Bytecoin vs Zerocoin vs Dark Coin vs..

Discussion of math, cryptography, protocol, and features

Bytecoin vs Zerocoin vs Dark Coin vs..

Postby MRSpock » Tue Apr 01, 2014 9:26 pm

Hi,

How does Bytecoin compare in regards to anonymity to its current and upcoming contenders?
Just some I have seen lately: Stealth addresses, Coinswap, Darkcoin, Zerocash, Zerocoin, Bitcoin mixers
MRSpock
 
Posts: 11
Joined: Tue Apr 01, 2014 9:24 pm

Re: Bytecoin vs Zerocoin vs Dark Coin vs..

Postby The-rocket-A » Thu Apr 03, 2014 4:14 am

I think I can try to answer your question about Bytecoin vs. Zerocoin. I have found this on bytecoin.org:

In front of widespread talks about Zerocoin (ZC) we want to make a few notes about this tech and how it compares with our ring signature. Leaving aside cryptographic mumbo-jumbo, we will consider only consumers features.

First of all, let us boast our benefits. To spend a single zerocoin you should produce a signature sized of 30-40 KB. No alternative. It implies high user fees and blockchain bloating.Our system offers a user to choose his anonymity level and the size of his signature: 96 bytes or more. A conservative size about 500 bytes provides you almost the same practical level of privacy as ZC. Moreover, our solution relies on elliptic crypto, which works (in general) noticeably faster than RSA-based ZC.

Yes, the flexibility of our scheme has one hypothetical downside. As we said, a user can choose his level of privacy. While we believe that ambiguity degree "one of ten" (~500 bytes) for each transaction input is enough for practical untraceability, some may disagree and choose "one of all-possible-inputs" with huge-sized signature. ZC already hides your payments among all transactions with the same constant: 30-40 KB. It perfectly suits for a low transaction rate, but our linear-sized ring signature is asymptotically better: both for users' pockets and the blockchain size.

Another important note is about trusted setup in Zerocoin. In easy words the whole system is based on some secret values nobody should know (for example, this secret allows to make a double spend). How to acquire these values? ZC devs says: we can generate them and then "forget" OR we can implement the special algorithm to do in a distributed way at the system start (everybody know only his own part of the secret). The second option, of course, is preferable, but the problem of trust still remains: there is no way for new users to be sure they are not fooled by the early adopters, who has generated the secret values. As you guess, our system has no such trapdoors: every parameter is public, as in original Bitcoin. We consider this as a major advantage over ZC.
And BTW we are already working =)
User avatar
The-rocket-A
 
Posts: 6
Joined: Tue Apr 01, 2014 5:04 am

Re: Bytecoin vs Zerocoin vs Dark Coin vs..

Postby MRSpock » Thu Apr 03, 2014 3:24 pm

Thx alot for providing this quote rocket man!
I think the author of the quote refers to the original ZC paper which had those large proof signature sizes in it. Now with Zerocash they have shrunken the size of those to 288 bytes (99% less)! Even with a Zerocoin implementation, those signatures do not have to be stored in the blockchain for long. So after some reasonable time has passed, they can just be deleted and thus help to keep the blockchain lean.
see here: http://www.reddit.com/r/Anoncoin/commen ... ins_perks/

The proofs of Zerocash can be computed by a i7 single core 2.7 GHz CPU in a matter of 3 minutes (source: http://youtu.be/l7LSSE0bRRo?t=8m9s ). So I think there would be no problem either for weak hardware to compute them in the short term future with quad core smart phones already out there, etc.

If the ZC implementation will be done with enough independent users participating (think 2000 random bitcointalk users download the set up and do the computations locally) I think trust can be reasonably established if a single user burning their hard drive afterwards would mean that the initial parameters are kept save for all time to come.

The obvious advantage IS that your implementation is in fact running and working already for 2 (?) years and has been tested in beta. Now that you have come forward with it alot of people have to review the project and I hope it will be a huge success. But I cant help to think that a couple of pitfalls will be discovered on the way that we cannot yet see/have not yet been told about.

I would love to see some peer reviews on cryptonote and bytecoin and feel thrilled to be among the early adopters this time :lol:
MRSpock
 
Posts: 11
Joined: Tue Apr 01, 2014 9:24 pm

Re: Bytecoin vs Zerocoin vs Dark Coin vs..

Postby Maurice.P » Thu Apr 03, 2014 7:56 pm

That is quite a number of various solutions. Each deserves a separate thread, but I'll cover them briefly.

1. Stealth address is a technique, which is most similar to ours. It is a protocol, which allows users to create one-time addresses (not linked to their main public key). Honestly, this is quite an old idea; the researchers have reinvented it several times, as I've recently noticed looking through the forums' posts and the research papers. It may vary in its implementation, but the underlying idea is the same. The main advantage of CryptoNote is that the one-time address is a DEFAULT option for sending/receiving the payments. So you don't have to enable anything manually; the total anonymity is already provided.

