原始文献 / 论坛帖 / Re: Not a suggestion
Re: Not a suggestion
Bitcointalk · 2010-08-11 21:07:59 UTC
还在思考这个想法……
网络需要做的唯一工作，就是判断某次输出点的花费是否为第一次。
如果我们愿意让客户端自己保存其货币的历史记录，那么网络就不需要存储某些信息，例如：
- 价值
- 一笔交易中输入点与输出点的对应关系
网络将只跟踪一堆相互独立的输出点。它不知道这些输出点属于哪些交易、对应什么金额。客户端可以查询某个输出点是否已被花费，并可以提交一个满足条件的输入点来将其标记为已花费。网络保存该输出点以及第一个证明其已花费的有效输入点。输入点对其关联的下一个输出点的哈希与一个 salt 进行签名，这样，若知道 salt，就可以私下证明该签名签署了某个特定的下一个输出点，但公开来看，网络并不知道下一个输出点是什么。
我认为客户端将不得不保存一直追溯到最初生成币的完整历史记录。支付方需要向收款方发送数据，同时仍与网络通信以将输出点标记为已花费，并检查该花费是否为第一次花费。也许数据传输可以作为电子邮件附件来完成。
客户端必须保存完整历史记录这一事实，削弱了隐私上的好处。处理大额资金的人仍然能看到大量交易历史。考虑到历史会回溯发散，他们最终可能看到大部分历史。可以通过把面额做得更细来限制发散，但处理大额资金的商家仍然可能看到大量历史。
英文原文
Still thinking this idea through...
The only job the network needs to do is to tell whether a spend of an outpoint is the first or not.
If we're willing to have clients keep the history for their own money, then some of the information may not need to be stored by the network, such as:
- the value
- the association of inpoints and outpoints in one transaction
The network would track a bunch of independent outpoints. It doesn't know what transactions or amounts they belong to. A client can find out if an outpoint has been spent, and it can submit a satisfying inpoint to mark it spent. The network keeps the outpoint and the first valid inpoint that proves it spent. The inpoint signs a hash of its associated next outpoint and a salt, so it can privately be shown that the signature signs a particular next outpoint if you know the salt, but publicly the network doesn't know what the next outpoint is.
I believe the clients would have to keep the entire history back to the original generated coins. Someone sending a payment would have to send data to the recipient, as well as still communicating with the network to mark outpoints spent and check that the spend is the first spend. Maybe the data transfer could be done as an e-mail attachment.
The fact that clients have to keep the entire history reduces the privacy benefit. Someone handling a lot of money still gets to see a lot of transaction history. The way it retrospectively fans out, they might end up seeing a majority of the history. Denominations could be made granular to limit fan-out, but a business handling a lot of money might still end up seeing a lot of the history.