17 ms·

Zcash, an untraceable Bitcoin alternative, launches in alpha

205 points by rdl 11y ago

rdl 11y ago
I'm still a believer in a universe of huge numbers of diverse Chaumian token issuers intermediated by markets, but Zcash is an amazing system. Zooko, btw, used to work for DigiCash long ago. The world of anonymous ecash has been...without a lot of progress, overall. Hopefully Zcash changes this.
al2o3cr 11y ago
This will be massively labor-saving for a key cryptocurrency use-case: exchange operators who "get hacked" won't have to worry about whether they sufficiently hid the outbound funds... ;)
- desireco42 11y ago
  Excellent point! :)
- ewillbefull 11y ago
  One of the most important properties of Zcash is "selective disclosure." Effectively, you can audit and perform proofs-of-solvency with the same security as in other cryptocurrencies. But yes, if someone on the inside "steals" the money, nobody will figure out where it went.
ph33t 11y ago
Various governments were not happy with BitCoins ... I'm sure this will drive them crazy x10 if it catches on.
sarciszewski 11y ago
For anyone who wants to dive headfirst into the code: https://github.com/Electric-Coin-Company/zcash https://github.com/Electric-Coin-Company/zcash
kleer001 11y ago
I love the idea, but... > Zcash is launching as a for-profit company. That's their downfall right there. With someone visible to track they've given up the game before they started. Real people running real companies are really vulnerable. The real test of a security system is its weakest link. And that link is almost always a person. Right? IMHO the subtle political reason Bitcoin has gotten as far as it has is because it's creator has remained anonymous, and not tried to visibly profit from it. Why do I think that? Because governments are very territorial about their money. Banks too. The regulations for banks are pretty tough, as you may know, Know-Your-Customer edicts and such.
- sarciszewski 11y ago
  > That's their downfall right there. With someone visible to track they've given up the game before they started. Real people running real companies are really vulnerable. The real test of a security system is its weakest link. And that link is almost always a person. Right? The company that is launching this consists of a team of brilliant cryptographers and security engineers. How does "their identity is known" translate into an attack? How does "they're a for-profit company" weaken the security guarantees of a zero-knowledge proof?
  - deleted 11y ago
    [deleted]
  - rogerbinns 11y ago
    > How does "their identity is known" translate into an attack? They can be coerced into actions based on threats to themselves or relatives.
    - ewillbefull 11y ago
      Virtually everyone involved in Bitcoin's development is also well-known and presumably "coerceable." The company makes no difference as far as I can see.
      - 11y ago
e40 11y ago
Can someone ELI5 how Zcash works?
- vessenes 11y ago
  Zero Knowledge proofs take the place of a digital signature proving ownership of an address in Bitcoin. Well, that's explain like you're a crypto undergrad. But, it's a start. There's quite a lot of interesting cryptography and engineering involved in making this work; the last zerocash presentation I saw in 2014 mentioned they had been working on shrinking ZK proofs from 25k down to a manageable size for a blockchain.
- fryguy 11y ago
  I haven't read the Zcash paper, but my understanding of its predecessor could be simplified to: * To "create" zcash, you put a random number into a box that can't be opened and a proof that you spent bitcoin to a special kind of bitcoin address. * To "spend" zcash, you reveal the random number that you put in the box (to prevent double spending), and you prove that one of the boxes contains that number (without revealing which box it is). Then you can take the same amount of bitcoin from any of the special addresses above.
- Atheros 11y ago
  I commend fryguy for trying. People with PhD's in computer science have trouble figuring out how Zcash works. It seems to require a very strong mathematics background and it's an order of magnitude more complicated than Bitcoin. I don't think that you're going to get a good ELI5 for it for a while. Zcash is based on Zerocash. In case you ever want to feel like a simpleton: http://zerocash-project.org/media/pdf/zerocash-extended-20140518.pdf http://zerocash-project.org/media/pdf/zerocash-extended-2014...
jhasse 11y ago
For anyone interested in how Zcash (formely Zerocoin) works and who understands German, I've written my Bachelor thesis about it in 2013: http://www.math.uni-bremen.de/~jhasse/Kryptografische%20Grundlagen%20von%20Bitcoin.pdf http://www.math.uni-bremen.de/~jhasse/Kryptografische%20Grun... (Part IV)
- vessenes 11y ago
  Hey! Can you help me understand something about Zcash? Do buckets need to be decrypted for the network on spend? Or is there a way to append a zk-proof that the bucket contains enough to fund follow-on buckets? I'm probably wasting your time a little by asking, but I don't want to rely on my own reading to get a solid understanding.
  - jhasse 11y ago
    What exactly are buckets? I think they used some other terminology back in the Zerocoin days.
    - vessenes 11y ago
      The github explains that you create a transaction as follows: 1) You have 50 coins in a 'bucket' or address? 2) You send 18 to a friend 3) You send 32 t yourself. So you create two encrypted buckets, 18 in one, and 32 in the other. They seem to be the equivalent of UTXOs. I'm not clear if they need to be 'revealed' to be spent though.
      - jhasse 11y ago
        IIRC: No, they aren't "revealed". The 32 newly created coins in your bucket will be made public with a "commitment". I think this was called forging a Zerocoin. When you use them later you're using a zero-knowledge proof, which means others can't link the coins you spend with the forged coins from earlier.
    - ewillbefull 11y ago
      Buckets are basically Coins from the original paper. It was changed because a `Coin` implies things that it actually isn't, but bucket is an even worse name, so it'll probably either be called Coin again or perhaps "pour output" or something.
droffel 11y ago
I'm not really sure how Zcash's privacy features differentiate it from a Cryptonote protocol, like Monero. Disclosure: I own Bitcoin, but do not currently own any Monero. I have no financial incentive to promote it, I'm just legitimately curious as to how Zcash is different.
- jerguismi 11y ago
  Yep, also dash is privacy-oriented.
- ewillbefull 11y ago
  Monero and other ring signature schemes can only feasibly "mix" your transactions with a small number of previous transaction outputs, opening the door to statistical attacks. Zcash mixes your transaction with every previous transaction. In fact, it goes to great lengths to make transactions indistinguishable from each other.
xiphias 11y ago
Zerocash had a possible backdoor, which was its' biggest drawback. I don't see it mentioned on the web page, which seems like they're hiding it (it's cruital to know who we need to trust with the setup part, and whether anybody has the right to take part in it). ,,Security of Π relies on a trusted party running Setup to generate the public parameters (once and for all). This trust is needed for the transaction non-malleability and balance properties but not for ledger indistinguishability'' - from the zerocash paper
- ewillbefull 11y ago
  Zcash is planning to use a new multi-party trusted setup scheme that allows a group to securely compute the mathematical structures necessary to protect the zero-knowledge proof integrity. (Secure Sampling of Public Parameters for Succinct Zero Knowledge Proofs, Ben-Sasson, E. ; Chiesa, A. ; Green, M. ; Tromer, E. et al.) Only if every member of this group were compromised or dishonest will the setup fail. That is, only 1/N participants need to be honest.
  - mangeletti 11y ago
    Would this new "multi-party trusted setup" happen to be based on a block chain of its own? If so, then they've introduced a new sort of meta 51% attack potential in a system that gives no economic incentive to mine (i.e., 51% attack is much easier when its not "51% of everyone trying to earn coins", but instead is "51% of those donating computing to protect zero-knowledge proof"), right? If not so, then how? (rewind to Jan 2, 2009...)
    - jhasse 11y ago
      I haven't read the paper, so correct me if I'm wrong: I think the "multi-party trusted setup" isn't about a blockchain or something complex. It's just an algorithm to set up some initial values.
    - swordswinger12 11y ago
      Most zk-SNARK constructions are in the "common reference string" model, which requires a one-time trusted setup of a random string accessible to all parties: https://en.wikipedia.org/wiki/Common_reference_string_model https://en.wikipedia.org/wiki/Common_reference_string_model
ctoth 11y ago
Of course, once these techniques were in place, they conclusively destroyed the ability of governments to control the flow of electronic funds, anywhere, anytime, for any purpose. As it happened, this process had pretty much destroyed any human control at all over the modern electronic economy. By the time people figured out that raging nonlinear anarchy was not exactly to the advantage of anyone concerned, the process was simply too far gone to stop. All workable standards of wealth had vaporized, digitized, and vanished into a nonstop hurricane of electronic thin air. Even physically tearing up the fiber optics couldn't stop it; governments that tried to just found that the whole encryption mess oozed swiftly into voice mail and even fax machines. ... Alex did not find it surprising that people like the Chinese Triads and the Corsican Black Hand were electronically minting their own cash. He simply accepted it: electronic, private cash, unbacked by any government, untraceable, completely anonymous, global in reach, lightninglike in speed, ubiquitous, fungible, and usually highly volatile. Of course, such funds didn't boldly say "Sicilian Mafia" right on the transaction screen; they usually had some stuffy official-sounding alias such as "Banco Ambrosiano ATM Euro-DigiLira," but the private currency speculators would usually have a pretty good guess as to the solvency of the issuers. - Heavy Weather
- imglorp 11y ago
  Paper cash is mostly untraceable, so we're not really changing that much. BTC is much more traceable.
