2018-05-07-logs-for-the-Monero-Research-Lab-meeting-held-on-2018-05-07.md 18.5 KB
Newer Older
1 2 3 4
---
layout: post
title: Logs for the Monero Research Lab Meeting Held on 2018-05-07
summary: Sarang work, Surae work, and miscellaneous
el00ruobuob's avatar
el00ruobuob committed
5
tags: [dev diaries, community, crypto, research]
6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236
author: el00ruobuob / surae
---

# Logs  

**\<sarang>** OK, it's time to begin  
**\<sarang>** Welcome to everyone; hello  
**\<sgp\_[m]>** Hi!  
**\<sarang>** Calling others: hyc suraeNoether anonimal endogenic binaryFate fluffypony luigi1111 luigi1113 rehrar[m] monerigo[m] gingeropolous dEBRUYNE  
**\<sarang>** and many others no doubt  
**\<sarang>** s/monerigo[m]/moneromooo  
**\<binaryFate>** présent  
**\<sarang>** I suppose we can discuss recent updates and such  
**\<sarang>** I have been focusing on noninteractive refund transactions  
**\<sarang>** it's surprisingly tricky to get right  
**\<sarang>** The idea of whether or not to hide block heights has big implications on size and complexity  
**\<sarang>** and also will affect the use of old outputs  
**\<theRealSurae>** Hey everyone, sorry I'm late (and not using my registered nick)  
**\<sarang>** A good higher-level question is whether we insist that having refund transactions is enough of a priority  
**\<sarang>** Hello fake suraeNoether  
**\<theRealSurae>** heh  
**\<sarang>** \*enough of a priority to devote big plumbing-level changes  
**\<sarang>** these questions have consumed me as the Whale consumed Ahab  
**\<sarang>** and, like Ahab, I spend much time in the company of Starbuck(s)  
**\<theRealSurae>** gross  
**\<sarang>** theRealSurae: what has consumed you lately?    
**\<UkoeHB>** it feels like there should be an easier way to hide amounts. Maybe worth mulling for some time  
**\<sarang>** UkoeHB: other than commitments?  
**\<rehrar[m]>** Hi  
**\<UkoeHB>** Yeah. Maybe a shift in perspective. Baseless intuition  
**\<silur>** what  
**\<sarang>** Well, the current Best Way is homomorphic commitments + range proofs to ensure balance  
**\<theRealSurae>** I've been thinking about koe's reduced mlsag and how we might be able to batch-verify ring signatures with bulletproofs. and i've been speaking with a professor at clemson university about the possibility of starting a paid project for a grad student to invent a new elliptic curve with 2^255-19 points on it, or to come up with a similar sort of variant to secp256k1  
**\<theRealSurae>** yeah, I think we are going to experience reduced returns in terms of hammering bulletproofs for improving our amount strucutres  
**\<sarang>** theRealSurae: BPs to batch verify our current MLSAG scheme?  
**\<silur>** oh yea the curve order question you asked  
**\<theRealSurae>** so, i think it'd be really really helpful for both bitcoin and monero to have alternate curves  
**\<theRealSurae>** ohgod  
**\<theRealSurae>** other than that and the multisig dump I made the night before yesterday, this week has been consumed by editing papers for other folks. Koe and my old advisor and another document. lots of reading this week  
**\<sarang>** What are your thoughts on refunds?  
**\<UkoeHB>** and thank you for that :) incredibly helpful  
**\<sarang>** UkoeHB: any big changes to your excellent paper?  
**\<UkoeHB>** Well we found out monero doesn't even use borromean sigs  
**\<UkoeHB>** genBorromean should be genSAGs  
**\<UkoeHB>** Or something  
**\<sarang>** SAG?  
**\<theRealSurae>** I've been thinking a lot about the refund structure with timelocks, and I'm trying to figure out exactly whether we have a novel "invention" in these refund transactions or whether tit is equivalent to a timelock+multisig situation  
**\<UkoeHB>** spontaneous anonymous group sig. Like LSAG but no key images  
**\<sarang>** for range?  
**\<UkoeHB>** Yeah  
**\<UkoeHB>** Check ringCT.cpp genBorromean  
**\<sarang>** Yeah I'm familiar with that code  
**\<UkoeHB>** It's 33% larger range proofs than a real borromean setup  
**\<theRealSurae>** ... i need more details about that, koe, if you don't mind...  
**\<sarang>** heh  
**\<sarang>** theRealSurae: big thing is non-interactivity  
**\<sarang>** I don't need the recipient's cooperation  
**\<UkoeHB>** I'll see what I can do  
**\<theRealSurae>** thanks koe, i'm not in a rush on that though...  
**\<theRealSurae>** I want to remind everyone that I'll be mostly away from the internet from tomorrow until the 19th, with some intermittent access.  
