Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zerocoin: making Bitcoin anonymous

blog.cryptographyengineering.com

Post reply on HN
Print view View original

41–50 of 86 posts

Re: Zerocoin: making Bitcoin anonymous

#41

Post by pjscott »

jasonlingx wrote: post #31

Can't we just open a mtgox account, deposit and then withdraw?

The article addresses this:

> For the more paranoid, there are services called 'laundries' that take in bitcoins from a whole bunch of users, mix them up and shuffle them back out. In theory this makes it hard to track your money. Unfortunately, laundries suffer from a few problems. First, they only work well if lots of people are using them, and today's laundries have relatively low volume. More importantly, you're entirely dependent on the honesty and goodwill of the laundry itself. A dishonest (or hacked) laundry can steal your coins, or even trace its inputs and outputs -- which could completely undermine your privacy.

Re: Zerocoin: making Bitcoin anonymous

#42

Post by waps »

jerf wrote: post #25
anonymoushn wrote: post #18

Earlier quoted context omitted.

Could you point out the problem with such a distribution? It isn't immediately obvious that I cannot satisfy both axioms. Edit: The helpful explanation linked in a comment on the question you linked is defective because it applies to all continuous probability distributions.

The key is the restriction that in the uniform distribution the probability density must be the same at all points, and if it covers infinity, it can be neither 0 nor anything greater than 0 if it's going to sum to 1. It's perfectly legal to have a probability distribution across all the reals. In fact most if not all of the well-known ones are; the Gaussian/normal distribution is defined on all reals, for instance.…

Why isn't the answer P = { Inf -> 1, otherwise 0 } ?

Axiom 1: P(E) elem N => P(E) >= 0, for all E

Trivially satisfied

Axiom 2: P(Omega) = 1

Satisfied: Omega = N { Inf } elem N

Axiom 3: Sigma additivity. Trivially satisfied since it either includes { Inf } or it doesn't, making the outcome 0 or 1.

Where is the problem ?

I think it's pretty clear that this is the only possible solution, because since N is not closed, there is no way to keep a uniform density other than 0.

This does not seem like it's a very useful solution, but it does seem to satisfy the axioms.

Re: Zerocoin: making Bitcoin anonymous

#44

Post by anonymoushn »

Fargren wrote: post #34
anonymoushn wrote: post #29

Earlier quoted context omitted.

It contains the sentence "For any distribution, the sum of probabilities always equals 1" without the caveat that the sum is of a countable number of probabilities. It applies to every continuous distribution using the same argument, but with "the sum across all naturals" replaced with "the sum across the appropriate universe."

"the sum across the appropriate universe" for Reals is an integral. An integral can go from -Infinite to Infinite and still equal 1. This is the reason, for instance, why Zeno's Paradox of movement doesn't really forbid all movement.

This comment is more or less irrelevant. The third axiom of probability is about sums of countably many terms: http://en.wikipedia.org/wiki/Axioms_of_probability#Third_axi...

Re: Zerocoin: making Bitcoin anonymous

#45

Post by vessenes »

I like seeing proposals like this that use Bitcoin as essentially a protocol layer (and in this case value store).

40KB anything is not going anywhere near the blockchain soon; this is going to be a no-go for the dev team and miners.

There are also a bunch of ancillary questions, like can these zero knowledge proofs (presumably non-interactive ones) be combined up with the rest of the blockchain to be turing-complete? Also a no-go.

Anyway, this is cool. Given current Bitcoin decision making processes, I would expect it would need a solid year of great adoption in some sort of side-car process before it had a shot at main blockchain integration, and even then, it would have to get drilled down to 1 or 2k of data max.

Re: Zerocoin: making Bitcoin anonymous

#46

Post by drakaal »

In order for this scheme to work ZeroCoins would have to have the same computational creation requirements as a bit coin. This would mean that there would always be fewer zero coins than bit coins and those coins would have to be mined.

If the zero coins were not the same difficulty to create then you could just create zero coins and trade them for bit coins anytime you wanted.

This seems like a huge flaw in the system.

Re: Zerocoin: making Bitcoin anonymous

#47

Post by [deleted] »

waps wrote: post #42
jerf wrote: post #25

Earlier quoted context omitted.

The key is the restriction that in the uniform distribution the probability density must be the same at all points, and if it covers infinity, it can be neither 0 nor anything greater than 0 if it's going to sum to 1. It's perfectly legal to have a probability distribution across all the reals. In fact most if not all of the well-known ones are; the Gaussian/normal distribution is defined on all reals, for instance.…

Why isn't the answer P = { Inf -> 1, otherwise 0 } ? Axiom 1: P(E) elem N => P(E) >= 0, for all E Trivially satisfied Axiom 2: P(Omega) = 1 Satisfied: Omega = N { Inf } elem N Axiom 3: Sigma additivity. Trivially satisfied since it either includes { Inf } or it doesn't, making the outcome 0 or 1. Where is the problem ? I think it's pretty clear that this is the only possible solution, because since N is not closed, t…

[deleted]

Re: Zerocoin: making Bitcoin anonymous

#49

Post by gizmo686 »

drakaal wrote: post #46

In order for this scheme to work ZeroCoins would have to have the same computational creation requirements as a bit coin. This would mean that there would always be fewer zero coins than bit coins and those coins would have to be mined. If the zero coins were not the same difficulty to create then you could just create zero coins and trade them for bit coins anytime you wanted. This seems like a huge flaw in the syst…

No, ZeroCoins are computationally easy to create. The concept is that you easily create a zerocoin, and then 'buy' it using bitcoins. When you buy the zerocoin, you create a bitcoin transaction, so you have to spend the corrosponding amount of bitcoins. When you want to redeem a zerocoin, you have to prove that you bought one. In this way, zerocoins are a lot like gold notes. They are cheap to create, but have value becuase they can be exchanged with gold/bitcoins, which have value and are hard to create. Unlike goldnotes however, zerocoins should be impossible to forge.

Re: Zerocoin: making Bitcoin anonymous

#50

Post by gizmo686 »

jevinskie wrote: post #38
gojomo wrote: post #35

Earlier quoted context omitted.

MtGox knows who you are, and is not a secret underground operation thumbing its nose at The Man. Over the long run, you should consider them as transparent as any major, bailed-out bank.

Correct. Zerocoin is a way to make it mathematically difficult (read: likely infeasible in practice) to de-anonymize instead of trusting a central party. Cool stuff!

Mathematically difficult does not mean infeasible in practice. Not even mathematically impossible means infeasible in practice. Having a solid theory is a good start, but a minor oversight in the implemantation could doom the system.
Post reply on HN