also you can see a possible cryptosystem that could be used that i designed a few months ago based on SWIFFT lattice signatures and a ternary math based signature calculation scheme https://git.smesh....
i decided to put together a full PQ signature and ZKP proof protocol to add to gnarl-hamadryad. they are pretty decent and competitive based on the specs deepsnek put together for me over an extensive planning session.
now probably one of the things that is why i never dug deep into zkp stuff before was because i wasn't really familiar with the projected use cases. group membership without identification and i am just remembering one of the other things you can do is actually fully anonymized, but auditable ledgers that prevent inflation bugs while making spends fully dissociated from each other.
the two things that make it impractical at current compute and network capacity are the data size and the amount of calculation. i haven't followed the development of the work closely but i remember when i was working for Dusk there was more than a few conversations about the problem about how expensive it was to validate the chain data. probably not gonna really solve that problem here but then zkp-by-default on transactions might not be quite as high value as estimated at least in the sense that if you couple UTXO with compact lattice-based but schnorr signatures, a substantial shor algorithm obstruction but not as strong as a full PQ scheme.
anyway. anonymised group membership is a great thing. for onion routed connections, tunneling over relays and being able to control access to resources (relay bandwidth for things like realtime interactive instant messaging) has uses for sure, while letting you skate past the complexity of MLS - simple tunnel-shielded p2p messaging instead of complex protocol designed for groups when a large amount of activity is actually two party.
now probably one of the things that is why i never dug deep into zkp stuff before was because i wasn't really familiar with the projected use cases. group membership without identification and i am just remembering one of the other things you can do is actually fully anonymized, but auditable ledgers that prevent inflation bugs while making spends fully dissociated from each other.
the two things that make it impractical at current compute and network capacity are the data size and the amount of calculation. i haven't followed the development of the work closely but i remember when i was working for Dusk there was more than a few conversations about the problem about how expensive it was to validate the chain data. probably not gonna really solve that problem here but then zkp-by-default on transactions might not be quite as high value as estimated at least in the sense that if you couple UTXO with compact lattice-based but schnorr signatures, a substantial shor algorithm obstruction but not as strong as a full PQ scheme.
anyway. anonymised group membership is a great thing. for onion routed connections, tunneling over relays and being able to control access to resources (relay bandwidth for things like realtime interactive instant messaging) has uses for sure, while letting you skate past the complexity of MLS - simple tunnel-shielded p2p messaging instead of complex protocol designed for groups when a large amount of activity is actually two party.
1
