01:21:07 <UkoeHB> Is there an algebraic transformation `p = f(x) mod q` s.t. it is intractable to find `x` given `p` (with `q` prime > 3)? E.g. `p = x + 1/x` or something. Looking at this for a payment channel issue.
03:30:17 <br-m> <kayabanerve:matrix.org> UkoeHB: g^x, though that likely isn't helpful
03:52:19 <UkoeHB> Yeah it has to be provable without revealing `x`, e.g. with a composition proof from start/end keys `[x G, p G]`.
05:46:42 <br-m> <kayabanerve:matrix.org> I mean, you can prove a square-and-mul ladder in a simple enough BP, but sure, it isn't linear
05:46:51 <br-m> <kayabanerve:matrix.org> I'd be more concerned with the hardness of the computational DLP over a 256-bit prime field
05:49:36 <br-m> <kayabanerve:matrix.org> *computational hardness of the DLP
07:00:42 <br-m> <kayabanerve:matrix.org> It seems there's a demo of a DLP solve over a 768-bit safe prime, so yes, I believe you're limited to an arithmetic hash or approximate :/
19:28:10 <br-m> <loop.ster:matrix.org> It sounds like you're venturing near the path I went down coming up with the VCOF for Grease. After several dead ends, I ended up at SNARKS - https://github.com/grease-xmr/grease/blob/9aa7d74d5c909726bec1af24b9eeeb33de37517d/docs/legacy/v1/15_channel_update.typ#L43 > <UkoeHB> Yeah it has to be provable without revealing `x`, e.g. with a composition proof from start/end keys `[x G, p G]`.
21:06:53 <UkoeHB> @loop.ster oh perfect, doesn't that directly solve https://github.com/monero-project/research-lab/issues/161#issuecomment-5396778447 ? Not sure why CjS77 mentioned it as a problem.
21:53:04 <br-m> <kayabanerve:matrix.org> So we are now at an arithmetic hash and a BP to prove it?
21:58:35 <br-m> <kayabanerve:matrix.org> Poseidon or reducing some linear combination of Ed25519 x coordinates into an Ed25519 scalar and arguing its sufficiently close to uniform?