Both Grin and BEAM are developed based on MimbleWimble. What are the highlights of it?
Editor's Note: The original text is from theblockcrypto, authorArjun Balaji。
Editor | Lu Xiaoming
Editor | Lu Xiaoming
In January of this year, two privacy-focused cryptocurrencies were launched: BEAM mainnet launched on January 3rd, and Grin will launch on January 15th.
Both coins are based on a new privacy-preserving protocol called the MimbleWimble protocol.
secondary title
What is the MimbleWimble protocol?
MimbleWimble is a blockchain protocol focused on fungibility, scalability, and privacy. The protocol was first proposed in July 2016 by Tom Elvis Jedusor (pseudonym) in a white paper published on the IRC channel #bitcoin-wizard, proposing a new way of transacting that could improve privacy on public blockchains.
(Odaily Note: IRC, the abbreviation of Internet Relay Chat, is an instant chat method through the Internet, mainly used for group or individual chat.)
The MimbleWimble white paper builds on another published in 2013anonymous paper. This paper uses one-way aggregate signatures (one-way aggregate signatures), paired with a new cryptographic primitive - paired encryption, although this cryptographic primitive is not very trusted in academia.
In addition, the MimbleWimble white paper also refers to two privacy proposals made by Bitcoin core developer Gregory Maxwell - Confidential Transactions and CoinJoin.
The so-called CoinJoin means that when you want to transfer money, you can find other people who also want to transfer money, and you sign your own input separately to create a transaction together. The core idea of CoinJoin is to take advantage of the fact that one transaction of Bitcoin can have multiple inputs and multiple outputs, and combine multiple transactions, making it difficult for people to distinguish which input corresponds to which output, and thus make it difficult to track a certain address The source or destination of funds.
The original MimbleWimble white paper used the same elliptic curve encryption technology as Bitcoin, which attracted the attention of many Bitcoin researchers. Blockstream mathematician and applied cryptographer Andrew Poelstra was one of them, and he refined the MimbleWimble white paper, releasing a "precise" version in October 2016. For a long time, Andrew Poelstra's work has been focused on protecting privacy, working on Bitcoin's confidential transactions and"Scriptless Script"。
(Odaily note: Blockstream is one of the institutions that provide funding for Bitcoin core developers)
The original idea was that MimbleWimble could be integrated as an upgraded version of Bitcoin, or exist as a side chain. But Blockstream co-founder, Bitcoin core developerPieter Wuille Said in 2016, there are some challenges in integrating it to be backwards compatible:
Bringing MimbleWimble to Bitcoin in a backwards-compatible manner will be a difficult endeavor. It's not impossible, but it will be very difficult. If I had to experiment, I would like it to be an experimental split chain or sidechain; in a sidechain we won't be introducing a new cryptocurrency, it will also be a separate chain. MimbleWimble has some downsides, like, it doesn't have a scripting language... despite the privacy downsides of the scripting language, it works really well. Mimblewimble takes people to the other extreme, where you have better privacy, but at the expense of other features.
MimbleWimble does do away with the scripting language that allowed innovations like payment channels (like the Lightning Network) and cross-chain atomic swaps, both of which were enabled in 2017’s Bitcoin innovation. Since then, two independent implementations of the MimbleWimble protocol have emerged, each with different concerns about community, ethos, funding, and technical details.
The first project to implement the MimbleWimble protocol is Grin. A few days after Andrew Poelstra's "precise" release, Ignotus Peverell (pseudonym) created a project called ignopeverell/grin on Github. In this project, he proves that a protocol written in Rust can be partially implemented and presents his vision for the project.
In March 2017, Peverell published a technical introduction to Grin and MimbleWimble, which is now the main reference for protocol specifications today. To this day, the project is still largely maintained by a group of anonymous developers, some of whom use pseudonyms from Harry Potter (such as Luna Lovegood, Seamus Finnigan, and Percy WeasleyPercy), who they believe are similar to Grin consistent with the original spirit of the project.
Grin's first testnet was launched in November 2017, and the project is currently undergoing its fourth test, which is also considered to be the last testnet before the project's mainnet goes live.
