With confidential amounts you'd have better anonymity guarantees. With public denominations, each denomination effectively has its own anonymity set, which might especially affect user anonymity when different denominations are combined, and the issuer knows a per-denomination lower bound on a user's funds and upper bound on amounts being transferred between users.
I'm still trying to wrap my head around the cryptography needed for confidential amounts. I think each token has to be bigger by some constant factor, but each user only needs to store a single token. And someone might have a single token worth 4.2 BTC and remain in the same anonymity set as someone with a balance of 69 sat.
UX-wise there should be no difference, but it could be made insanely private, with the issuer not even knowing whether a particular user is sending, receiving or just renewing a token.
shafemtol /
npub1mh…anahj
2023-03-15 16:12:15
in reply to nevent1q…9pgg
Author Public Key
npub1mh94j7j7nwvzl7kwcg70fhxe67kdy50fccakmueq9jjf77zmc25svanahjPublished at
2023-03-15 16:12:15Event JSON
{
"id": "240af300cab813b937ce77380f2717055e36d6fe6c4f00e04b3dbb2a73a3d98f",
"pubkey": "ddcb597a5e9b982ffacec23cf4dcd9d7acd251e9c63b6df3202ca49f785bc2a9",
"created_at": 1678893135,
"kind": 1,
"tags": [
[
"e",
"4c9f7b3a1a5b48747015c95a5aa2f204f2374bea107cf391045a77155bb906d1",
"",
"root"
],
[
"e",
"7ed171e549c9dcfafb5b4d4fc408fc36f948972f9ca5efbe53dbfd4f9cd3e486",
"",
"reply"
],
[
"p",
"ddcb597a5e9b982ffacec23cf4dcd9d7acd251e9c63b6df3202ca49f785bc2a9"
],
[
"p",
"50d94fc2d8580c682b071a542f8b1e31a200b0508bab95a33bef0855df281d63"
]
],
"content": "With confidential amounts you'd have better anonymity guarantees. With public denominations, each denomination effectively has its own anonymity set, which might especially affect user anonymity when different denominations are combined, and the issuer knows a per-denomination lower bound on a user's funds and upper bound on amounts being transferred between users.\n\nI'm still trying to wrap my head around the cryptography needed for confidential amounts. I think each token has to be bigger by some constant factor, but each user only needs to store a single token. And someone might have a single token worth 4.2 BTC and remain in the same anonymity set as someone with a balance of 69 sat.\n\nUX-wise there should be no difference, but it could be made insanely private, with the issuer not even knowing whether a particular user is sending, receiving or just renewing a token.",
"sig": "00ff909800f8bb96a6cdd6582921e65cbb1a83d0974d7803b371076ff65297c30d08c36be5bff3a346b0156c992107ea931958d3c6525e97cfed714365fc8c54"
}