Fuzzy message detection in Zeth about zeth-specifications

[AntoineRondelet]

FMD is an interesting concept. The possibility to outsource the message detection to the server - while being able to configure a false positive rate looks like a promising avenue for nice trade-offs between recipient anonymity (via key ambiguity and noise about the received message set thanks to detection ambiguity) and the performance of the receive() algorithm run on the recipient's device.

One (very) tricky thing seems to be related to the selection of the parameters for concrete applications.
On that note, the selection of the false positive rate is particularly tricky here. Not only is this parameter public (shared with the potentially adversarial server) - which is an additional "leakage" of information (limited to one server (in the best case), or to the whole network (in the worst case - if the adversary broadcasts all its known information)), but it will also certainly end up being set to different values by users depending on the amount of payments they receive through Zeth. This coupled with the existing gas-related leakages will constitute extra "cracks" in the protocol which consequences are hard to properly estimate. Furthermore letting such parameters to be set by users raises other challenges for wallet developers/UX engineers and documentation engineers. In fact, any degree of liberty let to the user is a potential "deviation" from the "expected" behavior "maximizing indistunguishability". Hence, UX/documentation/wallet engineers will need to jump in to suggest sensible default values, extensively document the purpose of these parameters and extensively educate the end users. Seems like some modelling would be required here (see for e.g. https://git.openprivacy.ca/openprivacy/fuzzytags-sim).
Moreover, the impossibility to (easily - i.e. without distributing new keys) update p over time may be problematic as it won't allow a user to have an elastic false-positive proba that can be adjusted w.r.t. spikes in number of received payments.

That being said, such scheme would also allow new entrants to join in the protocol (users having computationally restricted devices), which would widen the anonymity set.

I'll drop some of these remarks in the specs, and close this ticket. The work on FMD is very nice, but it is too early to consider using such an approach in the protocol.

[AntoineRondelet]

See also the implementation - fuzzytags - by Sarah Jamie Lewis.

[seresistvanandras]

Interesting discussion about the trade-offs of fuzzy message detection parameter selection!

[AntoineRondelet]

Interesting discussion about the trade-offs of fuzzy message detection parameter selection!

Thanks @seresistvanandras :)