<carrington[m]> "Other than the Paymo paper (..." <- Here's another approach by Sarang/Surae/others (unless you were implying DLSAG isn't in the cards for Monero): reddit.com/r/Monero/comments/bvz97k…interactive_refund_transactions_for

Small comment on Lelantus compatibility: reddit.com/r/Monero/comments/bvz97k…ive_refund_transactions_for/epwg0z1

Note that approach would require a pretty significant change to the protocol and they also recommend hidden time-locks. So still not seeing a case for clear unlock times on-chain

And clarifying on how PayMo recommends a lock time lock-like feature, it recommends the use of time-lock puzzles that are solved off-chain looks like

<jberman[m]> "And clarifying on how PayMo..." <- I remembered that this is the homomorphic time-lock puzzle (HTLP). Afaik HTLP relies on RSA groups. However, I don't quite understand when I first read it if the "trusted setup" in RSA groups is "bad". I might take another look on that paper.

Also my interpretation of Paymo is that they _settled_ on the offchain timelock puzzles, _because_ Monero "doesn't have time-locks". Quote:

"One of the main challenges that we face in constructing a fully-compatible PC for

Monero is the lack of a time-lock functionality of its scripting language. To “simulate” this functionality

off-chain, our constructions will resort to the usage of time-lock puzzles (p. 6)"

Weren't lock times a thing when they wrote this? November 2020

jberman: I don't know. I just arrived here around April this year.

I assumed they meant a more expressive lock-time contract that allows you to spend before the lock expires by that like an HTLC

jberman: Yeah. I think HTLP looks something like this. Is the "monero timelock" not like this?

No an output gets locked and can’t be spent until the time expires

In Monero’s today

Oh that's different. Time-Lock Puzzle is like the classic RSA encryption, except that I give the private key, BUT the decryption computation can take an "arbitrary", but controlled, time.

Now I don't know about the Monero's timelock feature. If the discussion here is about removing it, I'm sorry I am not knowledgeable enough for that.

sirs?

I don't know well the whole Monero algorithms (my apologies) so I have a little question :

Monero nodes (monerod) makes several verifications concerning the block to add to the blockchain (valid format etc),

but does monerod also verify (at least basically) the quality of the decoys used in each transaction inside the block ?

This is the validation it does on quality of decoys: github.com/monero-project/monero/bl…te_core/tx_sanity_check.cpp#L87-L99

It's very basic and doesn't assess whether the selection of decoys matches the expected distribution. Reasons I've seen mentioned for not doing deeper validation: (1) added complexity, (2) potential for non-uniform floating point calculation to cause a chain split, (3) edge case scenarios such as delayed tx broadcasting that would fail

Doing deeper validation in that area is something Rucknium and myself are giving more thought, talked about it in point 4 of this MRL post to improve decoy selection algo: monero-project/research-lab #86

I see it's indeed very basic. Thanks for pointing to the piece of code.

np :) this is also a great vid by isthmus discussing the topic if you're interested: youtu.be/XIrqyxU3k5Q could be mistaken but I believe the validation was added after that research

For those who don't want to use youtube :

This is not part of the consensus. You can't do meaningful statistical tests on small numbers of data points.

Ah true, I see, it's just on tx submission and can be bypassed

in regard to the decoy selection, could the distribution to which the decoys are selected be dynamically addapt? like the probability of a decoy selected from a block n nodes before the current transaction is calculated based on the blockchain and updated every block and then for a new transaction according to this distribution the decoys are getting sampled. I dont know much about the security of this approach, but wouldnt the

guarantee that the decoys are sampled perfectly?

s/addapt/addapted/

this is an approach Rucknium is looking into, but as far as security goes, a challenge with it is that it would allow an attacker to get the decoy selection algo to mold towards selecting their own outputs in higher frequency, thereby making a flood attack easier

ahh ok i see

<ferretinjapan> "sirs?" <- Wow, long time no see!

:)

moneromooo: I used to think this too. In another channel someone brought this up again and i decided to just run a K-S test comparing a uniform selection of 11 observations against the current gamma distribution.

Result: K-S test strongly rejects, at p-value < 0.001 . I think the reason for this is that the gamma tails are just so long and thin. A uniform selection is just too different from the long and thin tails.

So right now with only 11 ring members, a mixin selection algorithm that is extremely out of sync with gamma (e.g. uniform) could be rejected.

And as the number of ring members rise in the future, as planned, the statistical power of the K-S test (or a similar test) would only rise.

I assume the spurious rejects would lead to a re-roll.

Do you have a better way ? If not, do you think those re-rolls would by themselves bias the distribution ?

Yeah, I don't see much danger in a re-roll. It can be almost instant if the check is also done at the wallet level

moneromooo: We already did that simulation with rejection at the p < 0.05 level . Result is variance, mean, and skew change by about 1 percent.

I suppose this can be pre-corrected by biasing the distribution in the other direction anyway.

A "better way" just requires more research. Rome wasn't built in a day. New statistical techniques can be developed just like new cryptography can be developed. Or, more likely, just adopt something that already exists in the vast statistics literature.

Yeah, probably. I see these things as pretty surmountable obstacles.

The thing tail is a good point. Though it also means the actual spend being old would bias the pick a lot.

So you might have to bias the distribution on purpose if the real spend is old.

...in order to properly hide the real spend. Yeah, possibly

As ring size rises, that would become less important.

<Rucknium[m]> "moneromooo: I used to think this..." <- "I used to think this too" ... what is this thing you think too ?

(... matrix muddle is sometimes hard to follow)

> <@hoverhalver:monero.social> "I used to think this too" ... what is this thing you think too ?

> (... matrix muddle is sometimes hard to follow)

thanks for asking, i was afraid to ask hahaha

That statistical tests on small number of data points are not very useful.

Halver: atomfried "You can't do meaningful statistical tests on small numbers of data points."

(but the thin long tail is a convincing argument for why it can work in this particular case)

(though I think it's still likely to let triangular picks pass a lot)

Or, more specifically, that the Kolmogorov-Smirnov (K-S) test would never be able to reject that an empirical distribution was substantially different from some specified theoretical distribution with just 11 observations.

moneromooo: Thanks. And by "small number" you mean the 11 outputs ?

The K-S test is a general, nonparametric test, and is considered to have weak statistical power. (typically, the more general a test is, the lower statistical power it has)

Also, it would not reject static makeups (ie, all rings use the same fake outs). We've seen that happen before IIRC.

Halver[m]: yes.

And this matters because it's not about rejecting random things that just are unlucky, but rejecting wallets doing the wrong thing.

moneromooo: A simple test would not. About to get into computation expense nightmare territory: One could think about checking ancestor rings for the same static makeup, and reject if it is the same static mixins.

In any case, I do agree that these are tricky things, but it is work the expense in labor and capital to investigate the possibilities.

The thing I'm worried about it how much it'll slow down tx verification.

I guess we'll know when it's done :)

I feel like this approach with working code is under-appreciated in this discussion: monero-project/research-lab #86#issuecomment-921805298

<moneromooo> "And this matters because it's..." <- before rejecting (online) random unlucky patterns,

I suspect that an extensive offline analysis of the blocks for say the last 6 months could give informations about what and how Monero attackers are doing.

Does somebody know if such an analysis has been done in 2021 ? or in previous years ?

jberman: "People are remiss for not taking into account this code, which I just released an hour ago" 😜

hehe, I mean I brought up the approach in the original post too

Halver: Yes, in the last 2 weeks there has been extensive work done. It will probably be published within the next few days and it will know everyone's socks off.

* will knock everyone socks off

jokes on you, i never wear socks

The analysis is about this:

isthmus has been leading the analysis, with jberman, myself, neptune, carrington, and gingeropolous helping

<moneromooo> "The thing I'm worried about it..." <- maybe before doing complex verification, some simple verifications would already suffice to catch some fish.

Also, alternatively to rejecting suspect txs, maybe there could be some alert messages published saying "hi, there is suspect txs atm" ?

So if there are 100 messages in a row, we could know that something is happening.

* doing complex statistical test verification, some

Halver: "Something" being an attack by an adversary?

yes, what else ?

I think that the work on the July-August 2021 tx volume anomaly will eventually lead into an effort to have continuous monitoring for a FloodXMR-style attack.

Which can be done by just examining the on-chain data without any changes to Monero's code or consensus rules.

I was thinking exactly the same thing.

* same thing. Continuous monotoring.

also agree I think some simpler verifications would be an improvement if complex don't make the cut and/or are delayed a long time Halver

And, further, one could imagine launching a counterattack to a FloodXMR attack. The de-anonymizing risk of FloodXMR only really exists if a single entity (who has knowledge of the specific txs that are fake volume) is causing the volume rise. If it is multiple entities, then the attack is basically defeated.

With a continuous monitoring we would have some knowledge about what our adversaries are doing,

and thus, instead of guessing if we must try to impeach this or this (unknown) pattern, we could have a better idea about the patterns to survey.

something like a call to action to the community if a FloodXMR attack is detected?

atomfried: Yeah. Or spend some of that Monero Core General Fund XMR on tx fees. I mean, for a distributed approach we could write software that could be used by individual users to mount a counterattack.

It would be so exciting!

Paying people to spam the network is really time for people to bug out.

Yeah, but as far as I know there is no defense against FloodXMR. It seems to be an inherent vulnerability.

could also backfire if the attack is actually a big bang attack

And, it could be the case that by just having the counterattack plan available, it would deter an attack itself. Like nuclear mutually assured destruction.

Isn't the big bang attack somewhat mitigated by ArcticMine's work (and moneromooo 's coding work)?

General thought: If you want to use statistical test, I'd think you'd tie it directly into fees to punish the attacker immediately.

spackle: Wow. I love this idea. Would be complicated, though.

I kinda thought it was neat at first, but then I thought if you can detect it, why allow it in the first place, it just gives one more degree of freedom to an attacker.

It *might* work if you can only give non 0 or 1 probabilities that this is an outlier, with a fee slope.

But if you do this, you'll end up with most people rerolling until they get lowest fee. And some people who won't.

So you get anonymity puddles again, and leave the degree of freedom.

aw, thats sweet you consider me helping :)

Anyway, unless I understand wrongly, nothing can be done at the wallet level.

(Because, if I'm an attacker, I'll simply program my own wallet script which will let me do everything I want).

<moneromooo> "But if you do this, you'll end..." <- I'm assuming that we are discussing probabilities that are almost always non 0 or 1. Would it not be possible to ramp fees for everyone if a statistical test is failed? There would be no incentive for changing individual action, just a recognition that the current network activity is strange and therefore more costly to participate in.

Do you mean ramping up consensus fees if stat test of the recent blockchain as a whole gets too much out of kilter ?

That's interesting, and possible. Though it might open up a DoS.

That would moot my point yes.

I will say that for the recent July-Aug tx volume anomaly, the "Flood" was extremely obvious. If that's the best they can do, there is no problem with detecting it. I do not think that's the best they can do, however.

wait, it was confirmed flood attack?

sgp_ @sgp_:monero.social had some spreadsheets at some point showing how the effectiveness of flooding outputs falls off a cliff as ringsizes go up. Can't find it now though

sech1: it definitely didn't look like organic tx volume

not sure if their goal was floodxmr or something else

there was a similar event in dec 2020

Just thinking out loud... I imagine you'd limit the potential effect of the statistical test on fees.

sech1: Unclear if malicious or for "research purposes". isthmus should have a nice little article posted in the next 5 days or so.

Rucknium[m], did the analysis compare to the dec 2020 event?

sech1: there is a report being prepared on it, not sure on details yet.

sech1: We have produced overwhelming evidence that it is a single entity.

gingeropolous: No, not in this analysis.

Rucknium[m]: Can't wait to read it...

I though Dec 2020 was the naughty nodes causing issues rather than a flood attack

dunno that naughty nodes would cause tx spikes: bitinfocharts.com/comparison/monero-transactions.html#3y

but yeah thats a much different event than july 21

<carrington[m]> "sgp_ @sgp_:monero.social had..." <- onedrive.live.com/view.aspx?resid=4…ile%2cxlsx&authkey=!AOpTq2h4tkFKeUU

This flood attack probably is a good reason to do that hardfork quite soon

which hf?

Get more padding with larger rings and bump the base fee

I'd assume that the dip in December 2020 was because many people couldn't transact on account of the FUK nodes

what is the current status of BP+? could the hf include BP+ and a larger ring size?

<atomfried[m]> "what is the current status of BP..." <- Yes

That would be the plan for a HF, BP+ is ready to go AFAIK, and would offset some of the efficiency loss due to increasing ring size.

atomfried[m], the next dev meeting this sunday is about consensus changes for next hf

wait. not this sunday

whenever the next one is

Hey guys! Reuben from Firo here and noticed that there was some discussion on Lelantus Spark in here which I have been following on Discord but my messages weren't being piped through :( Also thanks for the shoutout sethsimmons!

I wanted to clarify some things about the relationship of Spark with Seraphis. Our Lelantus Spark construction was worked out independently without any knowledge of Seraphis/ZCT with our researcher Aram contributing the key ideas behind it. Spark was not designed as an instantiation of Seraphis which hadn't existed then (was still in an early stage and called ZCT).

In the process of making sure our Spark addresses were fine, Sarang had helpful discussions with UkoeHB in relation to payment proof construction, output construction and general feedback on addressing. This discussion benefited both Seraphis and Spark.

progress is good

I don't think anyone accused you of anything really. Or at least I didn't see it. Maybe on reddit but that's a troll site.

As UkoeHB mentioned, rather than being a full protocol, Seraphis is a tx protocol 'abstraction' and is described in a more general sense with several ways to 'instantiate it', while Spark is a full protocol with all components worked out. Seraphis is described generally enough that Spark can probably fit into this framework but Spark was not designed as a Seraphis instantiation.

Both constructions of course coming from similar ideas have a lot of similarities and I think it's a result of helpful discussions hence the credit to UKoeHB.

(oh, and except geonic but that was way tinfoil)

As for the question of anonymity sets we are playing around with sets of 32k-65k and have some tricks to get batching working really efficiently so we'll wait until we have full optimized code implementation but we'll definitely be happy to collaborate on this as we believe the privacy space needs more solid privacy protocols.

thanks moneromoo

Right now we're working on diversified addressing support (sub-addresses)

yes my tinfoil was extra that day

<Reuben> "As UkoeHB mentioned, rather than..." <- This is the best description that relates between the two.

Reuben: do you guys have any eyes on Halo 2 et.al.?

Yes my purpose in calling Spark an instantiation of Seraphis is just so no one gets the idea the two protocols/papers are doing fundamentally different things.

Compared to the difference between eg cryptonote/ringct/triptych/etc

Also, if the papers overlap, then security proofs/models back each other up, which is why I increased the level of abstraction of Seraphis compared to early drafts. More generally, a higher level of abstraction makes it easier to update any given instantiation with new proof components, or design a new instantiation without necessarily needing to write a big paper.

UkoeHB: What does "instantiation" mean in this context? Feel free to point me to a definition online.

I think it just means "particular case".

As a historical note, Aram and I, at around the same time, independently came up with the same idea for membership proofs to be purely based on commitments to zero to output content. The novel linking tag and address construction was the product of our discussion as we both tried to make the commitment-to-zero approach work (at one point I thought it was impossible to find a workable solution, but somehow we landed on

the hidden timeline :p).

discussion along with Sarang of course ^

Rucknium[m]: An abstract tx protocol, in my view, lays out cryptographic structures and statements about them, and requires any instance of the protocol to prove those statements are valid with concrete proving systems. It can also describe core conventions for building transactions.

There is a layer of abstraction that encompasses all p2p tx protocols that use the output model. A second layer that encompasses all private tx protocols. The third layer is something like Seraphis that provides a framework for proving structures to fit inside. RingCT can be thought of as another protocol abstraction (or it could be formulated that way with some effort).

The fourth layer is a specification for an abstract protocol (defining proving structures and protocol rules), the fifth layer is an actual implementation, and the final layer is a specific cryptocurrency instantiation (eg blockchain) running the code of a protocol implementation.

UkoeHB: Thanks! DO you have any recommendations on an introduction to cryptography on a technical level? You can assume knowledge of multivariate calc, linear algebra, real analysis, and some topology.

Well there is ZtM2 lol, but it isn’t gentle.

I did not learn crypto formally or via a single resource.

Zero to Monero? It's on my reading list.

And what I just wrote, I can up with just now. :)

came*

Yes the second edition (or mechanics of mobilecoin, which is my fork of ZtM2 with various improvements to the early crypto chapters).

I think this resource is supposed to be good: crypto.stanford.edu/~dabo/cryptobook