  - ctoth 11y ago
    Which is why I made this comment on a thread about a new digital currency that according to the title is untraceable, and not a thread about BTC.
  - SuddsMcDuff 11y ago
    Don't rely on paper cash being around for that much longer either - http://www.zerohedge.com/news/2016-01-23/norways-biggest-bank-demands-cash-ban http://www.zerohedge.com/news/2016-01-23/norways-biggest-ban...
kchoudhu 11y ago
Oh good, Roger Ver is involved as an investor. Steer clear, fellas. Steer clear.
- duskwuff 11y ago
  Mind explaining who this is, and why this is an issue? (I genuinely have no idea, and I figure you can probably explain better than a Google search could.)
  - kchoudhu 11y ago
    His wikipedia page is a good place to start: https://en.wikipedia.org/wiki/Roger_Ver https://en.wikipedia.org/wiki/Roger_Ver * He sold explosives on ebay back in the day, and went to prison for it. * He renounced his US citizenship to avoid paying taxes... * ...but was for some reason VERY annoyed when the US government wouldn't let him back in. * Of course he funded Ross Ulbricht's defense in the Silkroad trial. Mostly though, he is the subject of waaaay too many posts on /r/buttcoin. Who you take money from shows what kind of organization you want to build. ZCash is currently failing this test for me.
  - ufo 11y ago
    His mtgox video is emblematic[1]. Mtgox was at the time the largest bitcoin exchange in the world but it was insolvent due to stealing/misplacing customer funds. Roger made a video saying everything was fine and then mtgox went under a couple of months later. He then tried to spin that he was just talking about "liquidity" and not "solvency" but thats a really shitty excuse. [1] https://www.youtube.com/watch?v=UP1YsMlrfF0 https://www.youtube.com/watch?v=UP1YsMlrfF0.
DCKing 11y ago
There's an interesting property of fully untraceable currency, and that's that it's possible to perform 'perfect crimes' [1]. Often the weakness in committing, say, a kidnapping or a drug sale is handling the associated money obtained with it which can be traced back to people due to circumstances. Fully untraceable currency by definition completely avoids these circumstances. The inevitable question "should we want this?" is moot because evidently such systems are possible (iff they provide a practical currency for such transactions) and will inevitably be used for this. Furthermore, Bitcoin already achieves something close to it in practice. It's just worth pointing out that untraceability will have nasty consequences as well as good ones. As an interesting aside, David Chaum, who has lately been infamous for advocating ways to backdoor encryption, may be considered the father of fully untraceable (but not decentralized) digital currencies. Ironically, after [1] was published others in the cryptographic community spend a number of papers on building what they called 'fair' blind signatures, which constituted basically of varieties of Chaum's basic idea but where untraceability could be lifted by an "independent party posessing the right private key" (i.e. a public "police backdoor"). They were trying to backdoor Chaum's encryption... [1]: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.465.9796&rep=rep1&type=pdf http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.465...
- otoburb 11y ago
  >>[...] others in the cryptographic community [built] what they called 'fair' blind signatures [...] where untraceability could be lifted by an "independent party posessing the right private key" (i.e. a public "police backdoor"). They were trying to backdoor Chaum's encryption... Chaum himself is advocating not just for any ol' backdoor, but for a flavour of "multi-sovereign-party public police backdoor" if you believe the Wired article that explained his proposal.[1] [1] http://www.wired.com/2016/01/david-chaum-father-of-online-anonymity-plan-to-end-the-crypto-wars/ http://www.wired.com/2016/01/david-chaum-father-of-online-an...
- dmix 11y ago
  Currency is merely one investigative method. There are plenty of others and like all crypto systems there will be cracks, people will make OPSEC mistakes, and ultimately law enforcement agencies have access to hacking/CNE. Additionally, the money by itself may be anonymous, but that person will have to convert it to other currency or make purchases. Those purchases may be physical objects like cars, or rent, or any other large purchase which the person will have to demonstrate how they could afford to purchase it. The IRS would still be able to detect irregularities in consumption. If anything it will be a boone for the information security industry, they will have to stop selling snakeoil and start selling solutions that actually prevent peoples money from being stolen.
