--- layout: post title: Logs for the Monero Research Lab Meeting Held on 2019-05-14 summary: Surae work, Sarang work, and miscellaneous tags: [dev diaries, crypto, research] author: el00ruobuob / sarang --- # Logs **\** Agenda: https://github.com/monero-project/meta/issues/344 **\** Logs of this meeting will be posted there **\** GREETINGS **\** howdy! **\** how is everyone? **\** who had fun at MCC? \*this guy\* **\** okay **\** well let's beign **\** begin\* **\** for the roundtable portion **\** let's start with general questions from the audience, and let's go around and see if anyone has anything to present **\** other than sarang and i anyway **\** Heh, I suppose we can move to presentations **\** yup **\** go ahead suraeNoether **\** go ahead sir **\** ahah **\** jinx **\** okay **\** well, CLSAG paper is undergoing the final round the corner. sarang and i are working on the final details today with randomrun, and i hope we can make a public version of the paper available in the next several days (unless some flaw is found) **\** Yeah, just need that timing data and a definite answer on the hash coeffs in the proof **\** DLSAG paper is undergoing further review, but I believe we are putting up an IACR version of that in the coming days also **\** Yep, waiting on all authors to sign off **\** MRL11 is still in progress, but now that clsag and dlsag are off my plate, it's being cranked up in terms of priority **\** i anticipate rapid progress on that as well **\** May 20-24, sarang and endogenic and I are doing the Monero workshop, and I believe we may be having Gao from Clemson come give us talks on starks and fully homomorphic encryption in the RLWE setting **\** (sarang, we should do some studying before then together on that) **\** of course **\** I gave a talk, sat on a panel, and gave an interview at the magical crypto conference **\** all of those are up on youtube; the talk was about four different branches of research here at MRL **\** other than that, i guess i'd prefer answering questions rather than talking myself into a rabbit hole **\** nioc and i have had some conversations about how long-winded i can be so i'm going to zip it unless folks want more details :D **\** Any questions for suraeNoether on this work? **\** so, for the audience members who are new **\** DLSAG = dual-recipient output signatures = work toward the claim-or-refund primitive that can underly smart contracts and lightning network. CLSAG = compressed signatures making the rate of growth on the monterion blockchain hopefully 25% smaller and faster to verify **\** MRL11 = traceability resistance analysis **\** so, work is important, hard, and slow going, but doing it right is very important to us **\** anyway, sarang, how about yourself? **\** Plenty to mention **\** I had overhauled some definitions and such in the CLSAG paper, which suraeNoether has completed more edits on **\** In particular, some stuff on multi-asset transactions that could be enabled by this **\** I'll get timing data and then we can release for review **\** "multi-asset" being akin to coloured coins ? **\** ya **\** Not saying I'm recommending such a thing for us, but it's an easy application **\** I've been working on some draft protocols for how a Monero coinjoin could work **\** Right now the initial scheme requires a certain amount of trust in a dealer, but is very efficient **\** This is obviously not ideal **\** MoJoin, I call it **\** FWIW it doesn't leak spend data to the dealer, only the partition of inputs-and-outputs to each player in the join **\** sgp\_ and I did two Breaking Monero episodes, one on input/output counts and one on block explorers **\** that's the main stuff for me **\** oh, guys: we are deciding to extend early-bird pricing for a few more days **\** i'll be advertising it **\** but don't forget to get your ticket at monerokon.com before prices change, if you are still coming **\** students are especially encouraged to attend; there will likely be partial rebates at the door for student tickets **\** Any particular questions for me? **\** how many rounds of interaction in mojoin? **\** The "Gao [...] fully homomorphic" thing makes me wonder if that could not be looked at in conjunction with dealerless coinjoin :) **\** 3 **\** This is minimal because of the BP MPC **\** yeah, that's cool. moneromooo i think that's probably a safe avenue of stuff for us to talk about **\** Er, no... 4 rounds now, sorry **\** I had to make a change **\** oh **\** The extra round is to avoid commitment sums being