2. CoinSwap, CoinJoin, DarkCoin. I've intentionally combined them, although they are not the same. In short, these are the protocols that allow users to mix their payments with each others'. It can be done in a single transaction (CoinJoin) or through a transaction chain (CoinSwap).

One can say this is what we do with our ring signature, which hides your actual outputs among others'. Leaving the math aside, a distinctive feature of our solution is its autonomy. You do not have to interact with the other users, send anything to the network (except for your final transaction), wait for the peers to sign your common mixing transaction, or worry about hiding your activity. Everything is already in the block chain; I imply all the past outputs (no matter, spent or not). So you can create your entire transaction even being offline. Still, your payment will be perfectly hidden.

3. Zerocoin, Zerocash. This is the most advanced technology, I must admit. Yes, the quote above is from the analysis of the previous version of the protocol. To my knowledge, it's not 288, but 384 bytes, but anyway this is the good news.

They used a brand new technic called SNARK, which has certain downsides: for example, a large initial database of public parameters required to create a signature (more than 1 GB) and the significant time required to create a transaction (more than a minute). Finally, they're using a young crypto, which I've mentioned to be an arguable idea: https://forum.cryptonote.org/viewtopic.php?f=2&t=19#p55
Maurice.P
 
Posts: 63
Joined: Wed Mar 26, 2014 3:26 pm

Re: Bytecoin vs Zerocoin vs Dark Coin vs..

Postby Rias » Fri Apr 04, 2014 2:00 pm

Maurice.P wrote:The main advantage of CryptoNote is that one-time address is a DEFAULT option for sending/receiving payments. So you don't have to enable anything manually, the total anonymity is already provided.


Does "default option" mean that there are another options to send the payment for example not anonimously?
Rias
 
Posts: 2
Joined: Fri Apr 04, 2014 11:04 am

Re: Bytecoin vs Zerocoin vs Dark Coin vs..

Postby Maurice.P » Fri Apr 04, 2014 5:52 pm

Rias wrote:
Maurice.P wrote:The main advantage of CryptoNote is that one-time address is a DEFAULT option for sending/receiving payments. So you don't have to enable anything manually, the total anonymity is already provided.


Does "default option" mean that there are another options to send the payment for example not anonimously?


We believe this to be the underlying basics for the cryptocurrency, so by default you're anonymous. Of course, you can always indicate ambiguity degree of 0 in an attempt to de-anonymize yourself.
Maurice.P
 
Posts: 63
Joined: Wed Mar 26, 2014 3:26 pm

Re: Bytecoin vs Zerocoin vs Dark Coin vs..

Postby Johnny Mneumonic » Sat Apr 05, 2014 12:22 am

Wouldn't "de-anonymizing" yourself present a privacy threat to the person you're transacting with? If one party identifies himself, then associations could be made to possibly identify interacting parties. It seems there should be a minimum level of ambiguity, don't you think?
Johnny Mneumonic
 
Posts: 5
Joined: Thu Apr 03, 2014 2:11 am

Re: Bytecoin vs Zerocoin vs Dark Coin vs..

Postby Masniff.Hurricane » Wed Apr 09, 2014 7:09 pm

i read Adam Back twitter several days ago and he wrote "...cryptonote [...] is better than coinjoin + standard coin denominations" and then spent some time comparing you to zerocash.

you are recognized by such famous cryptographer. conrratz!
User avatar
Masniff.Hurricane
 
Posts: 8
Joined: Fri Mar 28, 2014 9:36 am
Location: Finland, Tampere

Re: Bytecoin vs Zerocoin vs Dark Coin vs..

Postby ochtend » Fri Apr 11, 2014 3:45 pm

As I understood ring signatures mix your transaction with the old ones (which are already in the block chain). What if I want to anonymously spend a non-round amount of coins (e.g. 123456 BCN) and there were no such sums in block chain history? How will ring signature hide my transaction? Is there any notification service, which can tell me if somebody just spent such amount, so I can mix my transaction?

Thanks!
ochtend
 
Posts: 3
Joined: Fri Mar 28, 2014 9:49 am

Re: Bytecoin vs Zerocoin vs Dark Coin vs..

Postby kuno » Fri Apr 11, 2014 9:20 pm

I've seen the transactions in action when it gets sent to my wallet. It breaks up the amount into multiple pieces.

For example 123456 BCN would be broken into:

100000 BCN
20000 BCN
3000 BCN
400 BCN
50 BCN
6 BCN
kuno
 
Posts: 1
Joined: Fri Apr 11, 2014 12:27 am

Next

Return to Technology

Who is online

Users browsing this forum: No registered users and 1 guest

cron