**\<moneromooo>** luigi1111: is this (genBorromean doesn't actually generate Borromean sigs) correct ?  
**\<UkoeHB>** yup have fun :). Vacation right?  
**\<theRealSurae>** i'm not the sort who can really put work down, but i'm trying, briefly. i managed to write up a skeleton of the unforgeability proof for multisig and hand it off to sarang to familiarize himself with the musig approach  
**\<binaryFate>** Zcash is also coming up with their own curve so as to speed up the particular things they need to. I find it worrying if the trend is that every project cooks up their curve to suit their particular needs.  
**\<theRealSurae>** and, like I said, I'm communicating with some folks at Clemson  
**\<sarang>** Yeah I've been revisiting the original musig paper  
**\<luigi1111>** Not that I know of  
**\<theRealSurae>** binaryFate: why would this be worrying?  
**\<luigi1111>** theRealSurae: 2^255-19 isn't the number of points  
**\<theRealSurae>** you are right, it's the group order  
**\<binaryFate>** against the "don't invent your own crypto", and light years away from typical review process for curves  
**\<theRealSurae>** right? i misspoke  
**\<vtnerd>** no, 2^255-19 is the prime field  
**\<sarang>** I hear it's a kind of cake  
**\<sarang>** Or that feeling when your leg falls asleep and you stand up  
**\<luigi1111>** Group order is l  
**\<luigi1111>** 2^252+blah  
**\<sarang>** aaaanyway  
**\<theRealSurae>** i confess I tend to think of our group as a scrambled mirror image of Z\_q, despite addition of points not even landing on the subgroup.  
**\<sarang>** So theRealSurae is working on unforgeability  
**\<sarang>** I am figuring out if noninteractive new-output-style refunds are worth it  
**\<sarang>** Other fun times?  
**\<theRealSurae>** binaryFate: yeah, I see that  
**\<sarang>** binaryFate: do you have any information on the Zcash efforts? I wasn't aware of their work  
**\<theRealSurae>** binaryFate: eventually that curve, even if proven to satisfy our desired properties, will have to be implemented, and the dangers or crappy implementation are huge... but I don't think that should discourage research into new curves and new proof methods using isomorphic curves  
**\<theRealSurae>** yeah, I wasn't either. I thought it was just Blockstream looking for a variant of secp256k1 so far  
**\<UkoeHB>** oh i messed up - they are borromean ugh  
**\<theRealSurae>** that's a relief koe!  
**\<sarang>** UkoeHB: what led to believe otherwise?  
**\<luigi1111>** ^  
**\<UkoeHB>** misreading code like a fool  
**\<UkoeHB>** thought this hash\_to\_scalar(L[1]) meant an array of hashes for each L[1], instead of a hash of the entire array  
**\<sarang>** Good thing hashes aren't important to borromean sigs /s  
**\<sarang>** If there aren't any other big topics to discuss, we could certainly return to refunds or previous topics  
**\<sarang>** There were suggestions from luigi1111 that the refunds needed for payment channels would be possible purely w/ timelocks + multisig  
**\<binaryFate>** will look for some link on the zcash curve thing. It's part of their roadmap to reduce overhead to generate z-transactions iirc  
**\<sarang>** I do not see how that would be possible without interaction from both parties, or a third-party arbiter  
**\<sgp\_[m]>** I just want to mention that I'm working on preserving the integrity of outputs held by mining pools  
**\<sarang>** But I'd love to be convinced otherwise  
**\<rehrar[m]>** MRL corporate cheer!  
**\<sarang>** sgp\_[m]: in response to the linking work?  
**\<luigi1111>** It does require interaction at the start  
**\<sarang>** right  
**\<sarang>** it'd have to  
**\<sarang>** So the recipient pre-signs for the refund?  
**\<rehrar[m]>** I have a bit of other ZCash news.  
**\<sgp\_[m]>** sarang kinda, yeah. I don't have too much to mention now though  
**\<sarang>** How does the network verify the spend of the originally-intended output?  
**\<sarang>** sgp\_[m]: ok, keep us updated  
**\<sneurlax>** I've contacted ehanoc re: the "transaction tree" python toolkit and we will collaborate to deliver that after I finish the scraping tool which moneromooo asked for.  mooo, I'll be sending you results this week  
**\<sneurlax>** sorry to interject  
**\<sarang>** sneurlax: excellent! That'll provide good data  
**\<theRealSurae>** rehrar[m]: tell us?  
**\<theRealSurae>** sneurlax: that's fantastic news  
**\<rehrar[m]>** ZCash wants to open a grant proposal jointly with a Monero community member (that'd be me atm) to donate a considerable sum of money to some FFS proposals.  