The second project of the MimbleWimble protocol, BEAM, started in March 2018 and was officially announced on the one-year anniversary of the original Mimblewimble white paper. BEAM is in a separatewhite papersecondary title
How does MimbleWimble improve privacy?
MimbleWimble made some modifications to Bitcoin's UTXO model to enable private transactions based on Confidential Transactions and CoinJoin. Thatwhite paperExpressed as follows:
no address;
no quantity;
Two transactions can be merged into one block, forming only one, removing all intermediate information.
The first two parts can be achieved through the use of Confidential Transactions, a proposal from the former CTO of Blockstream. He proposes to improve upon Bitcoin's UTXO model using a cryptographic primitive called the Pederson Commitment Scheme. For confidential transactions, only the participants in the transaction can see the transaction amount. This is theoretically possible, but there is a key problem: non-participants in the system must be able to identify whether the transaction is forged, so as to prevent false transactions. In other words, if a user spends more than their account balance, the transaction can be identified and terminated.
In Bitcoin, inputs, outputs, and transaction amounts are all essential when committing to a transaction using a simple cryptographic hash function. The Pedersen promise allows a sender to commit to a transaction volume without revealing it to the general public by propagating it as a hash on the blockchain; The recipient or anyone else who may need to know the information, such as a regulator, reveals the amount.
Pederson commitments are also transferable, allowing the recipient to spend them again elsewhere without revealing the amount. This is because the chosen hashes are homomorphic, meaning you can perform simple arithmetic functions on them, such as subtraction and addition, without decrypting the data.
But how do you prevent someone from accepting two inputs (eg -100BTC, +100BTC)? What about using "+100 BTC" as an input in a confidential transaction and ignoring "-100BTC"? The solution to Confidential Transactions is to use another cryptographic primitive called "Range Proof". This proof ensures that the total money supply does not change by guaranteeing that the inputs in the system are within a certain range (eg "+100BTC").
The MimbleWimble protocol uses confidential transactions to ensure that no addresses or quantities are visible in the system.
image description
(Example of Bitcoin transaction visualization, courtesy of Benedict Koehler)
Data visualization is not without precedent — startups like Elliptic and Chainalysis often use this form of on-chain forensics to detect fraud and “illegal transactions” (e.g. money laundering, black market activity). Some exchanges and government organizations also provide funds to track these companies for the sake of investigation. Bitcoin is still a poor choice for some private transactions because the Bitcoin network graph is easy to trace.
image description
(CoinJoin diagram, provided by Artncase)
Bitcoin wallets like Wasabi Wallet have implemented CoinJoin to provide transaction layer privacy for Bitcoin. However, the results were not satisfactory. The anonymity sets of these products tend to be very small, with only a few participants per transaction, and it often takes a significant amount of time to obtain matching funds. The researchers were even able to deanonymize most transactions in small anonymity sets.
MimbleWimble solves this problem by making CoinJoin a core part of the protocol, rather than transaction-level privacy improvements by third-party wallets. In MimbleWimble, all transactions in each block are automatically compressed into one transaction, and most of the intermediate transaction information is hidden.
Now you're probably thinking: my inputs, outputs, and transaction amounts are all hidden, and the transaction graph is very blurred... Is there any other way for those with ulterior motives to determine what I'm doing?
The answer is: yes, potentially a single node could use the original IP address to de-anonymize the transaction.
When a bitcoin transaction comes from a wallet, it is broadcast to a set of nodes, which are then quickly broadcast to peer nodes in the bitcoin network. Because individual transactions are distributed decentralized before these transactions are combined into a block, those with ulterior motives can record the transaction and the IP address from which it came, and use this information to gain information about someone's activities.
MimbleWimble's solution is to take another solution, Dandelion (Dandelion). This scheme was proposed by a research team at the University of Illinois at Urbana-Champaign, and it has been discussed and concerned as an improvement scheme of Bitcoin.
The goal of the "Dandelion" scheme is to obfuscate the IP addresses of Bitcoin transactions. In this scheme, the propagation of Bitcoin transactions on the network is divided into two stages: the "stem" stage (obfuscation) and the "fluff" stage (obfuscation).
