原始文献 / 论坛帖 / Re: Not a suggestion
Re: Not a suggestion
Bitcointalk · 2010-08-13 19:28:47 UTC
我还没理解你的想法。它对公开网络隐藏了什么信息吗？优势是什么？
如果至少 50% 的节点对交易的验证足够充分、以至于旧交易可以被丢弃，那么所有人都看到了一切，也可以保存一份记录。
公开节点能看到交易的金额吗？能看到金额来自哪笔之前的交易吗？如果能，那他们就知道了一切。如果不能，那他们就无法验证金额来自合法来源，你也就不能把他们生成的链当作对它的验证。
它隐藏比特币地址吗？是这样吗？好吧，如果是这样，那我可能明白了。
密码学可能提供一种做“密钥致盲”的方法。我做过一些研究，比较冷僻，但那里可能有东西。“群签名”可能相关。
这里大致方向上有一些内容：
http://www.users.zetnet.co.uk/hopwood/crypto/rh/
我们需要一种生成公钥的额外致盲变体的方法。致盲变体应具有与根公钥相同的性质，使得私钥可以为其中任何一个生成签名。其他人无法判断一个致盲密钥是否与根密钥相关，也无法判断来自同一根密钥的其他致盲密钥之间是否相关。这就是致盲的性质。简而言之，致盲就是 x = (x * large_random_int) mod m。
向比特币地址付款时，你每次都会生成一个新的致盲密钥。
然后你需要能这样签署签名：让人无法判断两个签名来自同一个私钥。我不确定始终签署不同的致盲公钥是否已经具备这个性质。如果没有，我认为群签名就派上用场了。有了群签名，可以做到某样东西被签署了，却不知道是谁签的。
举个例子，假设某个不得人心的军事攻击命令必须下达，但没人想在历史上留下是自己下令的记录。如果 10 位领导人都有私钥，其中一人可以签署命令，而你不知道是谁签的。
英文原文
I'm not grasping your idea yet. Does it hide any information from the public network? What is the advantage?
If at least 50% of nodes validated transactions enough that old transactions can be discarded, then everyone saw everything and could keep a record of it.
Can public nodes see the values of transactions? Can they see which previous transaction the value came from? If they can, then they know everything. If they can't, then they couldn't verify that the value came from a valid source, so you couldn't take their generated chain as verification of it.
Does it hide the bitcoin addresses? Is that it? OK, maybe now I see, if that's it.
Crypto may offer a way to do "key blinding". I did some research and it was obscure, but there may be something there. "group signatures" may be related.
There's something here in the general area:
http://www.users.zetnet.co.uk/hopwood/crypto/rh/
What we need is a way to generate additional blinded variations of a public key. The blinded variations would have the same properties as the root public key, such that the private key could generate a signature for any one of them. Others could not tell if a blinded key is related to the root key, or other blinded keys from the same root key. These are the properties of blinding. Blinding, in a nutshell, is x = (x * large_random_int) mod m.
When paying to a bitcoin address, you would generate a new blinded key for each use.
Then you need to be able to sign a signature such that you can't tell that two signatures came from the same private key. I'm not sure if always signing a different blinded public key would already give you this property. If not, I think that's where group signatures comes in. With group signatures, it is possible for something to be signed but not know who signed it.
As an example, say some unpopular military attack has to be ordered, but nobody wants to go down in history as the one who ordered it. If 10 leaders have private keys, one of them could sign the order and you wouldn't know who did it.