For the last few months Yahoo Finance have been promoting a criminal investment scam.They present it as if it was a legit company, while it is not hard to see that this is a scam run by some serial fraudsters.
Shame on you, Yahoo Finance!
Tomorrow 20 January, Trump will become the next US president. It will allow us to test again the concept of a 51% attack: more than 51% of Americans disapprove of Trump.
Here come the bad news. Possibly 90% would not help either. We have been losing control of the wealth and resources of this planet since the end of 1980s, and this concerns the 90% of us, the whole of the so called middle class included.
ADDITIONS: there are also many good people among the rich and influential.
In the last few years, we have seen an increased awareness that PGP/GPG is a dinosaur of 1990s crypto, and it does not satisfy the need of modern users for secure communication.
PGP model has many perverse effects: like creating a single point of failure where all sensitive communications are compromised with cracking one single key, which sooner or later quantum computer will crack.
Now are there any trustworthy alternatives on this planet? I believe there aren’t. I would recommend users NOT to trust anyone who says them some app is secure, like in this article which advocates Signal/What App . They are going to be disappointed.
Now we’ve covered why privacy is essential for widespread cryptocurrency adoption, and how stealth addresses can help assist the pseudonymity (stealth addresses defined and explained in Part 2, pseudonymity discussed in Part 1), it’s time to explain how to combine cryptography and Ethereum’s smart contract functionality to add another layer of obfuscation to public blockchains!
Ring signatures generally satisfy several essential properties, namely anonymity, unforgeability, and collusion resistance. The definition of anonymity here is that an adversary has no more than a negligible advantage of correctly identifying the individual that produced the signature.
Ring signatures offer honestly participating users with ‘unconditional anonymity’, and are formed without a complex setup procedure or the requirement for a trusted third party, trusted setup, or any form of group leader. Users are simply required to be part of an existing public key infrastructure.
Ring signatures are constructed in a way that the ring can only be ‘completed’, and so will only verify correctly, if the signer has knowledge of some secret information, most commonly a private key corresponding to one of the public keys in the ‘ring’. This is done through a zero-knowledge proof of membership.
In the signature generation algorithm, a number is generated at random for each of the other public keys in the ring, and then the signer uses the knowledge of their own private key, or some other ‘trapdoor information’, to ‘close’ the ring.
Ring signatures offer users anonymity by hiding transactions within a set of others’ transactions. If there are many users contributing very similar amounts to a ring, then the ring is said to have good liquidity, meaning the transactions can occur quickly, and also that transactions can be effectively mixed, with a high resistance to attempted mixing analysis attacks.
Linkable ring signature algorithms provide a scheme that allows users to sign on behalf of a group, again without revealing the individual signer’s identity, but with the additional property that any signatures produced by the same signer, whether signing the same message or different messages, have an identifier, called a tag, linking the signatures. With this tag, third parties can efficiently verify that the signatures were produced by the same signer, without learning who that signer is.
In our case, we use linkable ring signatures in a mixing contract.
Our linkable ring signature scheme relies on the hardness of EC-DDH, and the general scheme is as follows:
There are grittier details about adding opcodes to the EVM, hashing to secp256k1, indistinguishability and random oracle assumptions, etc, but we’ll gloss over them here!
The combination of stealth addresses and ring signatures makes revealing blockchain anonymous almost impossible (in cryptography the property is generally referred to as infeasibility). Combining these two techniques, we arrive at a scheme that satisfies the following properties:
Now breathe. And please tell me if you hated everything I said or have a million questions or want to let me know I’m wrong in a thousand ways!!!! (Or if more animal pictures are required).
In Part 1 we covered why privacy is essential for widespread cryptocurrency adoption, and concluded that neither Bitcoin nor Ethereum, or even ZCash is suitable for the task we’re wanting to solve: anonymity with efficiency. (Also the bonus property of needing no trusted setup)!
The benefits of using stealth addresses can be explained through this slightly contrived example:
Say Alice has a store, and she has her public key stuck to her till, so people can make payments to her in bitcoin/ethereum/ZCash. Alice is aware of the transaction analysis that people can perform on public blockchains, and her competitor Eve knows that about 98% of store payments are in Ether, so if she tracks Alice’s blockchain address, she will be able to monitor how Alice’s business is doing in near-real time. This makes Alice’s business vulnerable. For example, Eve could even learn to predict when Alice runs out of stock and then sell items to Alice at an unfair price. Instead of Alice changing her public key sticker every day, she can use stealth addresses!
