Vernacular Mimblewimble: A new type of privacy-preserving protocol

Editor's Note: This article comes fromEthereum enthusiastEthereum enthusiastmedium, reprinted by Odaily with authorization.

(WeChat ID: ethfans), author: Conor O'Higgins, translation & proofreading: stormpang & A Jian, the original text comes from

Note: Mimblewimble is designed as a public chain consensus protocol, and its features are described below, and the specific information of the transaction may not be disclosed. There are already more than one team implementing Mimblewimble.

image description

-Harry Potter - Warner Bros. - Casting the Mimblewimble Spell Fragment-

(Editor's note: I don't think the mouth shape of the person is using Mimblewimble, but it may be the Patronus spell (Expecto Patronum), what do you think?)

Satoshi Nakamoto's Bitcoin paper has a chapter called "Privacy" in which Satoshi Nakamoto very clearly explains the privacy limitations of Bitcoin. These deficiencies will continue to “worse” as attackers become better able to use Bitcoin data to locate or real-name Bitcoin users. This has come as a surprise to some who believe that Bitcoin is not associated with a name and thus protects privacy. Let's take a look at what data Bitcoin can analyze, and why-

secondary title

• Bitcoin satisfies two needs of a monetary system by revealing 3 secrets

• Every Bitcoin transaction reveals 3 secrets:

• sender address

Amount of bitcoins sent

• recipient address

• Bitcoin doesn't display this information because it hates privacy. It reveals these secrets because any monetary system (gold, cash, barter) must satisfy two conditions:

It must be able to verify that the amount of coins received is equal to the amount sent. If I could send 1 coin from one address in one transaction and receive 2 coins at another address, the cryptocurrency system would surely collapse. In the normal system, if I put 5 euros in your hand, then I lose 5 euros and you gain 5 euros. In this transaction process, there is no money created out of thin air, nor money disappearing out of thin air.

I can only electronically transfer funds from my own bank account, not from yours. We must be able to verify that the transaction was sent from the debit card and the holder of the PIN/Internet banking password, or the private key in the cryptocurrency.

Bitcoin satisfies both of these conditions by revealing the above three secrets.

Bitcoin transactions contain the transfer amount and the recipient's address in clear text. The first condition of the monetary system is thus easily satisfied; we see 5 bitcoins entering the transaction and 5 bitcoins coming out.

To verify that the Bitcoin system satisfies the second condition, Bitcoin uses public addresses with corresponding private keys. Public addresses hold bitcoins. (Transaction) The sender generates a signature by using the corresponding private key to sign his transaction (that is, the transaction that I just explained contains the transaction amount and the receiver's address). Everyone can verify that this signature was generated by the private key corresponding to the address holding the bitcoin; thus we verify that the transaction came from someone with the right to initiate the transaction.

Mimblewimble can satisfy these two conditions of the currency system without revealing the above three secrets.

The proof process requires some simple mathematics that can be understood by only a 10-year-old. I also use some complex mathematics in the proof, probably understandable by a 12-year-old.

Multiplication is easy, but factoring is hard

Many people are terrified of math and skip it whenever it is encountered in an article. However, if it is as simple as the picture below, you will not be afraid, right?

If I give you pen and paper, you can solve these problems in two minutes, right? Multiplication is very simple for people. For a computer, even a small pocket computer can quickly calculate the result of multiplying two million-order numbers.

But let's make a little change. Let's move the question mark to the other side:

(Interlude: In this article, I'm going to talk about multiplying numbers like 83 and 23 because I like these numbers, they're familiar, and they're very easy to understand. But computers don't use these numbers, they use very large numbers. Actually , a computer can figure out which two numbers I used to multiply to get 4221, but even a very powerful modern computer can hardly figure out which numbers you use to multiply to get a very large number.)

For simplicity, I don't want to discuss elliptic curves. In practice, encryption systems don't use any numbers, but a special collection called elliptic curve points. But the simple mathematical properties are the same in both cases: multiplication is easy, but the inverse of multiplication, factorization, is hard.

secondary title

Use multiplicative properties to hide information and verify ownership

If I ask you what is the missing number below...

...you can't tell me very quickly because the question marks are on the left and it's hard to find the missing factors.

Well, let me tell you. The missing numbers are 23 and 83. Now you want to verify that what I said is true, that the missing ones are really 23 and 83, which has become a simple multiplication problem.

You can solve for the answer very quickly, and 23 and 83 are indeed factors that make the product equal to 20,348,031.

If I'm lying, you can easily spot it, because the factors I give will not make the product equal to the large number on the right. I cannot make up wrong factors, nor can I guess or calculate them. I have to know these two factors ahead of time.

(Interlude: Note that the large number on the right is divisible by all the numbers used to construct it on the left; it is divisible by 83, by 11, and by all numbers on the left. We'll take advantage of this later.)

