johank



Offline



Activity: 14

Merit: 140







NewbieActivity: 14Merit: 140 Anonymous Atomic Swaps Using Homomorphic Hashing August 30, 2018, 03:28:29 PM Merited by theymos_away (50), ETFbitcoin (35), malevolent (13), LoyceV (10), DarkStar_ (3), aliashraf (3), dave111223 (2), o_e_l_e_o (2), d5000 (1), Coolcryptovator (1), Piggy (1), Shitcointalk (1) #1



I've written a paper entitled: "Anonymous Atomic Swaps Using Homomorphic Hashing". It is available at



Briefly, an atomic swap is the exchange of crypto between two parties using two transactions. Each transaction uses a hashed-time-lock-contract (HTLC) to lock the coins being sent to the other party. The hash used in both transactions are the same, linking the transactions. The paper describes how homomorphic hashing can be used to set up the HTLC's but each with a different hash, thus breaking the public link between the two transactions. The two hashes are related by a secret shared between the two parties, enabling the swap to proceed as per normal. As soon as the first party claims their coins using their pre-hash, the second party can use the shared secret and the pre-hash used by the first party to determine the pre-hash they have to use to claim their coins.



Any comments are welcome. I would like to hear thoughts on this. HiI've written a paper entitled: "Anonymous Atomic Swaps Using Homomorphic Hashing". It is available at https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3235955 Briefly, an atomic swap is the exchange of crypto between two parties using two transactions. Each transaction uses a hashed-time-lock-contract (HTLC) to lock the coins being sent to the other party. The hash used in both transactions are the same, linking the transactions. The paper describes how homomorphic hashing can be used to set up the HTLC's but each with a different hash, thus breaking the public link between the two transactions. The two hashes are related by a secret shared between the two parties, enabling the swap to proceed as per normal. As soon as the first party claims their coins using their pre-hash, the second party can use the shared secret and the pre-hash used by the first party to determine the pre-hash they have to use to claim their coins.Any comments are welcome. I would like to hear thoughts on this.

johank



Offline



Activity: 14

Merit: 140







NewbieActivity: 14Merit: 140 Re: Anonymous Atomic Swaps Using Homomorphic Hashing August 30, 2018, 11:08:21 PM

Last edit: August 31, 2018, 05:30:45 AM by johank Merited by DarkStar_ (3), d5000 (1), LeGaulois (1) #3 Hi aliashraf



Firstly, thank you very much for your feedback. It is very insightfull.



You have mentioned a weakness that I have not considered and that I would like to address.



You are correct in that an attacker could try to guess the two secrets using the sum provided.



There are actually two attacks that I see possible. The first you have mentioned, but I also realised there is another possibility.



If the sum t is very low or very high, very few secrets will be candidates to generate that sum. For example, if we use n = 3 and 8 bit representation with p = 257 and the sum is 2, then the secrets must be 1 and 1. The same for very high sums. If the sum is 33162750 and the secrets are limited to max 255 then the secrets must both be 255.



This attack can easily be solved by limiting the sums we find acceptable to the range (2/3*p)3 < t < p3.



The second attack is the one you mentioned. To analyse this attack it is necessary to determine the effective search space that will result from using the equation s 1 3 + s 2 3 = t, for a given t.



Suppose the attacker launches a brute force attack on this equation, what will the effective search space be?



The attacker will have to start with s 1 = 1 and solve for f = floor((t - s 1 3)1/3) and c = ceil((t - s 1 3)1/3).



If f = c they would have solved the problem with s 2 = f = c for a given s 1 .



The error in t is (s 1 3 + c3) - t or (s 1 3 + f3) - t.



The attacker can 'ride the curve' closer to t by starting from a point to search for (s 1 3 + c3) - t = 0. But there is no guarantee that it will end in a solution. (s 1 3 + c3) - t has many jump discontinuities. As soon as it gets close to 0 it jumps. According to estimates on a small space, there are approximately 40% * t1/3 discontinuities. The attacker will therefore still have to search about 40% * t1/3 of the space.



Using the limits for t previously set, I hypothesize the search space would therefore be between 25% * p and 40% * p.



Assuming a bit space of 256 bits is used in the hash, this would still be a large space.



I understand from your description of the attack, that you would look for values near the total. And that if you have enough randomly selected hashes, you would find an exact match by moving in on the exact match. But (s 1 3 + c3) - t has many jump discontinuities. And any starting point could lead to a solution, but most starting points wouldn't.



So even a random attack would be faced with the same search space. And it has to be an exact match, or the secrets would be slightly out and not match the required hashes.



Again, thank you for your feedback and insights. They are greatly appreciated.



Please feel free to provide further comment. If I have not explained myself correctly, please ask for clarrification.



If I have made reasoning errors, please bring them to my attention



Regards



Johan



johank



Offline



Activity: 14

Merit: 140







NewbieActivity: 14Merit: 140 Re: Anonymous Atomic Swaps Using Homomorphic Hashing August 31, 2018, 09:12:31 AM

Last edit: August 31, 2018, 09:38:17 AM by johank #4 Hi



I think I can prove the difficulty of finding e = 0 for e = s 1 3 + c3 - t [where c = ceil((t - s 1 3)1/3) ] scales with increasing size of space. (e is the error) (please refer to previous post)



First define b = ceil(a, d) where b is the number greater than a with d decimal places, e.g. b = ceil(a,0) wil give the integer larger than a and b=ceil(a,1) will give the number larger than a and divisible by 0.1



Then observe that b = ceil(10 * a, 0) = 10 * ceil(a, 1). That is, we can multiply a by 10 and then ceil to closest integer, or we can ceil to closest 0.1 and then multiply by 10.



Then scale space with m so that s 1 ' = 10m * s 1 , t' = 103*m * t,



e = (s 1 ')3 + (ceil((t' - (s 1 ')3)1/3,0))3 - t'



e = (10m * s 1 )3 + (ceil((103*m*t - (10m*s 1 )3)1/3,0))3 - 103*m*t



e = (10m * s 1 )3 + (ceil(10m*(t - (s 1 )3)1/3,0))3 - 103*m*t



e = (10m * s 1 )3 + (10m*ceil((t - (s 1 )3)1/3,m))3 - 103*m*t



e = 103*m * (s 1 3 + (ceil((t - (s 1 )3)1/3,m))3 - t)



If we now increase m, the ceil can be approximated by removing it and this then reduces to



e = 103*m * (s 1 3 + (t - (s 1 )3) - t)



e = 103*m * 0



Therefore e reduces to 0 for all values of s 1 and t if m becomes large enough.



Effectively as m increases the search space changes from integer space to rational space.



Thus the search for a unique solution to (s 1 3 + c3) - t becomes intractable.



As before comments and questions are welcome.



gmaxwell

Legendary





Offline



Activity: 3192

Merit: 4301









ModeratorLegendaryActivity: 3192Merit: 4301 Re: Anonymous Atomic Swaps Using Homomorphic Hashing September 01, 2018, 01:38:07 AM #5



CoinSwap:



Swapping with adaptor signatures:





The simple power sums looks like deanonyizing them is a solvable modular lattice problem but I haven't looked carefully, I'd be interested in knowing how you think your approach compares to the coinswap and adaptor signature approaches? Relevant related things:CoinSwap: https://bitcointalk.org/index.php?topic=321228.0 (now that the network has CSV and/or fixed malleability a somewhat simpler protocol can be used; see also https://github.com/AdamISZ/CoinSwapCS Swapping with adaptor signatures: https://github.com/apoelstra/scriptless-scripts/blob/master/md/atomic-swap.md The simple power sums looks like deanonyizing them is a solvable modular lattice problem but I haven't looked carefully, I'd be interested in knowing how you think your approach compares to the coinswap and adaptor signature approaches?