used to brute-force the partition by an observer **\** Making the resulting transaction identical to one not MoJoined (although the output count is something of a giveaway) **\** BTW, something I've not done in the branch is merging outputs to the same destination (originally the intent was to make Alice + Bob atomically paying Carol). **\** Would that be possible with the dealer based coinjoin ? **\** So A+B generate a single joint output? **\** yes. **\** I don't think it's possible to do the BP MPC without leaking the full mask **\** unless that's acceptable **\** That's fine in that case since Alice and Bob to advertise what they're paying, since each of them verifies the other does pay. **\** Would this assume another side channel between them that's outside of the join? **\** So it'd be a plug-and-play operation into a join? **\** I dunno. If you need one I guess. **\** Hmm **\** It's probably possible, under the right trust model between A+B **\** Of course, "probably possible" is quite the weaselworld **\** I'm here and caught up, sorry for being late **\** hi **\** nbd **\** talking coinjoin **\** Whats the advantage for Monero in using a CoinJoin implementation? if its better to chat later about it Ill shutup :) **\** no, that's a great question **\** It adds another layer of privacy. If Eve looks at one tx, she can't assume anymore than all the inputs are from hte same owner. **\** Yeah, it tries to break the common-ownership assumption **\** Ah, so its a mitigation of poisoning/EAE attacks specifically? How does it affect Tx size/blockchain bloat? **\** My thought about the dealer model (if it's a necessity, which is yet TBD) is that under a malicious dealer assumption, you basically revert back to the current model **\** If we're lucky, smaller txes since one single BP :) **\** Another quick note that hyc and I had a call with Trail of Bits, an auditor who submitted a SoW **\** they'll be updating their numbers, and noted that another project may be interested in helping fund RandomX **\** We'll have a call with those folks tomorrow **\** Hi, just finished my other call **\** yo **\** yeah, some good stuff from Trail of Bits **\** Awesome, I'm excited to learn more about CoinJoin on Monero as well as CLSAG, thanks guys! Ill get out of your hair now :) **\** Thanks for the question fort3hlulz **\** The security of coinjoins in Monero is still very much in the air **\** also for the benchmark freaks (like me) Huawei has offered to give me access to some servers with their newest chip, for benchmarking purposes **\** will be getting efficiency numbers for CN/R and RandomX on ARMv8 **\** ooooh **\** thats... fantastic... **\** nice **\** thes guys https://e.huawei.com/us/products/cloud-computing-dc/servers/arm-based **\** We'll post the ToB updated SoW when they provide it **\** and MRL marches forward into tomorrow's yesterday of the future^tm **\** general availability is end of June, early access is nice **\** that's all for me **\** Does anyone else have research to present? **\** Or general questions at all? **\** whats the coolest plane you've flown? **\** what kind of pie do you like? **\** berry berry **\** suraeNoether: commercially, or piloting myself? **\** with greek yogurt **\** ^ both **\** Commercially, Nepal **\** Myself, in between buildings in downtown San Francisco and the Golden Gate **\** which apparently is legal **\** not place, plane, but i'll accept your answer happily **\** that's awesome **\** Oh heh, didn't see that **\** Commercially, B787 **\** Myself, probably a DA40 **\** it's got the aerodynamics of a glider **\** WEll **\** Let's move to action items **\** suraeNoether: ? **\** final dlsag review today **\** mrl11 rest of the week **\** uhmmm... and if anything else is handed back to me like clsag **\** word **\** adjective **\** I'll get those CLSAG timings into the paper and finalize the proof question we had **\** Carry on with MoJoin **\** etc. **\** Any final words before we formally adjourn? **\** Perhaps a blog post from CLSAG could be written (similar to the one for Bulletproofs) **\** just excited for lunch **\** "Signatures. They are smaller and faster." **\** I don't think many community members would understand CLSAG from the technical paper alone :P **\** But yes, we could do that once we're satisfied with security **\** People need these blog posts or else no one will know **\** dEBRUYNE: that would be good, yes. **\** All righty, thanks to everyone for attending **\** We are now formally adjourned; logs will appear shortly