mimblewimble team mailing list archive

[Tim Ruffing <crypto@xxxxxxxxxxxxx>]

On Thu, 2017-09-07 at 16:47 -0400, 0xb100d wrote:
> 
> It struck me (and this is clearly an immense technical overhead idea
> and likely very bad) that you could have two chains a MIM and a WIM
> one that was binding and one that was hiding, and you would move
> value from one to the other depending on your use case. Store it on
> the binding chain, but switch it over to the hiding chain for
> transactions. I think we are all assuming future chain
> interoperability, why not embrace it from the getgo and have our cake
> and eat it to? Other than the fact that it essentially means building
> two chains from scratch that is.... 
> 

One advantage of the hash proposal is that it gives you that choice
already now. You can choose whether you want to give up the money or
your privacy. If you prefer privacy, you can just not reveal the
preimage. Then you cannot spend the money but privacy is
retained. Also, you can postpone that decision until the switch really
happens. (And if you're really paranoid you can even remove the
preimage from your storage or not use a real hash in the first place.)

So hashed switch commitments provide users with a lot of flexibility
without hurting anonymity.


Tim