then yes

esp if we can get 2020/020 i'm a sucker for that

so, good news: the fields institute is paying for travel. :D

sooooo what should i talk about

Comparison of lelantus/triptych/omniring/rct3 ?

And how these are still progressing.

Or is that too obvious ? :)

A discussion of the current state of the art for trust-free protocols could be nice

It often feels like trust-heavy proving systems and protocols occupy a lot of attention

so triptych takes a bunch of signatures, and somehow morphs the index location of a given signature amongst other signatures to some math gibberish that when combined with a new gibberish morph of a signature return 0

forgot my ?

Im looking at the extra field of a transaction: "extra":[1,...transaction pub key...,2,9,1,80,183,247,67,174,198,16,201]; the '2, 9,...' sequence must be the payment ID (probably a dummy) where 2 is the tag and 9 is the number of bytes; I was under the impression encrypted payment IDs were 8 bytes, am I mistaken or is there something else going on

here?

Am I correct in assuming the goal for Triptych implementation is to utilize larger anonymity sets with a smaller increase in computational time/effort?

amulet_dingy[m], i think that is true. That is the goal for any of the new protocol candidates afaik

size is also a consideration, though i personally have that ranked pretty low

The idea is to have better size scaling, with presumably linear verification time scaling that can take advantage of batching to bring down the marginal verification time

gingeropolous: the idea is to prove knowledge of a commitment opening within a list; such a proving system can be used as a building block for a linkable ring signature, as Groth and Bootle did in their earlier papers

yeah. i was trying to reword it in a way that i understand. i.e., one of the things in list A, when combined with something in list B, equals 0.

The way it works is that signing keys are commitments to zero, and Pedersen amount differences are commitments to zero if the amounts balance (and you construct the commitments in specific ways)

So you show that you (the signer) know the openings to these commitments

The trick is to do this in a linkable way and take care of the signing and amount keys at the same time

And now there are several distinct ways to do this, with different tradeoffs in size and time scaling and security: CLSAG, Lelantus, RCT3, Omniring, Triptych