Why are 5-party ring signatures enough for privacy? I don't understand how even if I get everything else right privacy-wise, I can still be connected to a transaction and potentially implicated in something to the tune of a 1/5 chance I was involved. Say there was some other real-life clue that would never be enough on its own, but could be damning enough if combined with the knowledge that I was at least a potential signer of that transaction? Hoping I'm just underestimating one-time stealth addresses or something, because it seems like all the introductory material seems to gloss over this as being fine.
Add a comment
|
1 Answer
Privacy concerns related to ring size are most significant in cases where an exchange or person that gave you the output you are spending knows you control it and is aware of your identity. Significantly reducing the statistical likelihood of a TX being connected to you in the above situation is not difficult using the current default ring size:
Can you tell that those funds actually came from the TX you sent to me 5 hops ago? Probability would be (1/N)^5 that it came from me. For ringsize 5, that's 0.0000032% chance. Just one of many possibilities, without any way of knowing which one is the real trail.
Monero Research Lab continues to evaluate the ring size issue. Minimum ring size will be increased in the future. However, because of the way ring size currently impacts tx size, it is likely that bulletproofs will be implemented before or in conjunction with any major adjustment to the minimum ring size:
Bulletproofs offer substantial improvements when using multiple outputs. With current Monero range proof technology, transaction sizes scale mostly linearly depending on the number of outputs (eg: 1 output = 7kB, 2 outputs = 13kB). With bulletproofs, these scale logarithmically instead (eg: 1 output = 2kB, 2 outputs = 2.5kB).