waxwing @waxwing@x0f.org

Amount blinding:

I was trying to make much the same point as this article in 2018 (blogpost, Lisbon panel, podcasts), but it is a pretty good summary. It slightly underplays just how unacceptable a "transparent migration" would be but, still.

Also, it should mention offchainness/higher layers.

It is concise, though, and clears up the main issues:

https://web.getmonero.org/2020/01/17/auditability.html

#bitcoin

Also, on crypto hardness: "In short, breaking soundness is not a practical risk" - maybe; pairing crypto?

I found this a very interesting read on the topic of the potential for backdooring ECC via non- or fake- NUMS parameter generation. By Dan Bernstein et al:

https://bada55.cr.yp.to/bada55-20150927.pdf

#crypto

Lindell with a review of some interesting talks from this year's RWC (which I believe was in NY this month).
https://www.unboundtech.com/report-real-world-cryptography-2020-conference/

@meeDamian

... and embed the wallet into the phone would be a substantial step up in work, and to not require an external jmdaemon, ie 100% on phone, even more (whole can of worms including Tor).

(jmdaemon was something i added in the rewrite in 2016/17; you can have the communications with peers entirely separated from the wallet, and the two talk to each over over TLS. At least one user actually does this)

#joinmarket

https://twitter.com/zndtoshi/status/1218108046938976262

There hasn't been too much discussion about this, but the first point is to narrow down exactly what functionality would be desired on mobile.
A while back someone (I think it was @meeDamian ?) added push notification functionality for coinjoins from makers; that would be basically trivial.
Then you could go further and have like a control panel for remote access on phone, and still have same basic joinmarket on home machine. To go even further (1/2)

I feel like what they're presenting as a new taxonomy here isn't actually new; it was already in Liu-Wei-Wong 04 ... but to be fair, they do cite it. Not sure whether new ring sig constructions here are of interest, but at the least they're attempting to clarify what is otherwise a very confusing topic:

https://eprint.iacr.org/2019/135

#crypto

H/T Christopher Allen. This kind of bumbling idiocy from governments, ruining people's lives through enforced identity tracking, is a trend.

https://mumbaimirror.indiatimes.com/mumbai/cover-story/man-endures-living-hell-as-aadhaar-card-is-put-online/amp_articleshow/73038561.cms

Very apposite comment here: does anyone believe such an insane choice would have survived for long if the library was open source?
It really beggars belief that you would not lock down curve parameters.

https://news.ycombinator.com/item?id=22050221

Also a funny nuance: one often has to explain to people that the choice of generator in a cyclic group "doesn't matter" (all generators are equivalent) - but crucially that is not the same as saying two different participants in a protocol can use different generators!

On the just released CVE from Microsoft/NSA, this explanation looks right:

https://news.ycombinator.com/item?id=22048619

The bug as per zdnet:

https://www.zdnet.com/article/microsoft-fixes-windows-crypto-bug-reported-by-the-nsa/

#crypto

To change from a standard (ID) sigma protocol to a signature scheme you apply Fiat-Shamir, which replaces an honest verifier choosing a random challenge, with a hash value.
How else could you get a provably honest random challenge? A blockchain!
If Alice commits to R in block N, she could use the blockhash of block N+100 and then publish a signature. No random oracle assumption required!
Wait ...
The security of bitcoin relies on the preimage resistance of the hash function anyway, lol.
#crypto

Wasabi research club talked about SNICKER and I attended. Hangout started with a slide presentation by Aviv Milner explaining in detail, visually, how it works - very recommended if you're interested in the proposal but don't want to wade through the BIP draft.

https://youtu.be/S0C-50QTteA

#bitcoin #coinjoin