johank



Offline



Activity: 14

Merit: 140







NewbieActivity: 14Merit: 140 Re: Anonymous Atomic Swaps Using Homomorphic Hashing September 01, 2018, 01:56:40 PM

Last edit: September 01, 2018, 03:14:38 PM by johank Merited by LeGaulois (2) #7 @gmaxwell,



Thank you for making me aware of the CoinSwap and the Adaptor signatures. I was not aware of this work and will update my paper to reference and discuss how it compares to my work. I will also discuss this here as you asked how they compare.



As I understand from what I have read on the CoinSwap method it has the following features relevant to your question:

1) It runs on current cryptocurrencies without them needing modification and no novel cryptography is needed;

2) It uses scripts that are frequently used, so that it can blend in with the environment;

3) It uses between 4 and 6 transactions to execute, of which the first two are 2-of-2 multisignature transactions; and

4) All the coins that are being swapped are swapped together.



From my understanding of the Adaptor signature it has the following features relevant to your question

1) It would require a soft fork to implement Schnorr signatures;

2) It will use Schnorr signatures to release coins;

3) It uses 4 transactions to execute; and

4) All the coins that are being swapped are swapped together.



If there is something I do not understand correctly, please bring this to my attention.



The main features of my proposal that are relevant to your question are:

1) It would require a soft fork to implement the needed homomorphic hash opcode;

2) It will use the created homomorphic hash code to release coins;

3) It uses a minimum of 2 transactions to execute; and

4) The coins can be swapped in a variety of combinations.



Let me explain at the hand of the items above what the differences therefore are.



The CoinSwap does not require modification; the Adaptor signature does but it seems a BIP is in the process. My proposal will require due investigation to make sure it is secure and would then require a BIP.



The CoinSwap blends in much more with the environment than the other two which require special opcodes. But this might not be as safe as it sounds. It is true that the CoinSwap multisig transactions would not be found among all the other multisigs, but what would happen in practice is that someone would investigate a person by following the history of their coins. If they encounter a multisig transaction they would as a matter of course search for another multisig transaction for the same amount around the same block height. If they found such a multisig they would fork their investigation to follow both coin histories.



In my opinion any anonymous swap of coins will leave some sort of fingerprint. That cannot be eliminated. What needs to happen is for that the anonymous swap must be the standard method of swapping crypto assets and it must be possible for the swap to be broken up into smaller transactions with different amounts. That way if an investigation is following coins and it finds a swap has occurred, it must search for an unknown number of transactions in a sea of similar transactions.



That brings me to the last point. To my understanding the CoinSwap and Adaptor signature methods swap coin for coin in a fixed set of transactions. In other words A gives 1 BTC to B in TX1 and B gives 1 BTC to A in TX2. In my proposal I make the point that implies the following is possible:

1) A creates 3 transactions with amounts 0.2 BTC, 0.3 BTC and 0.5 BTC to send to B; and

2) B creates 2 transactions with amounts 0.4 BTC and 0.6 BTC to send to A.



The amounts all add to 1 BTC, each transaction will have a different hash, all hashes are related by a set of shared secrets, and if A claims a single transaction in (2) B will be able to claim all transactions in (1). These transactions can also happen in different blocks. This is a very important point that is not made in any of the literature that I read on the CoinSwap and Adaptor signature methods. I suspect it is possible for the Adaptor signature methods but not for CoinSwap.



But to hide the swap with the homomorphic opcode that flags it as a swap, these swaps would need to be the standard method of crypto asset swapping. I believe this is true no matter which of these three methods are used, even for the CoinSwap method for reasons mentioned above.



On a side note, a homomorphic hash might also have applications other than atomic swaps. For example:

1) Alice generates a secret s1 and Bob generates a secret s2;

2) they both hash their secrets to generate h1 and h2;

3) they sum the hashes to generate ht

4) They can now use this ht in a transaction

5) If either s1 or s2 is revealed the other party can determine st which is the pre-image of ht.

