[DISCUSSION] How should we deal with attacks from Howard Chu and the rest of Monero community?

General
66

So Monero still uses mixns but how exactly are Bulletproofs being used in Monero? I understand that these are also a form of Zero Knowledge Proof but are inefficient compared to Zcash’s SNARKS…

How are zero knowledge proofs used in Monero vs those used in Zcash?

1 Like
67

I will be total honest, and the way you phrased the question I am going to do some googling.

Thanks mate. My monero is basic at best. I have asked ppl to explain it, but didnt get anywere. Im good on meta data - please point to some resources (time for me to rebreaking monero)

Thanks mate - I will post more as i get it.

1 Like
68

From my limited understanding, the quantity transferred within an XMR transaction is hidden by a range proof: the exact amount value is not shared, but rather it is inferred to be within an appropriate range(s) required to complete the transaction(s). Here is something I found that seems to corroborate: Proving amount of Monero - Range Proofs - Monero Stack Exchange

1 Like
69

Hmm interesting. I also would like to learn more… People like Justin Ehrenhofer have claimed before Monero uses Zero Knowledge Proofs in the same way ZEC does. — I think also it comes down to global anonymity set. Zcash has a larger one, and the more people who use Shielded addresses the stronger we become. Obviously right now not many use it but soon that will change…Where as with Monero this is not the case. I wish I could explain this better…hope someone can chime in here.

1 Like
70

Monero does use a “range” proof, but the range is very large, 0 to 2^64, so that’s not revealing very much (the example in that post about the range 50 to 100 is just an example of an optional add on kind of like a viewing key, not the monero protocol itself).

As for the use of Zk proofs, I’m still not sure the best way to explain the difference. Like I think it’s most accurate to say both Zcash and Monero use ZK proofs. Zcash uses SNARKs, but that isnt directly relevant to how it has a larger anonymity set either. What’s different is what the ZKPs are about. Mixins&key image vs the commitment tree&nullifiers. But this doesn’t seem so catchy or easy to understand

2 Likes
71

Pinging @Blazin8888 as you are answering his question too :slight_smile:

One question from me. Is it correct that a practically sized mixin ring signature (let’s say 11 like in Monero right now) would reveal much more information than commitment tree? Thus leading to things like EAE attacks.

2 Likes