User:Gmaxwell/alt ideas - Revision history

Gmaxwell: likewise

2017-04-19T18:53:44Z

likewise

← Older revision		Revision as of 18:53, 19 April 2017
Line 1:		Line 1:

	Here are a few of the ideas which I think would be most interesting to see in an altcoin. A few of these things may be possible as hardforking changes in Bitcoin too but '''<span style="font-size:125%;">some represent different security and economic tradeoffs and I don't think those could be ethically imposed on Bitcoin even if a simple majority of users wanted them</span>''' (as they'd be forced onto the people who don't want them).		Here are a few of the ideas which I think would be most interesting to see '''<span style="font-size:125%;">in an altcoin</span>'''. A few of these things may be possible as hardforking changes in Bitcoin too but '''<span style="font-size:125%;">some represent different security and economic tradeoffs and I don't think those could be ethically imposed on Bitcoin even if a simple majority of users wanted them</span>''' (as they'd be forced onto the people who don't want them).

	(Some of these ideas are mine, some are from other people, some are old and obvious)		(Some of these ideas are mine, some are from other people, some are old and obvious)

Gmaxwell: ditto

2017-04-19T18:51:53Z

ditto

← Older revision		Revision as of 18:51, 19 April 2017
Line 30:		Line 30:
	** Abandoned UTXO should be forgotten and become unspendable.		** Abandoned UTXO should be forgotten and become unspendable.
	** Demurrage is one possible construction for this, but its economically and educationally complicated. Simpler would just be having a long but finite maximum. Unspendable coins could vanish forever, or be returned to mining— but returning the coins to mining is economically distorting and risks creating weird incentives ("I won't mine your txn because I want to collect its inputs as fees once you've been successfully denied")		** Demurrage is one possible construction for this, but its economically and educationally complicated. Simpler would just be having a long but finite maximum. Unspendable coins could vanish forever, or be returned to mining— but returning the coins to mining is economically distorting and risks creating weird incentives ("I won't mine your txn because I want to collect its inputs as fees once you've been successfully denied")
			** ATTENTION MORONS: THIS CANNOT BE DONE WITH BITCOIN. SEE THE LARGE BOLD TEXT AT THE TOP.

	* Make all transactions P2SH		* Make all transactions P2SH

Gmaxwell: jesus christ. I am so tired of morons in this industry.

2017-04-19T18:50:46Z

jesus christ. I am so tired of morons in this industry.

← Older revision		Revision as of 18:50, 19 April 2017
Line 1:		Line 1:

	Here are a few of the ideas which I think would be most interesting to see in an altcoin. A few of these things may be possible as hardforking changes in Bitcoin too but some represent different security and economic tradeoffs and I don't think those could be ethically imposed on Bitcoin even if a simple majority of users wanted them (as they'd be forced onto the people who don't want them).		Here are a few of the ideas which I think would be most interesting to see in an altcoin. A few of these things may be possible as hardforking changes in Bitcoin too but '''<span style="font-size:125%;">some represent different security and economic tradeoffs and I don't think those could be ethically imposed on Bitcoin even if a simple majority of users wanted them</span>''' (as they'd be forced onto the people who don't want them).

	(Some of these ideas are mine, some are from other people, some are old and obvious)		(Some of these ideas are mine, some are from other people, some are old and obvious)

Stevenroose: Updated link to Guy Fawkes signatures (has bad SSL too)

2016-11-07T12:00:32Z

Updated link to Guy Fawkes signatures (has bad SSL too)

← Older revision		Revision as of 12:00, 7 November 2016
Line 75:		Line 75:
	** With libsecp256k1 ed25519 is <s>only 2x</s>not faster. Also it has a non-prime order— cofactor of 8. yuck.		** With libsecp256k1 ed25519 is <s>only 2x</s>not faster. Also it has a non-prime order— cofactor of 8. yuck.