**\<sarang>** What types of FFS do they want to fund?  
**\<theRealSurae>** how would that work? would you have discretion over donating the funds?  
**\<rehrar[m]>** https://twitter.com/socrates1024/status/993252058923925506?s=19  
**\<theRealSurae>** i'll almost always take free money if it's no-strings  
**\<sarang>** Aw shucks, they like us!  
**\<theRealSurae>** that's... fantastic  
**\<rehrar[m]>** Dunno. When next round of bp auditing funds?  
**\<rehrar[m]>** We can out it up, raise the amount, and take out right away. Superior Coin also wants to help if you recall.  
**\<rehrar[m]>** Perhaps we can also get subaddresses audited?  
**\<theRealSurae>** hmm  
**\<sarang>** Yeah, was thinking of waiting until closer to the finalization, but I suppose there's little advantage if we can coordinate w/ OSTIF quickly  
**\<theRealSurae>** it seems like a lot of projects want to funnel their research funding through the Monero FFS  
**\<binaryFate>** the harder we criticize them the more they like us... 10k$ is not that much compared to amounts raised typically anyway  
**\<sarang>** It's a nice gesture of community spirit though  
**\<sgp\_[m]>** I think the best ones are the hardware wallet (which should work with Zcash iirc) and code audits  
**\<rehrar[m]>** They're masochists binaryfate. If we criticize harder they'll give more.  
**\<sarang>** A subaddress audit depends highly on the scope  
**\<sarang>** The BP scope was narrow-ish  
**\<theRealSurae>** binaryFate: yeah, it seems like a largely symbolic thing, but also: they've been really encouraging me and sarang to encourage you guys to ask for grant money.  
**\<theRealSurae>** rehrar[m]: i should just take zooko out to a bdsm club in denver, see if they offer us six or seven figures. :P  
**\<rehrar[m]>** In return , we can send them Monero stickers to put on their laptops.  
**\<sarang>** something something meat market  
**\<theRealSurae>** meat meat something market  
**\<binaryFate> \<rehrar[m]>** In return , we can send them Monero stickers to put on their laptops. <-- they have one at least, we've put one on zooko's back at CCC without him noticing  
**\<sarang>** I'll be interested to see how the 10K is disbursed  
**\<theRealSurae>** sarang: Is the implication that it would totally be up to our discretion? that's sort of what i'm getting...  
**\<rehrar[m]>** Zooko is a dude.  
**\<rehrar[m]>** I chilled with him in Colorado.  
**\<rehrar[m]>** Can neither confirm nor deny Verge dev there too.  
**\<theRealSurae>** What if we take the 10k, pay for a semester of a grad student working with some cryptographers to invent three new curves, a variant for secp256k1, a variant for x25519, and a variant for zcash's thing  
**\<sarang>** tall order  
**\<theRealSurae>** maybe  
**\<endogenic>** sorry rehar  
**\<theRealSurae>** it'd guarantee that student would spend the rest of his time in grad school working on that sort of thing  
**\<theRealSurae>** which I think would be a valuable thing: seed the mind-virus among as many researchers as possible  
**\<binaryFate>** They're not even asking for doing joint work with zcash stuff at this stage apparently. Would just channel to Monero topics entirely if possible.  
**\<pwrcycle>** Hi all.  
**\<binaryFate>** Anyway grad student is a great idea  
**\<theRealSurae>** binaryFate: yeah, that's the inference I made  
**\<rehrar[m]>** I'll talk with Miller.  
**\<rehrar[m]>** See how he wants to do the grant proposal.  
**\<theRealSurae>** binaryFate: the problem then is picking the student/school  
**\<pwrcycle>** Funding grant money for school research seems cool. Pinning all the hopes on one grad student seems like a bad idea.  
**\<theRealSurae>** rehrar[m]: please do, maybe CC me... I can hook him up with at least two cryptographers at Clemson who may be interested  
**\<theRealSurae>** pwrcycle: yeah, you'd pick by advisor more than student  
**\<rehrar[m]>** Maybe we can get some people to make a FFS that should have made one a while back in exchange for ZCash paper  
**\<rehrar[m]>** Like dEBRYUNE  
**\<rehrar[m]>** Then again, what use have gods for our petty currencies.  
**\<binaryFate>** Btw having some sort of pulic call for the paid internship circulating in academic circles is as important as the thing actually happening, in terms of mind-virus spreading  
