Re: [bitcoin-dev] RIDDLE: Lightweight anti-Sybil with anonymity in Bitcoin

[AdamISZ <AdamISZ@protonmail.com>]

Just a small update to those interested:
I migrated the gist due to failures of github's new equation formatting feature (which unfortunately started just when I published this gist!), to [1](but comments still on the gist please, or here).

Secondly, I did some research (including toy code) into sublinear ring signatures and Groth/Kohlweiss 2014 can give logarithmic scaled ring signatures, whose security is reducible to that of the Pedersen commitments (essentially ECDLP). I made a note on what this looks like concretely here [2], TLDR 1 o 2 KB for 256-1024 keys. Open question how much the computational load matters. (Ring sig + key image I think is effected via ring sig + "spend a coin" part of "how to leak a secret and spend a coin", in the language of the paper).

The above paragraph is mentioned of course to address the question of how practical it might be to get genuinely big anonymity sets. In short, it might be practical. Again to mention: though bilinear pairings crypto could give substantially more efficient constructions, that would not work on 'bare' secp256k1, though there might be a sensible way of 'transferring' over to other curves (I'll leave that to others to figure out!).

[1] https://reyify.com/blog/riddle
[2] https://gist.github.com/AdamISZ/51349418be08be22aa2b4b469e3be92f?permalink_comment_id=4210892#gistcomment-4210892

Cheers,
AdamISZ/waxwing




Sent with Proton Mail secure email.

------- Original Message -------
On Sunday, June 12th, 2022 at 18:04, AdamISZ via bitcoin-dev <bitcoin-dev@lists.linuxfoundation.org> wrote:


> List denizens,
>
> As per the title, a suggested protocol for doing anti-Sybil that isn't too demanding for the users, but actually keeps a decent level of privacy.
>
> Notice how it's mostly focused on a user/customer of a service/product/website, but it could conceivably useful in e.g. anti-Sybil in things like Lightning.
>
> Sorry that as usual I write rather long but there are several conveniently arranged sections you can click on :)
>
> https://gist.github.com/AdamISZ/51349418be08be22aa2b4b469e3be92f
>
> (with apologies for my backronym-ing sins)
>
> Cheers,
> waxwing/AdamISZ
>
>
>
> Sent with Proton Mail secure email.
>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev