ShuffleProofs.jl VS reverie

> uses a secret only exists on each individual phone

There is actually a way to prevent individuals from being traced while having a strong membership proof. This can be achieved by issuing signatures on a relative generator created in an exponentiation mix together with a set of output pseudonyms. One can picture it as strands braided together where it is hard to trace the link between the input and output strands, while it is very easy to tell that such a link exists.

More on that can be found on:

https://github.com/PeaceFounder/ShuffleProofs.jl

> fn add() { ... }: mispleading name or incorrect implementation `a - b`

Advice like this is frustratingly non-general: you might be doing addition over GF2[1] in which case `fn add(a, b) { a ^ b }` is a perfectly sound. I've worked on a codebase, in Rust, where that's the case[2]!

[1]: https://en.wikipedia.org/wiki/Finite_field_arithmetic#Effect...

[2]: https://github.com/trailofbits/reverie/blob/master/src/algeb...