At this time this transaction is a bit of a hammer looking for a nail. I mention it because someone might be able to use it and it helps you to understand the possible value of the proposed homomorphic hash.



I hope this answers your question to your satisfaction. If you have any further questions on this, please let me know.



---------------------------------------------------------------------------------------------------------------------------------------



@aliashraf



I look forward to hearing from you regarding any results your investigation produces.





andytoshi



Offline



Activity: 174

Merit: 132



-







Full MemberActivity: 174Merit: 132 Re: Anonymous Atomic Swaps Using Homomorphic Hashing September 01, 2018, 03:13:52 PM Merited by LeGaulois (1) #8



It is not possible to do a cross-chain atomic swap with only two transactions because you need at least one transaction on each chain, and the first transaction on each chain can be invalidated by publishing a conflicting transaction alongside it. You can do adaptor-signature based atomic swaps in Bitcoin without Schnorr; see https://eprint.iacr.org/2018/472 which has a full security proof (and security model, which is a nontrivial thing to define for transitive atomic swaps). Adaptor signatures can be used to make arbitrary sets of transactions atomic; and to even add transactions to these sets after the protocol has started. They are definitely not restricted to pairwise exchange, though in practice I expect you'll find it's hard to coordinate much else.It is not possible to do a cross-chain atomic swap with only two transactions because you need at least one transaction on each chain, and the first transaction on each chain can be invalidated by publishing a conflicting transaction alongside it.

johank



Offline



Activity: 14

Merit: 140







NewbieActivity: 14Merit: 140 Re: Anonymous Atomic Swaps Using Homomorphic Hashing September 01, 2018, 07:56:10 PM Merited by aliashraf (1) #11



You are correct, you can use EC. Specifically the proposal by Andrew Poelstra is a manner to use Schnorr signatures on EC curves to achieve this. From what I have learnt they approaches achieves something very similar. The main differences are that this proposal would use 2 transactions and Andrew's would use 4 and that there is already a BIP in the works to make Schnorr signatures part of Bitcoin.



What I am interested in seeing is what else the Scriptless Script's of Andrew can achieve. As for this proposal, the following example is another type of transaction that it could be applied to (as discussed in previous post):

Quote 1) Alice generates a secret s1 and Bob generates a secret s2;

2) they both hash their secrets to generate h1 and h2;

3) they sum the hashes to generate ht

4) They can now use this ht in a transaction

5) If either s1 or s2 is revealed the other party can determine st which is the pre-image of ht.



Hope this answers your question Hi vlad.gelferYou are correct, you can use EC. Specifically the proposal by Andrew Poelstra is a manner to use Schnorr signatures on EC curves to achieve this. From what I have learnt they approaches achieves something very similar. The main differences are that this proposal would use 2 transactions and Andrew's would use 4 and that there is already a BIP in the works to make Schnorr signatures part of Bitcoin.What I am interested in seeing is what else the Scriptless Script's of Andrew can achieve. As for this proposal, the following example is another type of transaction that it could be applied to (as discussed in previous post):Hope this answers your question

andytoshi



Offline



Activity: 174

Merit: 132



-







Full MemberActivity: 174Merit: 132 Re: Anonymous Atomic Swaps Using Homomorphic Hashing September 02, 2018, 01:39:06 AM #12 Quote from: aliashraf on September 01, 2018, 07:13:59 PM

Quote It is not possible to do a cross-chain atomic swap with only two transactions because you need at least one transaction on each chain, and the first transaction on each chain can be invalidated by publishing a conflicting transaction alongside it.

I doubt it. Using this proposal:



Alice issues tx1 on aliceChain sending m aliceCoins to Bob hash-locked with H(s1) after privately handing Bob (t, H(s1), H(s2))



Bob does the same by issuing tx2 on bobCahin hash-locked with H(s2), AFTER tx1 is confirmed on aliceChain.