Say Alice has long-term, publicly known public key , and corresponding private key , such that , with the generator of an elliptic curve (EC) group (if you don’t know what that means, we can just pretend they’re coordinates plotted on a graph with the property that is an excessively obscure representation which does not reveal the secret ). is an elliptic curve point (as is — it’s defined along with the curve we’re working on) and is a 256 bit integer.
Bob wants to pay Alice. Normally he would just send Ether to Alice, but as we know, blockchain analysis would make this transaction entirely public. So instead, Bob’s wallet generates an ephemeral key pair, for use in just this one transaction, with an elliptic curve point, and a 256 bit integer. Bob (or Bob’s wallet, acting on his behalf) sends to Alice, and they can both calculate the shared secret .
Bob can then send the Ether to an address formed ) (…with being the function used to map from public keys to public addresses in Ethereum), and Alice can spend the money with private key .
For any eavesdropper to compute the shared secret , they would have to crack the ECDH (elliptic curve Diffie-Hellman) problem. This is infeasible. So Alice’s privacy is protected so far!!
While we’re here, here are the definitions of ECDLP & EC-DDH. Both are useful in different parts of our huge scheme. The assumed hardness of the ECDLP is essential for privacy in the stealth address system, and the hardness of EC-DDH is the requirement for our ring signature scheme, described in Part 3. Assume E here is for Eve, our adversary (conventionally, the adversary is called A for adversary, but we have as Alice’s public key, so we can call the adversary E to avoid confusion between E, the malicious actor, and , the elliptic curve point).
Definition 1 Elliptic Curve Discrete Logarithm Problem (ECDHP)
E has no advantage in solving following:
Given and ,
Definition 2 Decisional Diffie-Hellman Assumption (EC-DDH)
E has no advantage in the following:
Given , with , decide whether .
Although the maths may look somewhat difficult to follow, Bob can send his one-time-use public key in the ‘data’ slot of the transaction, and so Alice can simply scan all transactions, find B, form the stealth private key, and spend the money as she wishes. The extra computations can all be automating inside and Alice and Bob’s wallets, and the communication is compressed down into 1 transaction needed, just like an entirely transparent result. This functionality is entirely possible with Ethereum & any wallet with stealth address capabilities.
However, if Eve is transferring money to Alice, and is really invested in finding out Alice’s income, she could produce a transaction (or many dust transactions) with stealth addresses for Alice, and then monitor the blockchain to see if Alice ever joins those accounts together or with others, in order to make an input to a higher value transaction in the future. This sounds unlikely to be relevant, but blockchain analysis (such as taint analysis) has been known to have crippling effects on the anonymity of public blockchain systems.
So we will work to prevent it. Using cool thing number 2.
The total number of ZEC coins will be only 21 million, like in bitcoin. Zerocash also reproduces few other unreasonable properties known from bitcoin: bizarre monetary policy with inelastic monetary supply and block halving every 4 years, get-it-rich-quick or “gold rush” syndrome, etc. All the things which make a crypto currency with very high volatility, which I anticipate will be AT LEAST as bad as for bitcoin, and probably a lot worse. This of course, will be a tremendous barrier for wider adoption of Zerocash by people other than libertarians or tax dodgers.
Early miners are already selling their coins. To start with, Poloniex has started trading them at UNBELIEVABLY large prices and only tiny fractions like 0.001 ZEC were traded. In the first hour and half, prices were moving like crazy between 500 and 3000 BTC per ZEC. In the next hour it went below 20 BTC, in the next 24 h it went below 5 BTC, and after another 24 hours, it went down to 1 BTC.
It is worth noting that the Zerocoin price as anticipated by a prediction/futures market has peaked at around 1 BTC in the days/hours preceding the release.