	* Alternatively, [http://~~www~~.~~hackerzvoice~~.net/~~madchat~~/crypto/papers/fawkes.pdf Guy Fawkes signatures]		* Alternatively, [http://repo.thehackademy.net/depot_madchat/crypto/papers/fawkes.pdf Guy Fawkes signatures]

	* Direct support for validating unblinded chaum tokens of some kind		* Direct support for validating unblinded chaum tokens of some kind

Gmaxwell: outdated information, libsecp256k1 is faster than many ed25519 implementations.

2016-02-01T23:17:09Z

outdated information, libsecp256k1 is faster than many ed25519 implementations.

← Older revision		Revision as of 23:17, 1 February 2016
Line 73:		Line 73:
	* Support for ed25519 signatures and lamport signatures		* Support for ed25519 signatures and lamport signatures
	** Both are significantly faster than Bitcoin's ECDSA, lamport is QC hard but would result in enormous scriptsigs (less of an issue with pruned history).		** Both are significantly faster than Bitcoin's ECDSA, lamport is QC hard but would result in enormous scriptsigs (less of an issue with pruned history).
	** With libsecp256k1 ed25519 is only 2x faster. Also it has a non-prime order— cofactor of 8. yuck.		** With libsecp256k1 ed25519 is <s>only 2x</s>not faster. Also it has a non-prime order— cofactor of 8. yuck.

	* Alternatively, [http://www.hackerzvoice.net/madchat/crypto/papers/fawkes.pdf Guy Fawkes signatures]		* Alternatively, [http://www.hackerzvoice.net/madchat/crypto/papers/fawkes.pdf Guy Fawkes signatures]

Gmaxwell at 23:29, 5 October 2014

2014-10-05T23:29:20Z

← Older revision		Revision as of 23:29, 5 October 2014
Line 9:		Line 9:
	* Rule violation announcements. When any rule violation is found, a proof or pointer to it gets flooded. (though no more than one violation per block or its parents) See also: [http://sourceforge.net/mailarchive/message.php?msg_id=29450793]		* Rule violation announcements. When any rule violation is found, a proof or pointer to it gets flooded. (though no more than one violation per block or its parents) See also: [http://sourceforge.net/mailarchive/message.php?msg_id=29450793]

	* Transaction ~~checkpoints~~. Each transaction (or signature?) should contain a block index and 32 (?) least significant bits of the block hash. The transaction's fees are only valid (or only their full value?) if they are mined in a chain they agree with. This would let people making bitcoin transactions 'vote with their wallets' on the identity of the chain they consider important. This isn't a viable POW replacement, but would greatly reduce the economic benefit of mining moderate depth forks, esp as fees begin to dominate the block reward. "You don't get (all) of my fee payment if you are mining a chain I don't like!"		* Transaction block commitments. Each transaction (or signature?) should contain a block index and 32 (?) least significant bits of the block hash. The transaction's fees are only valid (or only their full value?) if they are mined in a chain they agree with. This would let people making bitcoin transactions 'vote with their wallets' on the identity of the chain they consider important. This isn't a viable POW replacement, but would greatly reduce the economic benefit of mining moderate depth forks, esp as fees begin to dominate the block reward. "You don't get (all) of my fee payment if you are mining a chain I don't like!"
	** Nodes would typical checkpoint a few blocks in the past from their current height to avoid overstating their opinion unnecessarily.		** Nodes would typical checkpoint a few blocks in the past from their current height to avoid overstating their opinion unnecessarily.
	** Deep checkpoints could be automatically triggered by observing a critical mass of coins-day-destroyed confirming them— creating a PoS-ish system, though this is subject to the 'nothing at stake' problem of PoS, and is probably very dangerous. (e.g. isolation risk for newly bootsrapping nodes)		** Deep checkpoints could be automatically triggered by observing a critical mass of coins-day-destroyed confirming them— creating a PoS-ish system, though this is subject to the 'nothing at stake' problem of PoS, and is probably very dangerous. (e.g. isolation risk for newly bootsrapping nodes)

Gmaxwell at 20:51, 13 June 2014

2014-06-13T20:51:38Z

← Older revision		Revision as of 20:51, 13 June 2014
Line 1:		Line 1:

	Here are the ideas which I think would be most interesting to see in an altcoin. A few of these things may be possible as hardforking changes in Bitcoin too but some represent different security and economic tradeoffs and I don't think those could be ethically imposed on Bitcoin even if a simple majority of users wanted them (as they'd be forced onto the people who don't want them).		Here are a few of the ideas which I think would be most interesting to see in an altcoin. A few of these things may be possible as hardforking changes in Bitcoin too but some represent different security and economic tradeoffs and I don't think those could be ethically imposed on Bitcoin even if a simple majority of users wanted them (as they'd be forced onto the people who don't want them).