This is just multiplication. About 10 years old doll can understand. However, we have accomplished two very important things for cryptocurrencies -

We want to hide information. Now we know how to do it: we can hide information in the form of multiplication by the unknown. This makes it very difficult to decipher the original message.

We also want to prove that we hold the private key. Now we also know how to do it: just give the factors of large numbers.

We can do both by simply using the basic properties of multiplication.

hide transaction amount

Let's hide the transaction amount by multiplying it by a large, secret number. One of the three types of information that Bitcoin leaks is the number of Bitcoins sent. When I send 5 bitcoins over the bitcoin blockchain, the transaction amount is shown in clear text (ie, the number "5"). We hide it with multiplication. In the following equation, it is not easy for you to tell me what the transaction amount is:

The above equation is a bit like the representation of the transaction amount in Mimblewimble, but not exactly the same. In Mimblewimble, both sender and receiver give a number like this:

This number is called the Pedersen Commitment; I don't know why it's called that. The important thing to note is that the Pedersen Commitment includes a portion of the transaction amount (but hides it by multiplying by a large number) and a portion of the private key.

Note that both the sender and receiver participate in the creation of the transaction. This is completely different from Bitcoin. This approach avoids revealing the receiver's address, but makes it necessary for the sender to contact the receiver in some way. Beam includes a secure BBS system (separate from the Beam blockchain) that enables senders and receivers to securely exchange their Pedersen commitments.

(For simplicity, I omitted the transaction fee. In actual implementation, when I send money to a friend or vendor, I usually also give some transaction fee to the miner. The principle is the same. I also left out something about rangeproofs content, it proves that the hidden transaction amount is not a negative number, because sending -5, is like stuffing 5 free coins into my wallet. Maybe Harry Potter has another spell to achieve this :D)

Multiplicative Associativity

What follows is the most advanced math stuff we'll do. In Ireland, when you're a big boy at 12, that's what's taught in school -

If I want 2 plus 4 times 3, I can first calculate 2 + 4 = 6, then use 6 to multiply 3 to get 18, or I can first calculate 2 × 3 = 6, then calculate 4 × 3 = 12, and finally The sum is also 18.

One thing I want you to remember is that when we want to multiply the sum of two numbers by a third number, we can either sum them first and then multiply them by the third number, or we can first calculate Multiply one number by a third number, calculate the product of another number by the third number, and finally add the two products. These two processes are equivalent.

Prove that money in equals money out

Remember that one of the conditions required for a monetary system is that the amount received minus the amount sent must be 0. I put 5 euros in your hand, you get 5 euros. 5 - 5 = 0.

A Mimblewimble transaction consists of two Pedersen commitments: one to record the amount of money entered into the transaction, and another to record the amount of money in the transaction result:

For example, if the sender loses 5, the receiver gets 5:

But instead of multiplying the input transaction amount by this large number and the output transaction amount by this large number separately, we can combine them together like this:

(Translator's Note: "key1 + key2 × big number2" in the picture below should be "[key1 + key2] × big number2")

5 - 5 = 0. 0 multiplied by any large number is still 0. Then this formula is left:

Or:

The transaction amount part is gone! Although at each step, the transaction amount is hidden by multiplying it with a large number, we don't need to disclose these values, we only need to verify that the result is zero (to ensure that the system has no errors).

The reason why the transaction amount part has been concealed is that money in and money out are equal. If they are not equal, then their sum will not be 0, and then the result of the simplification will have something more...

...if the transaction amount ends up not being 0, then the transaction kernel is not divisible by 23 and 83. The Beam protocol will reject the transaction because it is malformed.

(You may notice that in some cases, if the value of the transaction amount is not zero, such as 1909, then the transaction core is still divisible by 23 and 83. Since the numbers I used in the illustration are very small, this Coincidences are possible. But in the very large-scale digital domains used by computers, the chances of such collisions are infinitely close to zero.)

The rest is the private key part

• The private key part is a very large number, which is the product of the sum of the sender's and receiver's private keys and another large number. The private key is divisible by this large number (Translator's Note: After multiple references, the "big number" here refers to "bignumber2", so the transaction core must also be divisible by the private key), just like 83 and 23 are Same as the "secret number" for the large number on the right.

• Therefore, there are two reasons why the transaction core can be divisible by the private key:

Because the transaction amount part is 0

• Because the private key part is obtained by multiplying a set of numbers, including our private key 83 and 23.

• From this we can satisfy the two conditions required for any monetary system:

If the transaction amount part is 0, it means that the input amount minus the output amount equals 0. In other words, the input amount is equal to the output amount; no money disappears, and no money is created. We have achieved this by first hiding the transaction amounts by multiplying them by an unknown large number, and then combining them through multiplicative associativity so that they are masked by a large number, but the sum is exactly 0.