Will you HODL Monero or dump it for Tari when it comes out?

sarang: Would it be worthwhile to have a specific meeting about -> 'there are considerations for important topics like multisignature support and output migration that warrant much more thorough discussion before a deployment ought to be considered.'

For sure, but as I've said a few times before, I don't know what computational requirements, if any, we should be targeting for multisig support

If we need/expect computationally-limited hardware wallets to be able to do this, that's a strong limitation

but I can't answer whether or not this is needed

do hardware wallets like trezor and ledger generally support multisig even for bitcoin?

Multisig a hw wallet cannot do is better than multisig noone can do.

I guess if they work with electrum?

We would need more general RSA group support, but a general library like OpenSSL would be able to handle it with some work

(the limitation is general RSA groups)

Meaning prime-product groups

It's not the RSA algorithms per se

for Paillier encryption/decryption needed for multisig

ty

Downside is that the primes are selected by the users; they aren't fixed globally

I'd rather kill multisig for Ledger/Trezor than not have Triptych or Arcturus

Ditto. Also... *how much* more computational requirement are we talking? If HW wallets will handle that in ~5 years' time, it's a limited problem

sgp_: +1

I think as long as we have 'standard' multisig support plus standard hardware wallet support, there will be little complaints

right, people can still use non-multisig on those devices

Cool

sarang: what would it take for us to feel more comfortable in the atypical assumption in Arctutus? An audit?

Why not play it safe and simply select Triptych? I think the advantages of Arcturus were not that substantial (I may be off here, sarang can clarify probably)

Space benefits; verification time is comparable

space benefits >10%

Would a Triptych -> Arcturus migration be possible at some point?

for the record, I still support Triptych, but it would be interesting to see what extra effort Arcturus would take since the benefits are not something to dismiss entirely imo

Not sure 10% is worth the risk of having atypical assumptions

Space is arguably fairly cheap, especially in comparison to verification time

I agree verification time is more important

hard to tell exactly from the chart, but looks like ~20-25% smaller?

Isn’t this batching related?

verification is effectively the same for both

batched and unbatched

Right, I meant the space benefits only come with batching compared to Triptych IIRC

maybe I'm missing something, but why is batching relevant for tx size?

I meant multiple inputs, batching was the wrong word

here are the charts sarang posted a while ago

1 input: usercontent.irccloud-cdn.com/file/DYMoX7jy/size-1.png

2 inputs: usercontent.irccloud-cdn.com/file/7Hw5Wnsv/size-2.png

16 inputs: usercontent.irccloud-cdn.com/file/QzJ03VBI/size-16.png

sarang would know for sure but that's how I would interpret those three charts

the arcturus paper showed the verification times for Monero txs from 18 October 2018 to 14 February 2020

if we switched to Arcturus, we'd probably have to change the txs fees to incentivize large-input-# transactions somehow

obviously not too much incentive, but to enough to fairly encourage one tx with many inputs over several with fewer inputs

that sounds ike something of only temporary value. for people with lots of dust in their wallets

makes batched payments cheaper too

batching is for multiple outputs, no?

why this focus on number of inputs?

just because the cost of the verification is lower per input as the # of inputs increase

Many-input-# transactions are less private, see EAE attack

sech1: well, "it depends" :)

back to arcturus vs triptych, it's unclear to me what if anything we can do to feel comfortable with arcturus

I clearly don't have the skills to assess that

I have the same question as selsta about feasibility of Triptych -> Arcturus migration at some point

there are charts similar to above for verification time that I can't find at the moment dependent on the ringsize

I remember Arcturus have a verification time advantage but

*****there are charts similar to above for verification time that I can't find at the moment

I remember Arcturus have a verification time advantage but dependent on the ringsize

Arcturus and Triptych share the same key image format, so switching the required proof from one to the other in consensus is possible without an output set migration

Input count is indeed where you see Arcturus shine, since it requires only one proof per transaction... Triptych (like CLSAG and MLSAG) requires a proof per input

Most transactions either have 1 or 2 inputs though, so for those Arcturus wouldn't have a significant impact, correct?

dEBRUYNE: the chart at the bottom of the Arcturus paper showed the numbers for real Monero transactions over that 1.5 yr window

average # of inputs is >2 iirc, but someone did the numbers on this at some point

Thanks

2.7 average RCT only

90% 1 or 2 in