Date: Thu, 30 Jun 2022 21:50:20 +0000
To: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
From: AdamISZ <AdamISZ@protonmail.com>
Reply-To: AdamISZ <AdamISZ@protonmail.com>
Message-ID: <HT3SgKh3WjJhJz9ozfy8E0MuGveya8Grb3SYrmYShZcHTQOPKpIBfArFupyAVV44k3XHNjSaKHmimqX_BCrUsXm5QvadXK5Z_24uGL60KWg=@protonmail.com>
In-Reply-To: <Kq8x6RTAGitSLOir_j1JcWHxTODreQpRTtqfW0NCTrrwTJBHQ9smptiZA1rIbh6aJl9wc_Ca6DvQr7xrMSate62s4r9nmQSypugYYKJXEZY=@protonmail.com>
References: <Kq8x6RTAGitSLOir_j1JcWHxTODreQpRTtqfW0NCTrrwTJBHQ9smptiZA1rIbh6aJl9wc_Ca6DvQr7xrMSate62s4r9nmQSypugYYKJXEZY=@protonmail.com>
Feedback-ID: 11565511:user:proton
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [bitcoin-dev] RIDDLE: Lightweight anti-Sybil with anonymity in
	Bitcoin
Precedence: list

Just a small update to those interested:
I migrated the gist due to failures of github's new equation formatting fea=
ture (which unfortunately started just when I published this gist!), to [1]=
(but comments still on the gist please, or here).

Secondly, I did some research (including toy code) into sublinear ring sign=
atures and Groth/Kohlweiss 2014 can give logarithmic scaled ring signatures=
, whose security is reducible to that of the Pedersen commitments (essentia=
lly ECDLP). I made a note on what this looks like concretely here [2], TLDR=
 1 o 2 KB for 256-1024 keys. Open question how much the computational load =
matters. (Ring sig + key image I think is effected via ring sig + "spend a =
coin" part of "how to leak a secret and spend a coin", in the language of t=
he paper).

The above paragraph is mentioned of course to address the question of how p=
ractical it might be to get genuinely big anonymity sets. In short, it migh=
t be practical. Again to mention: though bilinear pairings crypto could giv=
e substantially more efficient constructions, that would not work on 'bare'=
 secp256k1, though there might be a sensible way of 'transferring' over to =
other curves (I'll leave that to others to figure out!).

[1] https://reyify.com/blog/riddle
[2] https://gist.github.com/AdamISZ/51349418be08be22aa2b4b469e3be92f?permal=
ink_comment_id=3D4210892#gistcomment-4210892

Cheers,
AdamISZ/waxwing


Sent with Proton Mail secure email.

------- Original Message -------
On Sunday, June 12th, 2022 at 18:04, AdamISZ via bitcoin-dev <bitcoin-dev@l=
ists.linuxfoundation.org> wrote:


> List denizens,
>
> As per the title, a suggested protocol for doing anti-Sybil that isn't to=
o demanding for the users, but actually keeps a decent level of privacy.
>
> Notice how it's mostly focused on a user/customer of a service/product/we=
bsite, but it could conceivably useful in e.g. anti-Sybil in things like Li=
ghtning.
>
> Sorry that as usual I write rather long but there are several convenientl=
y arranged sections you can click on :)
>
> https://gist.github.com/AdamISZ/51349418be08be22aa2b4b469e3be92f
>
> (with apologies for my backronym-ing sins)
>
> Cheers,
> waxwing/AdamISZ
>
>
>
> Sent with Proton Mail secure email.
>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev