ah ok, so that's what's called the synthetic distribution. then how can one arrive at the observed distribution?

you look at the relative age of tx ring members compared to the tx age

got it, thanks

Hey folks. I added an Ethercalc spreadsheet to the matrix room. I thought could be useful to people here for sharing calculations, idea, functions or whatever else. The link is ethercalc.net/!toFcRZtpaiwiyapgVO:matrix.org_MRL_spreadsheet, but you should see it pinned on the top of this room

In any case you'll see it on the sidebar on the right.

Let's see if people find it useful, otherwise we can easily remove it

Meeting 2hrs: monero-project/meta #624

I finally figured out, after 3 years, why we need mul8 in the Diffie-Hellman key derivation used to make sender-receiver secrets (`generate_key_derivation()`). Without mul8, you can leak if the local private key is a multiple of 8 or not. Suppose the non-local DH partner (attacker) sets their pubkey to `K^p_nl = k_nl*G + K^h` (for `k_nl` non-local privkey, `K^h` in cofactor subgroup). The local DH partner computes some public

result of using the DH derivation `r(k_l * K^p_nl)` and returns that result to the nonlocal DH partner (for example, true/false on identifying an owned cryptonote-style output). The nonlocal partner then just tests `r(k_l * K^p_nl) ?= r(k_nl * K^p_l)`. If the test succeeds, then `k_l` is a multiple of 8.

btw h4sh3d, this also applies to multisig, so I will be updating the PR today

meeting time: monero-project/meta #624

1. greetings

hello

Hi

Meeting time :)

Hi there

hi

Hi

Howdy

.summon bridge

hello :)

2. let's start with updates

lets go relay

Hello everyone.

heyo

Looks like the IRC to Matrix bridge is warming up

Why am I seeing EtherCalc--MRL_spreadsheet imposed on top of matrix?

It's gone.

one-horse-wagon: You can un-pin it with the "..."

I did. Thank you.

My updates: 1) I created an animated statistical Monero logo. It can be used for marketing research projects I suppose.

2) Work on the decoy selection algorithm continues. The feedback process is ongoing.

Me: This week, I added two variants to my Seraphis PoC. I have decided not to do one other variant (using a modified grootle proof), since other perf tests showed it had no advantages over the variants I have right now (which use concise grootle). The Firo guys think the modified grootle can perform better, but I did my best to optimize it and couldn't improve it enough to justify using. I also don't really feel like implementing

a PoC of lelantus-spark. It is probably ~equivalent to my `MockTxTypeConciseV1` (maybe +/- a few percentages in size/verification cost). So... that means my PoC is basically done for perf testing :). gingeropolous[m] I will be hitting you up to pump some numbers on your beefy machine.

3) Working with gingeropolous on defining hardware requirements for a research computing server.

(1) I updated the binning algorithm PoC, it's ready for review. Refresher: there was a flaw in the originally proposed algo, and I modified the approach to use bins of a fixed block size, rather than a fixed number of outputs

(2) I've made solid progress on view tag support, tentatively want to say I may have it done much sooner than originally thought

Strange how long we had such a gem like the view tag idea just gathering dust.

are there any implications for view tags once ringsize goes massive with seraphis?

no

rbrunner: That's why I put "cat herding" on the MRL meeting agenda for later.

Rucknium. Your logo is in the public domain for anyone to use?

gingeropolous: ringsize is for tx INPUTS, view scanning is for tx OUTPUTS

roight roight roight

rbrunner: all it takes is someone to implement; there hasn't been anyone willing/able to implement it until now I guess

personally, I didn't know C++ 1.5yrs ago

one-horse-wagon: My interpretation is that it is CC BY-SA 4.0 license since it is somewhat derived from the original Monero logo. The code to create it is MIT. See

Hmm, I think mixed in there is also a failure to recognize the importance. Not only "nobody around to implement".

one-horse-wagon: So, basically anyone is free to post it anywhere. Go post it!

But anyway, nice to have it going now :)

Very good. Thank you.

wfaressuissia: are you around to give an update on Drijvers mitigation? technically a -dev issue, but also if interest here

or*

of*

it isn't ready yet, is it enough precision of update ?

lol thanks

3. well we can do open discussion if anyone has anything

from agenda or otherwise

Decoy Selection:

rbrunner: we can't solve everything right away, otherwise there'd be nothing to talk about... :P

good ol' decoy selection

ArticMine gave me great written feedback on OSPEAD. One thing he suggested was that the upcoming hard fork can be leveraged to investigate the properties of decoy selection in the wild. In other words, waiting until the hard fork will give us a discontinuity to work with since the ring size will suddenly increase 11-->16

I completed my feedback to OSREAD

The status of OSPEAD right now is that I am continuing to receive feedback, but the next step is for me to give a modified plan to ArticMine based on his feedback. Then my CCS proposal may move forward shortly after. I still plan to soon release a version of my OSPEAD technical specification, i.e. "Document A", before my CCS goes to the Funding Required stage.

Any questions?

What's the location of that feedback ?

The feedback from ArticMine was distributed to all those who have access to my HackerOne submission.

Roughly how many pages will Document A be?

That includes isthmus, jberman, luigi1111, moneromooo, sgp, binaryFate, and Syksy.

Right now Document A is about 13 pages. It will get longer.

(Because some people said the hackerone submission was very very long)

jberman suggested I add some things.

If readers don't want to slog through Document A, that's fine. It will be there for transparency purposes.

It's also quite technical.

So there will be TL;DR :)

I am looking forward to digging into it! 🙂

It would be nice to see Document A to get more specific details and have an idea of what is being discussed in Hackerone.

I mean, I will try to explain in simple terms the overall idea as well, but the purpose of writing Document A was specifically to give a detailed description.

In summary I believe that the overall approach is feasible. I am waiting for Rucknium's modified plan

hackerone submission replies are not encrypted and can be read by hackerone itself, right ?

Document A is basically an extension of my HackerOne submission. I said in my HackerOne submission "Here's a rough outline of what I plan to do" in about a page of text. Document A is a deep dive into what I meant.

wfaressuissia[m]: I think HackerOne is not end-to-end encrypted. Therefore, I did the encrypting myself, with the PGP keys of luigi1111 and moneromooo. Taking no chances.

TL;DR on my suggestion: use the real output data collected by Moser et al to fit a plausibly better distribution than the gamma distribution, using one of the multiple methods of fitting the distribution described in Document A

There are a few messages in H1 that are not e2ee encrypted, but they don't reveal much.

jberman: Yes, that's a good summary of your suggestion. Basically, a dry run to show how it would work.

UkoeHB: What's the next step after complete seraphis_perf branch ?

wfaressuissia: I need to run the perf tests now. Then make nice plots, then add them to the paper, then update/finalize the paper with coinstudent2048[ 's hard work on security modeling.

<jberman[m]> TL;DR on my suggestion: use the real output data collected by Moser et al to fit a plausibly better distribution than the gamma distribution, using one of the multiple methods of fitting the distribution described in Document A <--- This is a start, but I would not give up completely on the more recent data. My take on this is that It gets harder as we increase noise via ring size increases / binning.

So there is still merit in the OSREAD approach in addition to increasing noise

"... hard work security modelling" Are these definitions and related proofs public ?

at least definitions of required theorems to prove protocol securiy

s/securiy/security/

github.com/coinstudent2048/writeups raw.githubusercontent.com/coinstudent2048/writeups/main/seraphis.pdf

Doug Tuman asked me to speak about decoy selection issues on his podcast. For various reasons, I don't want to go on a podcast at this time. Is there someone who would like to talk about decoy selection? I have jberman, isthmus, and ArticMine in mind.

Agree ArticMine, I figured that start would give a bit more clarity to Document A

I see increasing noise via ring size increase / binning as complimentary and not a replacement for OSREAD

I would not mind doing a podcast. I can be tough while trying to keep the details secret

My preference would be to do it after the next HF

ArticMine: "It" here meaning the podcast or OSPEAD, or something else?

OSREAD / decoy selection

I would suggest waiting on doing any podcasts until there is no reason to try and keep details secret.

There are many other things to talk about having to do with Monero.

Which in my view is after the the next HF

ArticMine: I agree. I think it wouldn't be feasible to fully research and implement OSPEAD before the next hard fork, anyway. And with a HF, we have additional data we can use.

Upcoming is the Science of Blockchain Conference. Submission deadline is Nov 23:

I think it could be feasible to submit our work on the mid-2021 transaction volume anomaly as a work-in-progress.

Do you have to attend in-person?

UkoeHB: I am unsure.

FYI: Just a few minutes ago isthmus wrote a long comment on my CCS proposal:

We are at the end of the hour. I will call it here. Thanks for attending everyone.

Same time next week, I presume?

UkoeHB: Thanks for chairing the meeting.

sure

next week same time yes

Hmm, I’m guessing that the entity who generated the anomalous transaction volume is monitoring this room. It would be awesome if we both submitted talks to the “Attack analysis and threat modeling” topic of SBC. There’s no way the organizers would be able to resist putting our talks together (both sides of the coin would be a great conference session story arc). I'm in if you are, dear mystery wallet. ;- )

I went to sbc back in 2019, it was a great conference

I like the Lasker reference isthmus @isthmus:libera.chat

isthmus: I was thinking the same thing, regarding the conference. How fitting that would be 🙃

I updated the multisig PR so DH derivations are mul8 before being used.

What is this spreadsheet widget that shows a "403 Forbidden" for me in this room?

ErCiccione: can you set the default to 'not pinned'?

UkoeHB: Sure.

Hello everyone, has anyone used the code for data anonymity in other areas besides fintech? Healthcare to be exact

no

OK. I am aiming to use it for data anonymity for patient data analytics.

Let's see how it goes

Thanks

Guest90: Interesting idea. Do you have a GitHub repo or anything like that, or is it still an early-stage idea?