Now Alice should wait for tx2 to get confirmed before spending its outpoint and Bob should wait for Alice spending tx2 (and revealing s2) to be able to calculate s1 = t-s2 and spend tx1's outpoint.





I doubt it. Using this proposal:Alice issues tx1 on aliceChain sending m aliceCoins to Bob hash-locked with H(s1) after privately handing Bob (t, H(s1), H(s2))Bob does the same by issuing tx2 on bobCahin hash-locked with H(s2), AFTER tx1 is confirmed on aliceChain.Now Alice should wait for tx2 to get confirmed before spending its outpoint and Bob should wait for Alice spending tx2 (and revealing s2) to be able to calculate s1 = t-s2 and spend tx1's outpoint.

I count four transactions in what you described. I count four transactions in what you described.

empty[g]



Offline



Activity: 7

Merit: 9







NewbieActivity: 7Merit: 9 Re: Anonymous Atomic Swaps Using Homomorphic Hashing September 02, 2018, 08:37:19 AM

Last edit: September 02, 2018, 08:49:42 AM by empty[g] Merited by aliashraf (2) #14 Quote from: johank on August 30, 2018, 03:28:29 PM



I've written a paper entitled: "Anonymous Atomic Swaps Using Homomorphic Hashing". It is available at



HiI've written a paper entitled: "Anonymous Atomic Swaps Using Homomorphic Hashing". It is available at https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3235955

I have read the paper several times and after so much thinking about it i still can't understand your proof of 'no collisions', and i can't see a reason for proofing it, i think if we don't have a high chance of collisions that would be enough.

About the proof its self; as i see it, you can't use rule of signs when you are using modular math.

s 1 n-s 2 n=0 (mod p) means s 1 n-s 2 n=kp where k is a member of Integers numbers, so for a fixed s 1 not only s 2 but k would be a variable.

also the board of the function is limited from 0 to P-1 and as a result, the talk of no collisions is meaningless out of a limited range for s, and you have mentioned s<p in the paper but i see no use for it in the part 4 of 'no collisions'.

maybe i'm just wrong, please tell me if i am. Hi,I have read the paper several times and after so much thinking about it i still can't understand your proof of 'no collisions', and i can't see a reason for proofing it, i think if we don't have a high chance of collisions that would be enough.About the proof its self; as i see it, you can't use rule of signs when you are using modular math.-s=0 (mod p) means s-s=kp where k is a member of Integers numbers, so for a fixed snot only sbut k would be a variable.also the board of the function is limited from 0 to P-1 and as a result, the talk of no collisions is meaningless out of a limited range for s, and you have mentioned s

johank



Offline



Activity: 14

Merit: 140







NewbieActivity: 14Merit: 140 Re: Anonymous Atomic Swaps Using Homomorphic Hashing September 02, 2018, 01:49:35 PM #15 @empty[g]



I understand the point you are trying to make. I had not considered that issue. That is why I prefer sharing work on these forums

as you get people looking at your work which you do not come across in daily life. Your input is much appreciated.



I will consider the point you made and will see if I can find a solution. If you do find a solution I would appreciate if you share it.



Regards



Johan

johank



Offline



Activity: 14

Merit: 140







NewbieActivity: 14Merit: 140 Re: Anonymous Atomic Swaps Using Homomorphic Hashing September 04, 2018, 06:38:39 AM

Last edit: September 04, 2018, 06:49:41 AM by johank #16



Hopefully this expanded proof of no collisions works. Please let me know if I have made any mistakes.



I use the following theorem



Theorem 9.5 Let p be a prime. The non-congruent numbers a 1 ; a 2 ; : : : ; a k are

roots of the polynomial congruence f(x) = 0 (mod p) if and only if there exist

two integral polynomials q(x) and r(x) such that

f(x) = (x - a 1 ).(x - a 2 ) . . . (x - a k ).q(x) + p.r(x)

and deg r(x) < k.



