Litecoin is a good real world testcase for upgrades into Bitcoin. With the recent announcement of MimbleWimble extension blocks for privacy on LTC. Will Bitcoin adopt such a feature and what would that impact?
asked Feb 7, 2022 at 19:00
-
2I'd suggest sticking to asking about the scaling, privacy impact rather speculating on adoption. None of us can tell you if and when a proposal will be merged into Bitcoin.– Michael FolksonFeb 7, 2022 at 19:52
Add a comment
|
1 Answer
It's hard to make predictions about the future, but as of today, nobody has proposed adopting a similar MimbleWimble Extension Block in Bitcoin. Given the skepticism that previous extension block proposals were received with, I would be surprised if such a proposal got significant traction on Bitcoin.
The way I understand the proposal, the MimbleWimble Extension Block (MWEB) is coupled to the on-chain transaction body via a pegging mechanism. Funds can be moved into the MWEB by paying a special on-chain address and withdrawn from the MWEB by effecting a payment from that address.
Inside the extension block, transactions are created via the MimbleWimble protocol. MimbleWimble transactions must be crafted interactively involving both the sender and receiver, but making use Pedersen commitments the values of inputs and outputs are hidden to anyone but the parties crafting the transaction. Immediately after construction, transaction inputs and outputs form a similar graph structure as on-chain Bitcoin transactions. However, the minimal MimbleWimble transactions are especially designed to allow for transaction cut-through: transactions can be aggregated non-interactively facilitated by some Elliptic Curve magic and due to Pedersen Commitments being homomorphic, which prunes any intermediate outputs that already got spent in the aggregate. (E.g. if there are two transactions (A1⇒B1+A2) and (A2⇒C1+A3) they could get aggregated to (A1⇒B1+C1+A3) pruning the creation and spending of output A2.) As MimbleWimble transactions can be aggregated even across blocks, the chainstate reduces to a remaining kernel per transaction, the peg-in inputs and the currently spendable outputs. On the downside, MimbleWimble transactions are very limited in their scripting capabilities.
In result, an attacker can learn more about the transaction graph by actively monitoring the transaction relay, but a passive monitor catching up later would effectively only see a huge coinjoin that is the aggregate effect of all previous transactions with hidden amounts.
I only skimmed the MWEB proposal to brush up on details. I suggest verifying any information in this post if you have more than a passing interest.
-
1MW is great but it’s biggest downside is that the transactions are interactive which means that sender and recipient’s wallets need to communicate in order to complete the transaction.– Mike DFeb 7, 2022 at 23:25