asciilifeform: reviewing definition of ring sig : some process , whereby a signature S can be verified against keys K1, K2, ... KN , but without revealing which K had produced it
asciilifeform: mircea_popescu: describe, for my education, how Proper ring signature differs from shamir's
asciilifeform: (or unless you want to make blocks ~very~ compact)
asciilifeform: mircea_popescu: it doesn't have to be capped at 2, either, unless you use casks and want to leave room for dozen+ hop stages
asciilifeform: for folx tuned in : it also makes the cask thing possible, but the latter is wholly separate, optional algo, it is possible to use traditional mempools with this scheme
asciilifeform: mircea_popescu: fixed-width tx buys us this algo. but not only it. for instance, an adult tx's unique index can be quite short : blknum_txoffset. this in turn saves space elsewhere, for all time.
asciilifeform: (and he cannot even begin to work on a block until he knows Z and goes, fetches the required old tx ! no other miner has any incentive to help him do this.)
asciilifeform: as far as i can see, this solves. Z depends on previous block, and the xor'd output is ~covered~ by the hash (and nonce) of the currently-worked-on block. so miner cannot craft his Z, he is forced to suck it up.
asciilifeform: ( Z from here-on in this gedankenexperiment is simply a value that determines which 3 -- if arity==3 -- old tx's get xor'd )
asciilifeform: .... another pill against 'waltzers' : Z depends on the ~previous~ block.☟︎
asciilifeform: what is the complexity of actually fetching the Nth tx , if you can also make use of the T(...)xorT(...)xorT(...) in every block.
asciilifeform: and we have the luby transform above.
asciilifeform: suppose that tx's (recall, fixed width) position in the block, is also kept inside it. (e.g., tx # 100 will start with a 16bit field containing 0x0064 .)
asciilifeform: (either this, or simply replace 'nonce' in the equation, with a Z, that is equal to a hash over the ~transactions in the candidate block~, considerably more painful to waltz than the nonce )
asciilifeform: what remains is to compute the minimal arity for the attack to be impractical. and prove said fact.
asciilifeform: in above example, the 'arity' of the xor is 3. and mircea_popescu will probably answer, when he comes back , that evil miner will waltz the nonce until the 3 necessary tx are the ones that fit in his pocket. but arity doesn't have to be 3.
asciilifeform: (statistically speaking, any sequence of blocks, will eventually end up luby-coded into future blocks ! )
asciilifeform: theoretically it also means that a tx, as time goes to infinity, will have infinite number of confirmations...
asciilifeform: this also entirely annihilates the possibility that a future enemy could monkey with contents of old blocks by finding hash collisions.
asciilifeform: there is no way to practically compute this value without having a copy of the blockchain. and it also ends up being luby-transformable into any one of the 3 old tx if you have the other 2. a kind of perpetual redundancy in the storage .☟︎
asciilifeform: T( nonce mod Tmax ) xor T ( H(nonce) mod Tmax ) xor T ( H(H(nonce)) mod Tmax ).
asciilifeform: say every new block , to be valid, must contain a tx-sized slot (not covered by the nonce hash, but see below) that is computed as follows:
asciilifeform: T(N) is an O(1) fetch, as spoken of earlier.
asciilifeform: ooook try this on for size : suppose fixed-width TX (as discussed earlier.) T(N) is the Nth tx, T(0) is the first tx in genesis block, etc. Tmax is the last tx in the currentheightblock.☟︎
asciilifeform: open problem. betcha one can find the pill for this.,
asciilifeform: the nonce is Q. miner has to now find an old block that , treated with the above walk, contains F(Q). and point to the block # and the requisite offset .
asciilifeform: the cheat -- works. say your hash is a keccak that eats 512b blocks and produces 512b block.
asciilifeform: as i currently understand it, mircea_popescu's algo had two major effects -- a) nodes have something valuable to sell b) all users are protocolically forced to retain all blocks
asciilifeform: but if standing up a brand-new node from scratch, with full verification (rather than dumb bitwise copy of existing node) takes a century...
asciilifeform: if you already live on mars, there is no problem in flying to mars, yes.
asciilifeform: in fact verification from-genesis is O(N^2) !
asciilifeform: eventually (given death of moore's law, already long ago) the minimal practical time will exceed the block interval, and then mega-headache.
asciilifeform: '@aeliasen @gnupg for fingerprints collisions are not interesting. There is no known preimage attack for SHA1. Keep calm and use OpenPGP.' << lel
asciilifeform: mircea_popescu: friend of yours from meatspace ?