The proof is available at



h 1 = s 1 n mod p

h 2 = s 2 n mod p



For collisions h 1 = h 2 and s 1 != s 2



Therefore determine roots of



(s 1 n - s 2 n) = 0 (mod p)



This is equivalent to



s 1 n - s 2 n = t.p



So for completeness sake we can find the roots of



(s 1 n - s 2 n - t.p) = 0 (mod p)



Applying the above theorem, we can set r(s 1 ) = t



Then we have to find the roots of s 1 n - s 2 n



There are three possibilities:



1) n is odd

2) n is even and has no odd factors

3) n is even and has odd factors



-------------------------



(1)



if n is odd



= (s 1 - s 2 ).(s 1 (n-1) + s 1 (n-2).s 2 + ... + s 1 .s 2 (n-2) + s 2 (n-1))



= (s 1 - s 2 ).q(s 1 )



=> 1 root s 1 = s 2



=> no collisions



-------------------------



(2)



n is even



= (s 1 (n/2) - s 2 (n/2)).(s 1 (n/2) + s 2 (n/2))



n/2 is even



= (s 1 (n/4) - s 2 (n/4)).(s 1 (n/4) + s 2 (n/4)).(s 1 (n/2) + s 2 (n/2))



n/m is 2



= (s 1 2 - s 2 2).q(s1)



= (s 1 - s 2 ).(s 1 + s 2 ).q(s 1 )



=> 2 roots s 1 = s 2 and s 1 = -s 2



=> has collisions



-------------------------



(3)



n is even



= (s 1 (n/2) - s 2 (n/2)).(s 1 (n/2) + s 2 (n/2))



n/2 is even



= (s 1 (n/4) - s 2 (n/4)).(s 1 (n/4) + s 2 (n/4)).(s 1 (n/2) + s 2 (n/2))



n/m is odd



= (s 1 (n/m) - s 2 (n/m)).(s 1 (n/m) + s 2 (n/m)).q'(s1)



= (s 1 - s 2 ).(s 1 (n/m-1) + ... + s 2 (n/m-1)).(s 1 + s 2 ).(s 1 (n/m-1) - s 1 (n/m-2).s 2 + ... - s 1 .s 2 (n/m-2) + s 2 (n/m-1)).q'(s 1 )



=> at least 2 roots s 1 = s 2 and s 1 = -s 2



=> has collisions



-------------------------



Therefore to assure no collisions, n has to be odd and p must be a prime.



As soon as I have a chance I will update the paper with these details. HiHopefully this expanded proof of no collisions works. Please let me know if I have made any mistakes.I use the following theoremTheorem 9.5 Let p be a prime. The non-congruent numbers a; a; : : : ; aareroots of the polynomial congruence f(x) = 0 (mod p) if and only if there existtwo integral polynomials q(x) and r(x) such thatf(x) = (x - a).(x - a) . . . (x - a).q(x) + p.r(x)and deg r(x) < k.The proof is available at www2.math.uu.se/~astrombe/talteori2016/lindahl2002.pdf = smod p= smod pFor collisions h= hand s!= sTherefore determine roots of(s- s) = 0 (mod p)This is equivalent to- s= t.pSo for completeness sake we can find the roots of(s- s- t.p) = 0 (mod p)Applying the above theorem, we can set r(s) = tThen we have to find the roots of s- sThere are three possibilities:1) n is odd2) n is even and has no odd factors3) n is even and has odd factors-------------------------(1)if n is odd= (s- s).(s+ s.s+ ... + s.s+ s= (s- s).q(s=> 1 root s= s=> no collisions-------------------------(2)n is even= (s- s).(s+ sn/2 is even= (s- s).(s+ s).(s+ sn/m is 2= (s- s).q(s1)= (s- s).(s+ s).q(s=> 2 roots s= sand s= -s=> has collisions-------------------------(3)n is even= (s- s).(s+ sn/2 is even= (s- s).(s+ s).(s+ sn/m is odd= (s- s).(s+ s).q'(s1)= (s- s).(s+ ... + s).(s+ s).(s- s.s+ ... - s.s+ s).q'(s=> at least 2 roots s= sand s= -s=> has collisions-------------------------Therefore to assure no collisions, n has to be odd and p must be a prime.As soon as I have a chance I will update the paper with these details.