	(Some of these ideas are mine, some are from other people, some are old and obvious)		(Some of these ideas are mine, some are from other people, some are old and obvious)

Gmaxwell: on ed25519

2014-01-07T05:10:43Z

on ed25519

← Older revision		Revision as of 05:10, 7 January 2014
Line 73:		Line 73:
	* Support for ed25519 signatures and lamport signatures		* Support for ed25519 signatures and lamport signatures
	** Both are significantly faster than Bitcoin's ECDSA, lamport is QC hard but would result in enormous scriptsigs (less of an issue with pruned history).		** Both are significantly faster than Bitcoin's ECDSA, lamport is QC hard but would result in enormous scriptsigs (less of an issue with pruned history).
			** With libsecp256k1 ed25519 is only 2x faster. Also it has a non-prime order— cofactor of 8. yuck.

	* Alternatively, [http://www.hackerzvoice.net/madchat/crypto/papers/fawkes.pdf Guy Fawkes signatures]		* Alternatively, [http://www.hackerzvoice.net/madchat/crypto/papers/fawkes.pdf Guy Fawkes signatures]

Gmaxwell: ECDLP for timelock seems a little lame.

2013-12-29T00:59:53Z

ECDLP for timelock seems a little lame.

← Older revision		Revision as of 00:59, 29 December 2013
Line 25:		Line 25:
	** Probably incompatible with merged mining and other POW schemes.		** Probably incompatible with merged mining and other POW schemes.
	** Making the difficulty adaptive either makes far in the future messages impossible (because the problem size wouldn't be known long in advance), or requires increasingly big headers as the difficulty would require working on multiple problems concurrently.		** Making the difficulty adaptive either makes far in the future messages impossible (because the problem size wouldn't be known long in advance), or requires increasingly big headers as the difficulty would require working on multiple problems concurrently.
			** The obvious constructions using ECDLP as the asymmetric problem are not progress free.

	* UTXO aging		* UTXO aging

Gmaxwell: clarify a bit.

2013-12-25T00:26:12Z

clarify a bit.

← Older revision		Revision as of 00:26, 25 December 2013
Line 22:		Line 22:
	* POW which turns the distributed computation into ticking for timelock encryption		* POW which turns the distributed computation into ticking for timelock encryption
	** An infinite sequence of nothing-up-my-sleeve numbers are taken as an infinte sequence of ECC public keys. Searching the pow involves finding distinguished points along a Pollard's rho DLP solution trying to crack the key. When the key is cracked the problem is advanced to the next key.		** An infinite sequence of nothing-up-my-sleeve numbers are taken as an infinte sequence of ECC public keys. Searching the pow involves finding distinguished points along a Pollard's rho DLP solution trying to crack the key. When the key is cracked the problem is advanced to the next key.
	** People can then encrypt messages ~~to these~~ keys and sometime in the future ~~the~~ network will crack them, achieving a timelock.		** People can then encrypt messages with all of the keys between now and sometime in the future and network will crack them, achieving a timelock.
	** Probably incompatible with merged mining and other POW schemes.		** Probably incompatible with merged mining and other POW schemes.
	** Making the difficulty adaptive either makes far in the future messages impossible (because the problem size wouldn't be known long in advance), or requires increasingly big headers as the difficulty would require working on multiple problems concurrently.		** Making the difficulty adaptive either makes far in the future messages impossible (because the problem size wouldn't be known long in advance), or requires increasingly big headers as the difficulty would require working on multiple problems concurrently.