{"type":"rich","version":"1.0","author_name":"npub1ac86vemj7ce5z8jyxt39rna3tvwql6xd30ha3vxcd6esysp23d9qrlswfj","author_url":"https://nostr.ae/npub1ac86vemj7ce5z8jyxt39rna3tvwql6xd30ha3vxcd6esysp23d9qrlswfj","provider_name":"njump","provider_url":"https://nostr.ae","html":"📅 Original date posted:2013-05-15\n📝 Original message:On Wed, May 15, 2013 at 08:40:59AM -0400, Caleb James DeLisle wrote:\n\u003eIf the commitment is opaque at the time of inclusion in the block then\n\u003eI will create multiple commitments and then after revealing the\n\u003ecommitment and spend to you I will reveal the earlier commitment which\n\u003ecommits the coins to an address I control.\n\nBit-commitments are based on deterministic one-way functions eg like SHA1(\nSHA256( public key ) ) Obviously it has to be a different one-way function\nto the coin address calculation which is RIPEMD( SHA256( public key ) ) as\nthat is already public.  Alternatively it can be a different serialization\nusing the same hash eg RIPEMD( SHA256( 1 || public key ) ).\n\nThere is only one commitment possible per public key - so you can only\ncreate one commitment that would validate to a receiver, or to the network. \nThe network checks that there are no non-blind double spends of committed\ncoins which it can do as spends require disclosure of the public key, which\nallows existing commitments to be verified, and it similarly qchecks that\nthere are no blind double-commitments.\n\nEach committed coin would be:\n\none-spend-commit = Com( spender pub ), Com( transaction )\n\nwhere Com is implemented as the above hash.  The network just places the\ncommitments in order as with conventional transactions.\n\nThe committed coins are not linkable to your non-blind coin because you did\nnot reveal your public key in the (largely passive) act of receiving to a\ncoin address.\n\n\u003eOn the topic of reversibility, I suspect in the long term the lack of\n\u003echargebacks will create issues as criminals learn that for the first\n\u003etime in history, kidnap \u0026 ransom is effective. \n\nThe temporary unlinkability (until commitment reveal) is a necessary side\neffect, not a cryptographic anonymity feature like zerocoin.  The\ntransactions are identical to bitcoins once revealed.  How long the\ncommitted transaction chains can be between reveals is an implementation\nchoice could be 1 hop, or as long as you like.  (Actually it appears to be\nup to the individual users how long the maximum chain they accept is - the\nnetwork itself, though ordering the committed spends (if there are multiple\nspends on the same key) cant even tell how long the commitment payment\nchains are).\n\nObviously the first coins in the network ordered committed coins on the same\nkey up to the coin value are spends as verified by the recipient, the rest\nare double-spend and ignored.  If someone wants to waste fees by sending\nmore spends than there inputs thats up to them.\n\nProbably the typical user doesnt care about long committed chains  other\nthan their wallet will bloat if the chains are too long, so probably they\nwould periodically compact it by revealing the long chains.  Committed coins\nare probably a bit less SPV client friendly, though with correct formatting\nin the merkle trees between blocks, probably a committed coin holder can\nprovide enough proof to an SPV client to verify even multi-spend committed\ncoins directly (without a network feed).\n\nAbout privacy, up to the entire commitment chain can be opened at any time\n(to other people or to the bitcoin network in general) with the cooperation\nof any user on the chain (up to the point they saw it), so while the blind\ncommitment protocol is not vulnerable to a \u003e 50% power quorum unilaterally\nimposed policy (without even needing client updates), it is fully dependent\non the good will of the recipients for its temporary unlinkability.  Thats\nthe point: it puts policy control in the users hands not in the \u003e 50% power\nquorum.\n\nIf you want cryptographic anonymity its better to look to zerocoin.  You may\nhave noticed zero coin talked about optional fraud tracing.  Its usually\ntrivial to add tracing to an otherwise privay preserving protocol.\n\nThe blind commitment if implemented as described (and its not obvious how to\nget more privacy from it) offers somewhat like community policing.  Users on\nthe chain can still themselves do fraud tracing, or any policy they choose,\non any blind committed coins that they receive.  If they dont like the\ncolour of them they can refund them.  The point is to enforce that this is a\nfree uncoerced community choice, by individual end users, not a \u003e 50% cpu\npower quorum choice surreptitiously imposed.\n\nAdam"}