"stem" stage
Instead of making transaction information public to all nodes, nodes pass data to random nodes through a privacy graph, thereby keeping transaction information separate from other public nodes. As transaction information continues to be sent on-chain, it remains anonymous except to the nodes that directly receive it. Finally it reaches a node which announces to the rest of the network via broadcast.
"Fluff" stage
The diffusion process is the beginning of the fluff phase, which represents the distribution of transaction information in the blockchain network. While transactional information is currently in the public domain, it is difficult to find access to this stage of dissemination. Mapping it back to the original node becomes very difficult as the initial phase gets mixed up with other random nodes sending data. The normal transaction transmission path is to spread from a single point to other connection points; after using the Dandelion protocol, the transaction information takes a quiet path between random nodes, and finally spreads to the entire network through multiple nodes.
image description
(Schematic diagram of "Dandelion" displayed by Giulia Fanti in Lisbon)
secondary title
Difference Between BEAM and Grin
Although both Grin and BEAM are practitioners of the MimbleWimble protocol, there are still some differences between the two:
Grin is written in Rust, while BEAM is written in c++.
While both groups are "ASIC resistant", they took different approaches in choosing the hashing algorithm and initial method (discussed later).
The Grin team chose to stick to open source governance. One of the considerations is the funding issue, which relies on donations; the BEAM team, in addition to leaving 20% of the tokens to the founding team like Zcash, also conducted a round of private placement.
In Grin's monetary policy, "a new Grin is spawned every second", keeping inflation constant forever (though gradually approaching 0%). This is unlike other cryptocurrencies such as Bitcoin, which is highly deflationary. All in all, the Grin team aims to discourage hoarding of Grin. In contrast, BEAM has a fixed supply of about 263 million coins, and the total amount will be mined after 133 years. It is a deflationary token with limited supply.
If there is an error, Grin provides a partial synchronization mode to solve the problem, which allows nodes to synchronize a small part of the data required for a complete node synchronization to the network; BEAM requires all data to synchronize.
mining
mining
Mining prospects for Grin and BEAM are still unclear as both networks are nascent.
The BEAM team has opted for a modified Equihash PoW, which will prevent ASICs from accessing the network in addition to the planned 6-month hard fork.
Equihash is a proof-of-work that requires high memory, which means that how many coins you can mine depends mainly on the size of your device's memory. It is almost impossible to create a low-cost mining custom hardware (ASIC) in the short term, so Equihash is considered to be able to construct a more decentralized POW algorithm.
Grin uses the new Cuckoo Cycle, an alternative proof-of-work developed by John Tromp in 2015. Although the algorithm was designed to be ASIC resistant, the team has long believed that ASICs were inevitable. Two solutions emerged in September 2018: one optimized to be ASIC friendly ( Cuckatoo31+ ); the other optimized to allow GPU competition ( Cuckaroo29 ), with POW balancing mining rewards between the two algorithms every 24 hours.
The GPU of choice for early Grin and Beam miners was the Nvidia GTX 1080 TI, a general-purpose hardware that is also used for mining other blockchains.
Early BEAM release statistics show that two major mining pools dominate: sparkpool.com (multi-currency mining pool with 69% hash rate) and beepool.org (30% hash rate).
The Grin mining market is more institutionalized. More than a dozen private mining companies provide funds, venues and HNW (high-net-worth clients), and individual miners can choose to join a mining pool when mining. grinmint mining pool and MWGrinPool.com are the first two options offered by the community.
in conclusion
in conclusion
In a world of social credit systems and artificial intelligence technology, it is clear what you are trading, who you are trading with, and even what will happen in the future. Therefore, privacy is important when designing future monetary systems.
While using privacy methods (such as Bitcoin mixers) may "taint" users in the eyes of law enforcement, private currencies are necessary for privacy, even though there may be nothing to hide. But "with privacy currency" and "without privacy currency" are two concepts. After having it, the decision to use it or not lies with us.
Grin and BEAM are actually two different approaches to privacy protection. Despite superficial similarities, they are different in every way other than being based on the MimbleWimble protocol.
References:
References:
MimbleWimble: History, Technology, and the Mining Industry
Bitcoin Privacy Enhancement --- Brief Analysis of CoinJoin Technology
Comprehensive analysis of various blockchain privacy protection solutions
