Comments on MimbleWimble Extension Blocks proposals

[coblee]

Please comment here on the MW/EB proposals

[RobD-BP]

How does this affect Script mining. Also, what type of increase if any could we see with transaction fees?

[ecurrencyhodler]

Litecoin miners will keep mining Scrypt. As for transaction fees, it will depend on the fee market in the canonical chain and the EB.

[dpc]

What's the reason why peg-out outputs require locking? My understanding is that since both chains are tightly coupled 1:1 with each other, when one reorgs, the other reorgs as well. There is no possibility for them to be out of sync. So I don't understand why would they require preventing measures like typical federation-based side-chains etc.

[justinlooney]

Referring to the Rationale Section of Proposal. Was Elliptic-Curve Diffie–Hellman or the Signal Protocol considered? Does something like ENIGMA off-chain mixing to allow fully private and untraceable monetary transactions make sense for Litecoin?

Why can't Lightning Network encrypt sender-receiver data?

BOLT #8: Encrypted and Authenticated Transport

All communications between Lightning nodes is encrypted in order to provide confidentiality for all transcripts between nodes and is authenticated in order to avoid malicious interference. Each node has a known long-term identifier that is a public key on Bitcoin's secp256k1 curve. This long-term public key is used within the protocol to establish an encrypted and authenticated connection with peers, and also to authenticate any information advertised on behalf of a node.

[coblee]

What's the reason why peg-out outputs require locking?

The reason why is that with a reorg, the hash of the peg out transaction (on the canonical side) will be changed. So any transaction chains (i.e. transactions spending those outputs) will be invalid. Those transactions cannot be replayed like they would be with normal transactions in a reorg.

So for example, if you pegged-out 10 LTC and use that to pay a merchant and they gave you your purchases after 6 confirmation, and there's a 7-block reorg after that. You have effectively double spent that transaction. You would have to resend another 10 LTC to the merchant. With normal transactions, after reorgs, your transaction will just be replayed and everything is good assuming no malicious intent. With peg-outs, you will double spend those transactions if you didn't know about the reorg even without malicious intent.

So this is similar to coinbase block reward transactions, which is locked for 100 blocks. Coinbase transactions are worse w.r.t. this because the new coinbase transaction is likely mined by a different miner. At least with EB peg-outs, the same owner controls the new peg-out coins. So we need to lock it enough such that a reorg of that length practically never happens, but don't necessarily need a lock up of 100 blocks.

[Sdczen]

The only thing this comes down to is Economic Viability!

If exchanges & on/off ramps de-list Litecoin because of its new privacy features, then MimbleWimble should NOT be implemented. The effect of this goes against "litecoin is money", and mass user adoption (you can't get mass adoption, if you can't easily buy it). LTC will become illiquid, and we all know what happens to chains that become illiquid.

I'm all for privacy features, but not if it jeopardizes economic viability. There needs to be absolute clarification from the large exchanges on what they'll do. The other concern is, exchanges may receive guidance from .Gov to de-list all privacy coins in the future.

[ChillingSilence]

The LIPs state:

This will be activated with BIP8. The soft fork will be activated 1 year from the day the implementation is released. And miners will be able to activate it early with a 75% signaling threshold.

Does this mean even if signalling after 1yr since commencing only reaches, say, 60% over any of the epochs, that the activation will still occur, rather than timing out and being abandoned?

[cinnamoncoin]

Although a soft fork this is kind if a big risk since it will rely on large mining pools and exchanges going along.
Personally I would not be against it since legacy tx would not be at any risk. It should be done slow and careful since it increases the 'attack' surface for those who opt in. If there are problems could have long term effects on public perception of the entire project.... The privacy issue could scare some exchanges away.... i guess bip 8 means it gets activated when the one year timer is up.....

[nulldog22]

I do not agree with this proposal.

All evidence and reasoning suggests to me that this will not help to provide fungibility in a meaningful way, so it would not be not worth all the drawbacks.

Up to 98-99% of Zcash transactions are not shielded because it is opt-in, and there are only reasons to think that this metric would be worse for LTC. LTC’s userbase is more mainstream and less interested in privacy than Zcash’s userbase. Users will have less incentive to use it because it is weaker in terms of privacy guarantees. Services will have less incentive to make the effort to implement it because it is interactive, risks regulatory issues and there will be little user demand.

This massive majority of transparent transactions will undermine the effectiveness of the rare opt-in MW transactions.

To compare to Beam, all Beam transactions occur with MW and can have forms of decoys to help deal with linkability, which goes beyond this LIP. With these improvements their project still notes that "Linkability is the Achilles' heel of MW" and that they see the need to research further significant cutting-edge changes like Lelantus. Conversely, this LIP ignores the “Achilles’ heel”, proposes nothing to mitigate it, and does not begin to discuss the consequences when interlinked with a massive majority of transparent transactions. There is not even any mention of Dandelion but I have to assume that would be used at the least.

Therefore it is not apparent that this would be worth years of development, increased technical complexity, risks of bugs, risks of delistings and the risks of diverging from Bitcoin. Many people see LTC’s value as coming from it having a low risk by sticking to BTC’s code instead of making experimental changes with less experienced developers. People will always worry about problems like inflation bugs that could kill LTC. It may be even worse from a regulatory perspective than Monero due to the possibility of deleted history.

This plan could even make fungibility worse since there will be a small percentage of transactions that have an obviously suspicious history. Exchanges and merchants will 100% certainly treat history of opting into MW as a red flag. Anyone can unintentionally end up with those coins.

LTC desperately needs fungibility to begin becoming usable as money, but this plan does not take a coherent step toward that.

