-
sarang
Hello all
-
sarang
Working on updating some tests today
-
sarang
Fun times!
-
sarang
How's research
-
sethsimmons
My poor man’s research could use some friendly fact-checking/verification:
twitter.com/sethisimmons/status/1285336820264382468?s=21
-
sethsimmons
I was pretty surprised to discover that the recommended way to spend Bitcoin privately was 600b heavier on-chain than a Monero 1-in 2-out transaction, while still providing less privacy/being far more difficult/being far more costly
-
sarang
How are you defining "reasonably private" between the two?
-
sarang
1.7 kB is accurate for a typical 1-2 transaction on the Monero chain
-
sethsimmons
Being used in the “recommended” sense
-
sethsimmons
i.e. a normal spend in Monero
-
sarang
2.5 kB for a 2-2 (the other most common structure)
-
sethsimmons
And a spend from a mix/STONEWALL in Bitcoin
-
sethsimmons
For sake of simplicity I’m saying those are at least comparable in terms of privacy provided
-
sethsimmons
Even though I know they’re not really/there is a lot of nuance between the two
-
sarang
It would be interesting to see what you could get with Bitcoin at the same 1.7 kB level as Monero right now
-
sethsimmons
But they’re the two “recommended” ways to transact with some privacy on both chains
-
sarang
Also note that Monero transactions are about to get smaller
-
sethsimmons
Yeah
-
sethsimmons
Which makes this even more in Monero’s favor soon :)
-
sarang
So that 1-2 transaction would drop by about 300 bytes
-
sethsimmons
I don’t think you can do the recommended chain of tx0->Whirlpool->STONEWALL at less than 1.7kb
-
sarang
the 2-2 drops by about 600 bytes
-
sethsimmons
The chain I chose was fairly small and all utilized Segwit.
-
sethsimmons
1400b vs 2300b for a “private spend” 🧐
-
sethsimmons
Love it
-
sethsimmons
For costs I also gave Bitcoin the absolute cheapest costs possible in the estimate, and didn’t even count mixing fees/doxxic change in the estimation, and Monero is still 100x cheaper to transact in privately
-
dEBRUYNE
sarang: As a side note, any timeline on the CLSAG blog going live?
-
sarang
dEBRUYNE: I assumed we would wait until the audit report goes public, so we can link to it
-
sarang
This should be coordinated with OSTIF, who haven't approved the most recent draft version
-
sarang
It was recently updated to be more clear about preprint updates, so as not to cause any confusion to readers
-
dEBRUYNE
sarang: I see, thanks
-
dEBRUYNE
Is there any particular reason that they haven't approved the draft by theway?
-
sarang
The auditors just recently sent the draft update
-
needmoney90
What do the numbers look like if we push three digit ring sizes sarang?
-
needmoney90
Say 100
-
sarang
I can tell you in 15 minutes after a build
-
sarang
needmoney90: I assume you mean with next-gen protocols?
-
needmoney90
Yeah
-
needmoney90
Well, you were just talking about a new reduction
-
needmoney90
Didn't read far back enough to see if that was next hen
-
needmoney90
Gen
-
sarang
Oh, for sethsimmons
-
sarang
that was CLSAG
-
sarang
at current anon set size
-
needmoney90
yeah whats the reductions for clsag on triple digits?
-
needmoney90
Or for each of these formats for that matter
-
sarang
CLSAG at that size would be unreasonably slow to verify
-
sarang
and unreasonably large
-
needmoney90
What protocols would be best suited to triple digit rings?
-
sarang
Omniring, RCT3, Triptych, Arcturus
-
sarang
Depends on what properties you want/need
-
sarang
Multisig gets more complicated, batching depends on which you choose
-
needmoney90
In your opinion which is best suited?
-
needmoney90
For the tradeoffs
-
sarang
So the spacetime tradeoffs are illustrated here:
eprint.iacr.org/2020/312.pdf
-
sarang
page 12
-
sarang
It really depends what you want to optimize for needmoney90
-
sarang
Updated RCT3 does great for size, but sucks in practice for time because of its padding requirements
-
sarang
Arcturus does a good job for size, and is great for time
-
sarang
No padding restrictions for inputs (but there is padding needed for ring size, as they all have)