Alessandra Scafuro

@real_or_random @claudiorlandi Let me add that in principle, the RO could be instantiated with a trusted party that answers to queries. Agreed is useless in practice, but theoretically it does implement an oracle, and if your proof relies on using its code, simply cannot be instantiated.

@real_or_random @claudiorlandi The point is there is no poly-size *circuit* that can implement the RO. I can't pinpoint a reference for this; eprint.iacr.org/1998/011.pdf shows that if the RO is implemented with a function that is *fully specified* to the adversary,the RO methodology fails.

Given commitments Com(x) and Com(y), it's possible to prove in zero-knowledge that y = H(x) for some function H. What if I want to model H as a programmable RO? I can't just assume the attacker knows a circuit for H but then program H. Is there any literature on this problem?

TumbleBit! An anonymous off-blockchain payment channel for #bitcoin. Revised paper: eprint.iacr.org/2016/575.pdf Github: github.com/BUSEC/TumbleBi…