Just a quick follow-up to the BLOOM research update above.
We now have a draft approach for adding the linkability we discussed—the feature needed to catch double-spending while keeping the spender anonymous. The encouraging part is that our initial estimates suggest this could be added with relatively little extra signature data.
That gets at an important question from the earlier update: can we add what BLOOM is missing for cryptocurrency use without losing the compactness that made it interesting in the first place? On paper, there looks to be a promising way forward.
The next step is to put that approach through more scrutiny. The security arguments still need work, and we need an implementation and benchmarks to establish how it actually performs. Small signatures are useful, but not enough if generating or checking them takes too long, especially with the large anonymity sets we want to support.
This is progress on the first building block, not a finished successor to Spark or a commitment to deploy this particular design. But we have something more concrete to evaluate now, which is worth sharing with everyone who has been following this thread.
Thanks for your patience and continued interest. I know research updates aren’t as tangible as a new wallet release, but I’d rather share where we genuinely are than get ahead of the results.
Thank you for keeping us updated Reuben! I really wanted to reply to this topic but kept getting distracted.
Would BLOOM entirely rely on lattice based cryptography like MLKEM? Why not combine quantum and classic by wrapping existing solution? We can’t know if vulnerability would be there in the post quantum approach not by quantum computers but classical breakthrough. Not putting our eggs in one basket given how new the field is looks like a reasonable approach?
Going to ring signatures like Monero wouldn’t be as good i think. Firo has its thing going because its model with burning and redeeming is unique and as im writing this, more secure than what Monero has. I dont believe we should be going in the ring signature direction neither do i believe we should be exploring post quantum without having a hybrid solution. Less weight on the transactions could mean the downfall of it should any issues be discovered and security and privacy are the prime goals and promises of Firo.
The current ring sizes on early estimated benchmarks are much akin to what we have currently in the 32-200k sizes so they’ll function the same if not better. The main drawback is while although it appears faster than classical Grootle OOOMP (which is what we are using now), we haven’t found a way to batch transactions yet but given the early times we are seeing that may not be so important. OOOMP basically works like a giant ring of 32,000 (which we have currently).
I don’t think it’s possible to ‘wrap’ existing solutions.