Silk Road forums

See, people can carp about how "privacy" isn't the same as "anonymity" as much as they like. The fact of the matter is that this is utter bullshit, because actually that sort of logic applies exclusively to the non-digital world. In the digital world privacy and anonymity are the same thing, the entire thing is a semantic argument. Nobody with two braincells to rub together deliberately chooses an inferior product so *some* higher-ups can break it! It's like a reverse version of Godwin's Law but for cryptography, good cryptography drives out the bad (albeit with the major caveat I mentioned about political/social capital and business sense).

An often-used analogy to the cryptographic blind signature is the physical act of enclosing a ballot in a special carbon paper lined envelope. The ballot can be marked through the envelope by the carbon paper. It is then sealed by the voter and handed to an official which signs the envelope. Once signed, the package can be given back to the voter, who transfers the now signed ballot to a new unmarked normal envelope. Thus, the signer does not view the message content, but a third party can later verify the signature and know that the signature is valid within the limitations of the underlying signature scheme.

Blind signatures can also be used to provide unlinkability, which prevents the signer from linking the blinded message it signs to a later un-blinded version that it may be called upon to verify. In this case, the signer's response is first "un-blinded" prior to verification in such a way that the signature remains valid for the un-blinded message. This can be useful in schemes where anonymity is required.

Anonymous internet banking depends on the mathematics of public key cryptography and blind signature algorithms. In this simple example we have Alice and Bob and a banker. The banker generates an RSA public key with modulus n= P Q, where P and Q are large primes, making n a semiprime. As described in RSA operation, the bank also generates public key exponent e and private key exponent d.

Bob asks the banker for a $100 deposit slip in anticipation of Alice wanting to transfer money to him. To generate a deposit slip the bank selects a large, globally unique random number R and encrypts it using the bank's public key; this means that it can only be decrypted with the bank's secret key:

R' = R^e mod n

This encrypted value R' is sent to Bob with the promise to deposit $100 into his account when Bob sends the value R back to the bank. The bank is confident that Bob won't be able to break RSA to generate R from R' within the heat death of the universe without knowledge of d, so it does not worry about handing out the deposit slips without receiving anything from Bob.

When Alice wants to pay Bob $100 she asks for the deposit slip and Bob sends her R'. Alice selects a large random value w coprime with n (so as to have an inverse modulo n) and uses it to blind R''=w^e*R' and sends it to the bank to be blind signed. The Bank charges Alice $100 for this operation and returns the blind signed value R'''. Due to the symmetric properties of RSA, this provides her with R:

R'''  = (w^e*R')^d  mod n = (w^e*R^e)^d  mod n = (w*R)^ed mod n = w * R mod n

Because of the blinding process, the Bank is not able to associate R'' or R''' with R' or R. The only possible way for the bank to do this is to trial divide R'' by all the values of R' that it gave out or R''' by all values of R. This means is unable to determine that Bob and Alice are doing business together, preserving the anonymity of the transaction. Alice unblinds R''' (by dividing it by w) to generate the original value R, which she sends to Bob. Bob verifies that R can be encrypted with the bank's public key by computing R' = R^e mod n, which means that Alice has deposited $100 into the bank. Bob then sends this value to the bank and the bank checks its records to be sure that R has not been already used. If it has not, it deposits $100 into his account and updates its database that the unique value R has been redeemed.

Different public keys can be used for different denominations of currency so this system doesn't take appreciably longer for large transactions.

Note that if neither Alice nor Bob wishes the bank to know that they performed a transaction with each other, then it is hard for the bank to find out. However, in order to ensure this is the case many people need to be making transactions at the same time. Otherwise the bank can figure it out by the timing of the transactions, using traffic analysis.

I'm too lazy to actually sift through this protocol change proposal... but I don't see how it's possible to do this.  I mean possible at all: the whole idea behind Bitcoin is that the entire transaction history is available for public verification in the blockchain.  Every transaction ever made.  Remove that, and you're trusting a central authority to keep their records straight: that places all the power in their hands, and that's one of the things Bitcoin is specifically designed to avoid.

Again, I haven't looked at the specification or anything, but I don't see how it could possibly work.

I agree, all this Atlantis hype when SR is under attack is highly suspicious..... If you want to praise Atlantis go do it on their forums..... oh wait, they probably don't have one.

I don't give 2 shits and a fuck about Atlantis.... even if SR only works for 5 minutes a day,  I'll continue to support it over the competition.

If I was DPR I'd delete every forum member hyping Atlantis, along with any SR account that has matching username. I'd also lock new user registration on the forums for a few weeks as well.

This is the SR forum, you should only be aloud to talk about SR.