On Tue, Nov 14, 2017 at 01:21:14AM +0000, Gregory Maxwell via bitcoin-dev wrote: > The primary advantage of this approach is that it can be constructed > without any substantial new cryptographic assumptions (e.g., only > discrete log security in our existing curve), that it can be high > performance compared to alternatives, that it has no trusted setup, > and that it doesn't involve the creation of any forever-growing > unprunable accumulators. All major alternative schemes fail multiple > of these criteria (e.g., arguably Zcash's scheme fails every one of > them).
Re: the unprunable accumulators, that doesn't need to be an inherent property of Zcash/Monero style systems. It'd be quite feasible to use accumulator epochs and either make unspent coins in a previous epoch unspendable after some expiry time is reached - allowing the spent coin accumulator data to be discarded - or make use of a merkelized key-value scheme with transaction provided proofs to shift the costs of maintaining the accumulator to wallets. The disadvantage of epoch schemes is of course a reduced k-anonymity set, but if I understand the Confidential Transactions proposals correctly, they already have a significantly reduced k-anonymity set per transaction than Zcash theoretically could (modulo it's in practice low anonymity set due to lack of actual usage). In that respect, epoch size is simply a tradeoff between state size and k-anonymity set size. -- https://petertodd.org 'peter'[:-1]@petertodd.org
signature.asc
Description: Digital signature
_______________________________________________ bitcoin-dev mailing list bitcoin-dev@lists.linuxfoundation.org https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