empty[g]



Offline



Activity: 7

Merit: 9







NewbieActivity: 7Merit: 9 Re: Anonymous Atomic Swaps Using Homomorphic Hashing September 04, 2018, 08:14:30 AM #17 Quote from: johank on September 04, 2018, 06:38:39 AM Hi



Hopefully this expanded proof of no collisions works. Please let me know if I have made any mistakes.



I use the following theorem



as soon as i got the time i have something to share with you, but for now let me say i think there should be more conditions on P.

i would try to update this post and tell you more in next 24 hours. as soon as i got the time i have something to share with you, but for now let me say i think there should be more conditions on P.i would try to update this post and tell you more in next 24 hours.

johank



Offline



Activity: 14

Merit: 140







NewbieActivity: 14Merit: 140 Re: Anonymous Atomic Swaps Using Homomorphic Hashing September 04, 2018, 02:25:02 PM

Last edit: September 04, 2018, 02:48:58 PM by johank #18 Hi



Just thought I might share this. It is a simple attack, that the following proof shows will not work



h = sn mod p



Assume an attacker want to find a power m such that



hm mod p = s



=> s = s(n.m) mod p



=> s(n.m) - s = 0 (mod p)



The attacker would have to solve the above congruence.



Using the theorem from my previous post, this implies that the congruence can be factorized to yield



s.(s(n.m-1) - 1)



This yields roots s = 0, s = 1 and possibly s = -1 for all values of n and m



Therefore for s > 1 there are no values of m that can be used to determine the pre-image s from the hash h.

empty[g]



Offline



Activity: 7

Merit: 9







NewbieActivity: 7Merit: 9 Re: Anonymous Atomic Swaps Using Homomorphic Hashing September 06, 2018, 12:50:07 AM Merited by spartacusrex (5), Ix (2) #19 Quote from: johank on September 04, 2018, 06:38:39 AM Hi



Hopefully this expanded proof of no collisions works. Please let me know if I have made any mistakes.





hi

i think it is still wrong



i can't find out what did you do wrong exactly in math, so i just say why i think the result is wrong.

about the math: i think you did a mistake that you get here : "Then we have to find the roots of s 1 n - s 2 n"



i repeat what i said before once : "the board of the function is limited from 0 to P-1 and as a result, the talk of no collisions is meaningless out of a limited range for s, and you have mentioned s<p in the paper but i see no use for it in the part 4 of 'no collisions' "



in general when a function is modulating it would have collisions unless we set a range on the input (here 's')

any argue with no declaration on range of s for no collisions should be false.



also i have written a simple c program that with brute force checks if there is collisions(i can share it if you ask me nice )



for every prime number less than 10,000 as P

for every number less than the P is being tested as S



for n=3 the largest number as p with no collisions was "1289"

for n=5 the largest number as p with no collisions was "73"



it shows that there are prime numbers that will give you collisions and there are ones that would not.

-------------------------------------------------------

also sorry for not being on time as i promised in previous post hii think it is still wrongi can't find out what did you do wrong exactly in math, so i just say why i think the result is wrong.about the math: i think you did a mistake that you get here : "Then we have to find the roots of s- si repeat what i said before once : "the board of the function is limited from 0 to P-1 and as a result, the talk of no collisions is meaningless out of a limited range for s, and you have mentioned s