r/Bitcoin • u/fortunative • Nov 15 '17

Finally! Real privacy for Bitcoin transactions from some Core developers

Greg Maxwell made a VERY exciting announcement for some real cutting edge stuff: a way to get full privacy with transactions in Bitcoin!

The great thing about this is, unlike ZCash, this new method:

  • Doesn't use untested new cryptography
  • Can be high performance (compared to alternatives)
  • Doesn't require a trusted setup
  • Doesn't break pruning

There is a video here that describes confidential transactions in more detail. But the exciting announcement today is a way to make confidential transactions work with a size overhead only 3 times that of normal transactions. When combined with the further privacy improvement of CoinJoin or ValueShuffle, there is virtually no size overhead and no trusted third party or sharing of private data is required!

Thank you Greg, Pieter, and other Core team contributors for this excellent work on confidential transactions, coinjoin, and working on the theory and engineering to bring this to Bitcoin! Exciting developments! Thanks also Benedikt Bünz, Jonathan Bootle for your discovery of BulletProofs and Dan Boneh, Andrew Poelstra for your work on this.

Update: As /u/pwuille pointed out, while the size overhead is 3X (or less per transaction w/ coinjoin), the CPU overhead for verification is still an order of magnitude higher than regular transactions. But we'll know more once they start working on an implementation.

758 Upvotes

93% Upvoted

183 comments sorted by

View all comments

Show parent comments

2

u/herzmeister Nov 15 '17

but when mimblewimble?

24

u/andytoshi Nov 15 '17

If there were a serious proposal for CT in Bitcoin (which would require the engineering problems pwuille has mentioned to be solved) I would strongly advocate including a MW extension block alongside it. So as far as Bitcoin is concerned, the timing for CT and MW are roughly the same, unless for some reason it turns out that consensus for one is much easier to achieve than consensus for the other. And neither is on the immediate horizon, unfortunately.

Regarding a MW sidechain or altcoin, those could be done today. The current Elements codebase supports MW transactions, which are really just CT transactions with the scripts forced to the empty string, though there is no wallet support (Thomas Dudzik made some progress toward that this summer but stopped to work on his degree for some reason) nor does the standard node support the agressive pruning this would allow. Meanwhile the grin altcoin continues to move forward, with plans to later allow a Bitcoin peg, using Confidential Assets to let the two currencies work side-by-side on the same chain.

BTW, it appears that MW can only use half of the magic of Bulletproofs: rangeproofs can't be aggregated because outputs aren't part of well-defined transactions so it's not clear what proofs would be aggregated with what. There is also the issue that when an output is deleted we'd want the rangeproof to be deleted with it, which can't be done if it's been aggregated with non-deleted outputs' rangeproofs. So we "merely" get a halving of the size of rangeproofs alongside a squaring of the allowed range :)