**\<rehrar[m]>** Nothing more from me.  
**\<theRealSurae>** rehrar[m]: you are the greatest orator of our time  
**\<theRealSurae>** binaryFate: TRUE point  
**\<theRealSurae>** very true  
**\<theRealSurae>** sarang  
**\<sarang>** yo  
**\<theRealSurae>** when I get back I'm going to look into putting job postings on mathjobs.org  
**\<theRealSurae>** i was about to ask you to do it while i'm gone, but it's not urgent and there's no need to delegate. :P if you're curious, though :D  
**\<sarang>** I think using mathjobs is a really good idea for pure math applicants  
**\<theRealSurae>** there are lots and lots of applied jobs on there too  
**\<theRealSurae>** you should check it some time, but  
**\<theRealSurae>** creation of a curve is at the intersection of applied algebraic geometry and pure cryptography  
**\<sarang>** right, that wasn't what I meant  
**\<theRealSurae>** so it's sort of both pure and applied  
**\<theRealSurae>** oh ok  
**\<sarang>** I mean to get solid reach to academics  
**\<sarang>** that's the obvious choice  
**\<theRealSurae>** yep  
**\<sarang>** They can send us a list of all the points on their new curve, for us to check  
**\<binaryFate>** good old emails circulating between labs and advisors ("if you have a really good students, consider asking them to apply. And please forward blabla") is also worth it. Reaches more senior people than a job posting probably read primarily by students directly.  
**\<sarang>** Oh, so I've been seeing random reddit postings about deep reorgs  
**\<sarang>** But I haven't looked into it at all  
**\<sarang>** Anyone know anything?  
**\<selsta>** also articles are starting to come out https://www.trustnodes.com/2018/05/07/monero-allegedly-attack-claims-double-spends-orphaned-chains-21-block-deep  
**\<moneromooo>** I think it's fixed now (no PR yet).  
**\<sarang>** Do you know the cause?  
**\<theRealSurae>** is it known what the issue was?  
**\<sarang>** jinx  
**\<binaryFate>** The +20-blocks fork mentioned in the post is not an actual fork, you only see that when syncing. But somebody is fiddling with decent HR  
**\<sarang>** buy me a DietMonero  
**\<theRealSurae>** i thought the first few reports were possibly the OP for some reason  
**\<binaryFate>** moneromooo link or summary?  
**\<moneromooo>** Some init wasn't done in some cases when adding a tx.  
**\<sarang>** Yeah, I want to be able to give correct information  
**\<moneromooo>** So that was causing the tx to be rejected though it is valid.  
**\<theRealSurae>** hrmm  
**\<sarang>** OK, so that explains the "double spend" FUD  
**\<sarang>** The long-chain reorgs are just related to initial sync?  
**\<sarang>** It was noted that there wasn't any big spike in hashrate  
**\<sarang>** so it's not outsiders coming online and futzing  
**\<moneromooo>** If a pool doesn't accept a valid tx, it will continue mining on its own chain till it stops doing so.  
**\<sarang>** OK, so it's a single cause with these two effects?  
**\<moneromooo>** What two effects ?  
**\<sarang>** Well the reports I've seen have complained about apparent double spends (rejected tx) and long-chain reorgs  
**\<theRealSurae>** i feel like if a selfish miner was going to release a chain in an attack, the hashrate wouldn't necessarily look different to an observer, especially if the attacker had 33%+ attack power and was clever with their timestamp choice...  
**\<moneromooo>** I don't know anything about double spends.  
**\<moneromooo>** Though if a merchant is only connected to that pool, you could swindle it.  
**\<moneromooo>** The merchant would have to be only connected to that pool though, but that's not a new attack.  
**\<sarang>** Yeah that's just being cavalier  
**\<theRealSurae>** https://www.trustnodes.com/2018/05/07/monero-allegedly-attack-claims-double-spends-orphaned-chains-21-block-deep  
**\<theRealSurae>** i don't like that article for a variety of reasons, but  
**\<sarang>** Yeah that's the article I keep getting linked to  
**\<sarang>** it's based on some r/monero complaint posts  
**\<sarang>** so naturally it will be accepted as gospel and spread widely  
**\<theRealSurae>** it would be helpful to get more information from the specific users making this complaint  
**\<sarang>** A random user says one thing and the devs who know things say another thing! So there's no way to know!  
**\<binaryFate> \<sarang>** It was noted that there wasn't any big spike in hashrate <-- if someone is purposefully mining on alternative blocks rather than winning chain, we would not "see" the HR spike as it does not make blocks coming faster  
**\<moneromooo>** You'd see a hashrate spike downwards.  
**\<binaryFate>** only if that miner was mining before no?  
**\<moneromooo>** Yes.  
**\<theRealSurae>** not necessarily; an attacker with exactly 50% hash rate and honest timestamps will appear to be invisible. an attacker with lower hash rate could mess with timestamps slightly and appear invisible. an attacker with too low of a hash rate couldn't manipulate his timestamps enough to hide his activity  
**\<theRealSurae>** (not necessarily re: downward spike)  
**\<binaryFate>** Can we check how long it took them to mine a particular altchain of N blocks by checking logs on other nodes on when the last block in their chain got known to peers?  
**\<theRealSurae>** we can put a bound on it, for sure, and we can use that to estimate the hash rate power they have  
**\<theRealSurae>** ok y'all I gotta go  
**\<theRealSurae>** have a good week and a half!  
**\<binaryFate>** same!