not lose any funds, and, by the operation of math, the summary result does =
not result in any loss (or creation) of funds, thus CoinJoin cannot lead to=
 fraud.

I do not see much of a point in your objection here.
For example, in the case of Lightning, the individual payments made by the =
participants in the channel cannot be verified by anyone else (they can lie=
 about the payments that occurred on their channel).
But both participants in the channel need to agree on a single result, and =
it is that summary result that is independently verified onchain and publis=
hed.

Indeed, one major technique for privacy improvement in Bitcoin is the simpl=
e technique of creating summaries of multiple actions without revealing det=
ails.
Such a general class of techniques works by reducing the data pushed onchai=
n which provides both (a) scale because less data on chain and (b) privacy =
because less data is analyzable onchain.

Basically ---

1.  The entire point of a public blockchain is to prevent uncontrolled forg=
ery of the coin.
    Only particular rules allow construction of new coins (in Bitcoin, the =
mining subsidy).
2.  Various techniques can be used to support the above central point.
    * The simplest is to openly publish every amount value in cleartext.
      * However, this is not necessarily the ***only*** acceptable way to a=
chieve the goal!
      * Remember, the point is to prevent uncontrolled forgery.
        The point is **not** mass surveillance.
    * Another method would be to openly publish **summaries** of transactio=
ns, such as by Lightning Network summarizing the result of multiple payment=
s.
      * CoinJoin is really just a way to summarize multiple self-payments.
    * Another method would be to use homomorphisms between a cleartext and =
a ciphertext, and publish only the ciphertext (which can be independently v=
erified as correctly being added together and that inputs equal outputs plu=
s fees).

No privacy technique worth discussing and development in Bitcoin gets aroun=
d the above point, and thus fraud cannot be achieved with those (at least i=
f we define fraud simply as "those who control the keys control the coins" =
--- someone stealing a copy of your privkeys is beyond this definition of f=
raud).
Any privacy improvement Taproot buys (mostly in LN, but also some additiona=
l privacy for CoinSwap) will still not allow fraud.

Regards,
ZmnSCPxj