[Sdczen]

I agree with @nulldog22, there are too many potential issues.

[ecurrencyhodler]

Hey @nulldog22. Thanks for your feedback.

Up to 98-99% of Zcash transactions are not shielded because it is opt-in, and there are only reasons to think that this metric would be worse for LTC.

I'd like to push back on this. One big reason why shielded transactions haven't been widely adopted is because creating them are intensive and take a long time. This is a poor UX and people don't want to wait. If it was easier, it most certainly would be higher. And it's always a possibility that Litecoin users end up using MW a lot, especially if there's a platform of some sort for them to spend it on.

There is not even any mention of Dandelion but I have to assume that would be used at the least.

There was discussion internally about using dandelion. Since this LIP is a draft, we could definitely incorporate that into the finalized proposal. I admit there is room to better improve privacy in this LIP. If you have any suggestions and can help us write the code, that would be greatly appreciated.

Many people see LTC’s value as coming from it having a low risk by sticking to BTC’s code instead of making experimental changes with less experienced developers.

The canonical chain can still remain close to Bitcoin's codebase. The only difference is the extra work to maintain the extension block.

People will always worry about problems like inflation bugs that could kill LTC.

Supply inflation bugs are a concern for any privacy coin. But one of the benefits of being opt-in (which fully private coins don't have) is that the canonical chain will never exceed 84 million. This helps mitigate this risk. We could even organize an "audit" day where everyone pegs out of the EB (unlikely I know but still theoretically possible).

It may be even worse from a regulatory perspective than Monero due to the possibility of deleted history.

Would it be fair to ask that we don't make jump to conclusions and engage exchanges and regulators first? The only prominent exchanges I know of that have delisted privacy focused/marketed coins are Coinbase Europe and OKEX. Others haven't made the same move.

Exchanges and merchants will 100% certainly treat history of opting into MW as a red flag. Anyone can unintentionally end up with those coins.

Same could be said about coinjoins. Are you opposed to that as well? It's a bit extreme to claim that this will make Litecoin's fungibility worse.

And FWIW, we aren't saying that opt-in privacy is better than full privacy. Grin and Beam have us beat on that hands down. But it is a step in the right direction.

[DavidBurkett]

There is not even any mention of Dandelion but I have to assume that would be used at the least.

This LIP doesn't discuss the P2P layer at all. It's all about consensus, not implementation.

[DavidBurkett]

And FWIW, we aren't saying that opt-in privacy is better than full privacy. Grin and Beam have us beat on that hands down. But it is a step in the right direction.

Nothing beats mandatory privacy, but as a Grin dev, I can say that LTC has one big privacy advantage over Grin and Beam: a much larger userbase. Right now, LTC has about 5-15x as many daily transactions as Grin. If only 10% of LTC's transactions are moved to the EB, it will have an equivalent anonymity set.

[nulldog22]

But one of the benefits of being opt-in (which fully private coins don't have) is that the canonical chain will never exceed 84 million. This helps mitigate this risk.

That has no effect on preventing an inflation bug. Unless you disagree that as soon as the MW chain exists you will forever have to accept people pegging out. In that case you are truly damaging fungibility: MW LTC coins will not have the same value as coins on the transparent chain since there is reason to think MW coins could cease to be accepted if there were an inflation bug.

Would it be fair to ask that we don't make jump to conclusions and engage exchanges and regulators first?

Regardless of what they say now, the risk is always there.

Same could be said about coinjoins. Are you opposed to that as well? It's a bit extreme to claim that this will make Litecoin's fungibility worse.

Yes coinjoins have the same problem and are not a solution. I do not think it is extreme at all, rather it is undeniable that red-flagging MW coins will occur with automated chain analysis risk systems. Fungibility is not the same thing as privacy. Perhaps sometimes it will not be known where some coins came from, but those coins may be seen as different and less valuable because of that.

Nothing beats mandatory privacy, but as a Grin dev, I can say that LTC has one big privacy advantage over Grin and Beam: a much larger userbase. Right now, LTC has about 5-15x as many daily transactions as Grin. If only 10% of LTC's transactions are moved to the EB, it will have an equivalent anonymity set.

This is not true, although more transactions is of course a benefit. You seem to be imagining two separate chains that do not interact. Every time someone pegs in with KYC'd coins or pegs out to spend coins at a merchant/exchange that gets the user's identity etc, or just reveal the value of their coins, they will bring in dirty data to the MW chain. If the number of transactions were huge you would still be left with the issue that a large fraction of coins are bringing in data that assists with analysis. From the spend-time distributions of privacy coins and how people naively try to 'clean' their coins it is likely that people will quickly peg-in and peg-out, despite how this easily leads to deanonymisation through timing analysis. I wouldn't want to stay on the MW chain for long-term holding either because of the earlier statement about inflation bugs.

[ecurrencyhodler]

That has no effect on preventing an inflation bug.

I never said it prevents it. I said it mitigates it. I suppose you are opposed to all private coins then?

I do not think it is extreme at all, rather it is undeniable that red-flagging MW coins will occur with automated chain analysis risk systems.

If that were true, all CJ's would be tagged as highly suspicious by chain analysis companies by now. They're not. That is why I believe it is rather an extreme point of view. But we can agree to disagree here.

From the spend-time distributions of privacy coins and how people naively try to 'clean' their coins it is likely that people will quickly peg-in and peg-out, despite how this easily leads to deanonymisation through timing analysis.

You're making an assumption here. We know nothing about how people will peg in and out of the EB. Lots can be done about educating people, which we can do since it will take a while for this to roll out.