Interesting variant. I'd rather require that the 25 most significant bits of the hash of y be 0, because it's then trivial to prove in the random oracle model that there's no way of avoiding the work. My variant allows existing keys to have short IDs while yours requires new keys; your variant means that the proofs of ID are in the keys themselves while mine requires that you publish special extra information in order to attest to an ID.
Either variant is amenable to modification such that the "hashing" process is made memory-hungry in a way that frustrates attackers using parallel hardware.
![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png)
timeasmymeasure
Re: Zooko's triangle
Date: 2007-03-10 11:39 am (UTC)Either variant is amenable to modification such that the "hashing" process is made memory-hungry in a way that frustrates attackers using parallel hardware.