Bitcointalk · Not a suggestion

中本聪,2010 年 8 月 13 日

SN-2252 已核对来源,附原文与上下文。

阅读语言
中文译文

我还没搞懂你的想法。它对公共网络隐藏了什么信息吗?优势在哪里?

倘若至少 50% 的节点把交易校验到了可以丢弃旧交易的程度,那所有人都看到了一切,本可以留下记录。

公共节点能看到交易的金额吗?能看到金额来自哪笔先前的交易吗?倘若能,那他们就什么都知道了。倘若不能,他们就无法验证金额来自有效来源,你也就不能把他们生成的链当作交易的校验凭据。

它隐藏的是 bitcoin 地址吗?是这个吗?好,兴许我现在明白了,倘若是的话。

密码学兴许提供了一种「密钥盲化」的办法。我做过一些调研,这方面的资料很冷门,但兴许有些东西。「群签名」可能与此相关。

这个大方向上有一些东西: http://www.users.zetnet.co.uk/hopwood/crypto/rh/

我们需要的是一种为一个公钥生成额外盲化变体的方法。盲化变体要具有与根公钥相同的性质,使得私钥可以为其中任何一个生成签名。其他人无法判断某个盲化密钥是否与根密钥相关,也无法判断几个盲化密钥是否来自同一个根密钥。这些就是盲化的性质。一句话概括盲化:x = (x * large_random_int) mod m。

支付到 bitcoin 地址时,你可以为每次使用生成一个新的盲化密钥。

然后你还需要能生成这样的签名:无法看出两个签名出自同一个私钥。我不确定「总是用不同的盲化公钥签名」是否已经具备这个性质。倘若不具备,我想就该群签名出场了。有了群签名,可以做到某样东西被签了名,却不知道是谁签的。

举个例子,假设某次不得人心的军事行动必须下达命令,但没人想作为下令者载入史册。倘若 10 位领导人都持有私钥,其中一位可以签署命令,而你不会知道是谁签的。

ORIGINAL · 英文原文
I'm not grasping your idea yet.  Does it hide any information from the public network?  What is the advantage?

If at least 50% of nodes validated transactions enough that old transactions can be discarded, then everyone saw everything and could keep a record of it.

Can public nodes see the values of transactions?  Can they see which previous transaction the value came from?  If they can, then they know everything.  If they can't, then they couldn't verify that the value came from a valid source, so you couldn't take their generated chain as verification of it.

Does it hide the bitcoin addresses?  Is that it?  OK, maybe now I see, if that's it.

Crypto may offer a way to do "key blinding".  I did some research and it was obscure, but there may be something there.  "group signatures" may be related.

There's something here in the general area:
http://www.users.zetnet.co.uk/hopwood/crypto/rh/

What we need is a way to generate additional blinded variations of a public key.  The blinded variations would have the same properties as the root public key, such that the private key could generate a signature for any one of them.  Others could not tell if a blinded key is related to the root key, or other blinded keys from the same root key.  These are the properties of blinding.  Blinding, in a nutshell, is x = (x * large_random_int) mod m.

When paying to a bitcoin address, you would generate a new blinded key for each use.

Then you need to be able to sign a signature such that you can't tell that two signatures came from the same private key.  I'm not sure if always signing a different blinded public key would already give you this property.  If not, I think that's where group signatures comes in.  With group signatures, it is possible for something to be signed but not know who signed it.

As an example, say some unpopular military attack has to be ordered, but nobody wants to go down in history as the one who ordered it.  If 10 leaders have private keys, one of them could sign the order and you wouldn't know who did it.
上下文
← 上一条 SN-2252 · 当前 下一条 → 在档案中查看完整主题串 →
来源
Bitcointalk 原始链接 ↗ 记录编号 SN-2252