9

As a followup to this question, I'm curious as to whether an OMNI/Mastercoin-like colored coin protocol could be used on top of Monero, in a private manner. Colored coins are fundamentally different from a Counterparty-style system, (which sits on top of the protocol), while colored coins are literally the tokens transferred on the platform.

My first instinct was to think that this was impossible (as it breaks fungibility), but thinking about it further, I imagine (with an infinite-size TX_Extra) you could provide a chain of proofs signed off on by all prior owners of the colored coin, decryptable only by the receiver - but questions of how to prevent double spends, and the case of what happens if the coin is transferred without the provided proof, are still unresolved in my mind.

4
  • 2
    The only thing I can think of that could this is cryptographically obfuscated computation, but that's wizard stuff. Commented Aug 10, 2016 at 16:18
  • I'm surprised this hasn't gotten any responses yet. Commented Aug 13, 2016 at 19:55
  • 2
    perhaps explaining more would help? Commented Aug 15, 2016 at 12:05
  • 2
    Can you make a single question based on your first paragraph? Depending on the answer(s) you could then ask another follow up question based on one or more of the issues in your second paragraph.
    – 254123179
    Commented Aug 20, 2016 at 16:19

1 Answer 1

2

Based on Nate's understanding of Cryptonote's ring signature implementation: No, it cannot be used with colored coins:

With Bitcoin, there is a one-to-one correspondence between inputs and outputs of transactions. Suppose there is a transaction X with an output X1 that sends 1 satoshi to Alice's address A, and everyone agrees that output X1 is coloured so that it grants title to Alice's 1977 Chevy Nova. If Alice decides to give the car to Bob, she creates a new transaction Y, with an input pointing to X1, and whose sole output Y1 sends 1 satoshi to Bob's address B. Now Bob can prove, by creating a signature corresponding to his address B, that he is the rightful owner of the car. If Mallory tries to claim the car by creating a different transaction with input X1, he will be found out, because he can't sign that transaction with Alice's private key, so it won't verify. If Alice tries to give the car to someone else by creating a second properly signed transaction Z with input X1, it will be detected as a double spend because another transaction spending X1 precedes it in the block chain.

With ring signatures, this correspondence is broken. When creating a transaction, in addition to the one output (of a previous transaction) that you really want to spend, you can list many others. You create a signature that proves that you are authorized to spend one of the outputs you listed, but doesn't give any information about which one it was. However, a linking algorithm ensures that any future attempt to spend that output again will be noticed and rejected.

In the above scenario, if Alice uses a ring signature on her transaction Y, including not only X1 but another output Z1, then her signature will not prove that she is entitled to spend X1 (and therefore is the rightful owner of the car and can give it away); it only proves that she is entitled to either X1 or Z1.

Furthermore, Mallory could create a transaction M that includes X1 and another output K1 that he is entitled to spend. Since he has the private key corresponding to K1, he can properly sign the transaction M, but it won't be clear whether it is spending X1 (which would convey title to the car) or K1 (which won't).

Now, ring signatures are an optional feature in Cryptonote. If you want, you can create a transaction with only a single input, which will make it unambiguous which previous output you are spending. To avoid confusion such as Mallory's transaction above, a coloured coin protocol for Cryptonote would probably specify that to convey title, you have to use a transaction with a single input; then Mallory's multiple-input transaction above would still be a legal Cryptonote transaction, but the community would agree it doesn't grant him title to the car.

In short, the whole point of coloured coins is to create an unbroken chain of transactions that traces the title of the car, and the whole point of ring signatures is to avoid creating such a chain. So if you want coloured coins, you have to avoid using ring signatures in this way.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.