Show HN: Logcoin – Toy crypto-currency based on a zero-knowledge protocol • Hacker News Board

Re: Show HN: Logcoin – Toy crypto-currency based on a zero-knowledge protocol

#11

Post by im3w1l » Sat, Oct 17, 2015, 3:34 AM UTC

lambda wrote: post #6

im3w1l wrote: post #4

Sorry for being harsh on a newcomer, but this did not live up to my expectations based on the title. It seems to be strictly worse than bitcoin, let alone zerocoin. It needs a central tracker, and it needs a secure offline channel to transmit keys. The reason zerocoin uses zero-knowledge proofs is to make it impossible to trace the history of a coin. This is another property that this project does not have.

This comment does seem fairly harsh for something advertised as "a toy." Why would you expect a toy to be state of the art? When I see that phrase, I think of something that is a personal learning experience, might have an interesting idea or two but is not expected to replace anything that already exists.

I expect a toy example to be theoretically sound, but using shortcuts to get a practical realization.

For all the fancy cryptography this uses, I don't see how it provides any more security properties than a central actor having a databases of balances and requiring a cryptographic signature (like RSA, ECDSA etc) to authorize transactions. I don't see an extension path either.

Since the zero-knowledge proof is interactive, I am unsure how the central tracker could even be audited not to spoof transactions.

Re: Show HN: Logcoin – Toy crypto-currency based on a zero-knowledge protocol

#12

Post by im3w1l » Sat, Oct 17, 2015, 3:38 AM UTC

synapticrelease wrote: post #7

im3w1l wrote: post #4

Sorry for being harsh on a newcomer, but this did not live up to my expectations based on the title. It seems to be strictly worse than bitcoin, let alone zerocoin. It needs a central tracker, and it needs a secure offline channel to transmit keys. The reason zerocoin uses zero-knowledge proofs is to make it impossible to trace the history of a coin. This is another property that this project does not have.

No reason to be sorry. well, the title was supposed to be longer :P. I was going to write the same as the github title but it didn't fit. It is clearly a toy--- ahermmg ---semi-serious theoretical exercise, and not a real competitor to bitcoin or zerocoin, you are right in that respect. This (as far as I know) does make it impossible to trace the history of a coin, because there is no recorded transaction history, as…

You say that the trusted actor updates the public key of a coin. This means that it is known which former key corresponds to which following key. Thus the central actor can trace the history. If you have many trackers, then everyone can trace the history.

Re: Show HN: Logcoin – Toy crypto-currency based on a zero-knowledge protocol

#13

Post by synapticrelease » Sat, Oct 17, 2015, 5:05 PM UTC

im3w1l wrote: post #11

lambda wrote: post #6

Earlier quoted context omitted.

This comment does seem fairly harsh for something advertised as "a toy." Why would you expect a toy to be state of the art? When I see that phrase, I think of something that is a personal learning experience, might have an interesting idea or two but is not expected to replace anything that already exists.

I expect a toy example to be theoretically sound, but using shortcuts to get a practical realization. For all the fancy cryptography this uses, I don't see how it provides any more security properties than a central actor having a databases of balances and requiring a cryptographic signature (like RSA, ECDSA etc) to authorize transactions. I don't see an extension path either. Since the zero-knowledge proof is intera…

Read the readme again. The interactive ZKP does not reveal classified information about the actual transaction to the tracker, which is required to authorize it.

In theory, yes, a tracker could be malicious. It could even simply delete its record of all the coins and then refuse all transactions. Or change every coin so it cannot be spent. Actually the one thing it couldn't do is spoof transactions, because it doesn't know the secret key of a single coin it tracks. So it would have to make up a new coin, which would be easily detectable by other trackers because there must be a public consensus on how new coins are created (i.e., their public keys must be prime). So you would, once again, have to compromise every single tracker to spoof a transaction. Then you are right that there is no way to audit, but then you have bigger problems anyway (like people stealing money from exchanges) even before you get there.

Which brings me to the /real/ problem with my implementation, the coins are not worth nearly as much as bitcoin or zerocoin yet :P.

Re: Show HN: Logcoin – Toy crypto-currency based on a zero-knowledge protocol

#14

Post by synapticrelease » Sat, Oct 17, 2015, 5:07 PM UTC

im3w1l wrote: post #12

synapticrelease wrote: post #7

Earlier quoted context omitted.

No reason to be sorry. well, the title was supposed to be longer :P. I was going to write the same as the github title but it didn't fit. It is clearly a toy--- ahermmg ---semi-serious theoretical exercise, and not a real competitor to bitcoin or zerocoin, you are right in that respect. This (as far as I know) does make it impossible to trace the history of a coin, because there is no recorded transaction history, as…

You say that the trusted actor updates the public key of a coin. This means that it is known which former key corresponds to which following key. Thus the central actor can trace the history. If you have many trackers, then everyone can trace the history.

Yes, but it only knows the public key. Which is not a number in any way associated publicly with the identity of the owner...it's essentially a (discrete exponent of a) random number that identifies the coin.

Re: Show HN: Logcoin – Toy crypto-currency based on a zero-knowledge protocol

#15

Post by synapticrelease » Sat, Oct 17, 2015, 5:38 PM UTC

synapticrelease wrote: post #8

amluto wrote: post #5

Some thoughts: Why did you pick a modp group instead of an EC group? Why doesn't Bob send y? Y is derivable from what Bob sends. (Your zero knowledge claim is at least a bit wrong, since Bob is sending correlated numbers and, in fact, y can be derived from them.) Bob's sent values can be rewritten as y 2^b, y 2^c, and y^-1 * f_1 * f_2, which makes me wonder why f_3 is sent. Why does Bob prove knowledge of x+b+c? Can…

So, what I mean by zero knowledge is that there is zero knowledge of the secret key x, the discrete log of y. Y itself is supposed to be derived, that's part of the protocol. But when Bob randomly offsets the x-value before sending it, he is committing to a value of x, c, and b which he must then verify. It will be impossible for him to verify the c and b if he doesn't know x, which is important (see below). modp gro…

I should also mention that the protocol to verify x is separate and is a valid ZKP.

Re: Show HN: Logcoin – Toy crypto-currency based on a zero-knowledge protocol

#16

Post by im3w1l » Mon, Oct 19, 2015, 3:44 PM UTC

synapticrelease wrote: post #13

im3w1l wrote: post #11

Earlier quoted context omitted.

I expect a toy example to be theoretically sound, but using shortcuts to get a practical realization. For all the fancy cryptography this uses, I don't see how it provides any more security properties than a central actor having a databases of balances and requiring a cryptographic signature (like RSA, ECDSA etc) to authorize transactions. I don't see an extension path either. Since the zero-knowledge proof is intera…

Read the readme again. The interactive ZKP does not reveal classified information about the actual transaction to the tracker, which is required to authorize it. In theory, yes, a tracker could be malicious. It could even simply delete its record of all the coins and then refuse all transactions. Or change every coin so it cannot be spent. Actually the one thing it couldn't do is spoof transactions, because it doesn'…

Alice has a secret key. She wants to prove this to Tom the tracker. He issues her a number of challenges until he is convinced she has the key.

Suspicious Simon now wonders if Alice actually had they key. Maybe she didn't and Tom gave her easy challenges? How can Simon be sure Alice has the key?