It is unlikely that an equilibrium market price will be reached in the coming days. We expect further very high volatility for Zerocoin. The monetary policy of Zerocoin is genetically programmed to impose a certain pattern [known in advance] of progressively increasing monetary supply to the infant market. In particular, ZEC has artificially small block mining rewards for the first 34 days of mining. At the same time crypto currency investors have hundreds of millions of dollars in cash to play with, and many investors have been investing in altcoins rather than bitcoin. This is because traditionally altcoins are more volatile than bitcoin, so more profits can be made from trading. Moreover, maybe the only way for some investors to hope for really fabulous returns is to see some altcoin challenge the dominant position of bitcoin in the market.
Though only fools bought Zerocoins early on, many investors are now playing the game of guessing at which moment in ZEC history will be the best moment to buy, which question has no objective answer as it depends on actions of other investors.
Zerocash certainly adds value to the cryptocurrency market. Now the question is how much is the added value? Here is a plausible evaluation and a plausible scenario for the future of ZEC:
An interesting question is whether some government [United States, EU, maybe Russia] is going to ban or forbid zerocash. Such a ban could be decided just because the production of money is according to some, a state monopoly in the United States. This is however largely disputed and for example bitcoin is tolerated today in most countries.
In contrast, a truly anonymous crypto currency could be just banned in many jurisdictions. While bitcoin is very rarely claimed to be a threat to national security (even less to the US currency), ZeroCoin is definitely a huge challenge to national security. It could lead to a re-definition of the term of so called “domestic terrorism”, which term was quite surprisingly used in the Liberty dollar case where it was rather totally inappropriate (cf. here). However anonymous crypto currency is such a tremendous threat to the established legal and financial order, taxation, and such a powerful enabler for organized crime, that we should expect legislators to introduce new specific forms of crime related to anonymous digital currency. Interestingly, Zerocash allows also for non-anonymous usage.
Illustrations are under 123rf licence.
There is a considerable controversy around whether investing in a balanced basket of cryptocoins is a good idea.
Two serious sources show that this sort of investment enjoys steady growth without a lot of downturns, cf. DLT10 Index and a recent detailed study which concentrates on a shorter period with excellent returns since Jan 2016 (cf. also this curve for the whole of 2016).
A rebuttal paper was published by Coindesk: over a period of a few years, bitcoin is claimed to outperform altcoins.
I would like to insist on the moral aspect of investment and what it means for the jobs in the technology sector.
By investing in medium-sized altcoins, we make blockchain better and bring a lot of innovation and truly advanced technology to the market:
By investing in bitcoin alone, we promote stagnation and poor technology which is barely trying to get better. A dystopian financial network which does not function well. Bitcoin is the “Microsoft of cryptocurrency”, cf. interview by Dr Courtois in Nature, it has a toxic culture, it is owned and controlled by China, it has a bad habit to censor the dissident voices, it uses super-dodgy cryptography, and it is simply sad that bitcoin will at times outperform its competitors.
Many properties of bitcoin are self-defeating[Courtois] and lead to a programmed decline of bitcoin for example through skyrocketing fees [+557% in 2016!]. A very interesting curve to study is the so called bitcoin dominance curve. At moments bitcoin dominance reaches a peak [e.g. in Jan 2016 and again in Jan 2017]. Then it will reach a minimum, which happened in mid-March 2016 with the explosion of the Ethereum market. The long term trend is also, well less bitcoin dominance, more place for altcoins, which IMHO are THE investments which create some real value in this market. Let a thousand flower bloom.
We encourage students and young researchers to submit their paper or their thesis work to our research competition.
Submissions are extended until 31 October.
Cash prizes will be awarded and winners will be invited to present their work at an international blockchain conference.
JOB OPENINGS: several companies (mostly from UK) have contacted me: they would like to interview a selection of submitters for job and internships.
So how did the NSA backdoored the Internet or did they???
New ground-breaking paper shows that DSA and DH mod P keys with 1024 bits are vulnerable to practical backdoors which can be exploited to break our secure communications.
This is a SPECTACULAR reversal for the recommendation given by Bruce Schneier in Sep 2013 after being given the privilege of examining the bulk of unpublished Snowden files:
The impact is also MUCH LARGER than with ECCs: a much larger part of the Internet communications is encrypted using “conventional discrete-log-based systems” than with ECCs (their share is about 10%).