DickingAround 11y ago
There's a customer-base problem here. Bitcoin's expansion is based on who is willing to consider something different. A new alt-coin promising to do the kinds of things Bitcoin does but better (not crack new customers) can only exist by taking Bitcoin's market-share (which is not big). Being honest with ourselves, this is likely to get lost in the noise until bitcoin is large enough and this weakness of it is exploited enough that a substantial amount of people look for an alternative.
- dmix 11y ago
  The iPhone still exists despite Android coming out. I see no need for a single currency at a time. There may be ultimately a winner, but there is no stopping each from finding their own niche. What if Bitcoin becomes the currency of Wall St - which is better served by pseudonymous currency - while ZCash fills the more privacy oriented niche for projects like Open Bazaar?
bduerst 11y ago
>Zcash isn’t intended to facilitate crime, but also notes that the company isn’t liable for any criminal applications for which Zcash is used. “The people who built the first cars weren’t held responsible for car accidents or bank robberies,” Good luck with that, especially as a registered for-profit organization. Car manufacturers are required to report VIN numbers and allow for license plates, on top of a number of other mandatory regulations. Road access is also a priviledge, and automobiles not meeting certain standards are not allowed.
- dmix 11y ago
  Car manufacturers can report VIN numbers without destroying their business. If zcash is compelled to then they're business will no longer exist, as the primary incentive to using it (privacy) is no longer there. The question is whether a judge is willing to destroy a company in order to pursue law enforcement goals. Regardless, this doesn't mean zcash will die necessarily. As it will be open-source and has the ability to continue functioning without a centralized organization.
  - gamblor956 11y ago
    Zcash can't get around financial institution regulations simply by disclaiming liability. If that worked, banks and other institutions would have done so by now. But yes, a judge would be perfectly willing to destroy a company in violation of the law. See, e.g., Aereo and its ilk.
    - dmix 11y ago
      Indeed, but as consumers this doesn't affect us if an OSS version comes out as a result? Nor would it be an effective law enforcement tactic.
      - bduerst 11y ago
        It would definitely affect user adoption with the majority of merchants.
imaginenore 11y ago
Bitcoin is already very untraceable. Yes, there's a public ledger of all transactions, but it has no identifying information. There are some public addresses whose owners are known, because they volunteered that information. Exchanges also know the owners of certain addresses. But that's about it. Bitcoin's address space is huge, something like 10^48. I can make a thousand of them in a few seconds, along with the private keys. I can send the money to any of them, and you will never know who owns it. I can send my money between these 1000 addresses as much as I want, and all you will see in the leger is money going from A to B to C, just like the rest of it. Bitcoin network doesn't know any difference between me buying something on Overstock, or me sending the money to my brother across the globe, or to myself.
- ewillbefull 11y ago
  This video should give you a better idea of how anonymous Bitcoin is. https://www.youtube.com/watch?v=AypRF9q0llU https://www.youtube.com/watch?v=AypRF9q0llU There are also several startups dedicated to performing Bitcoin blockchain analysis for this specific purpose.
  - imaginenore 11y ago
    Do you realize that this video doesn't contradict what I said? The hacker got caught, and (some of) the money got returned, and that's what they are showing in that video. If the guy didn't get caught, they would have never found anything, unless the thief is dumb enough to send these coins to his exchange. If it were me, I would randomly mix 40,000 coins between random addresses, random amounts, random times for like a year. Never using the same address again. I would mix them with other coins. You might end up with 10,000 addresses holding random amounts of coins, but that's not a big deal at all. You need some cash? LocalBitcoins in a neighboring town. Or create an online business and buy your own product from yourself. Or build a website, put ads on it, and buy quality traffic with bitcoin (arbitrage).
- cyphar 11y ago
  > Bitcoin is already very untraceable. Yes, there's a public ledger of all transactions, but it has no identifying information. There are some public addresses whose owners are known, because they volunteered that information. Exchanges also know the owners of certain addresses. But that's about it. That isn't true. Bitcoin transactions can be traced like almost all other transaction types (even more so because it's a public leger), the only difference is that the end points are pseudonymous (sure, they might not have your names, but they do have unique identifiers, like account numbers). It's a mistake to consider the above as being "untraceable" or anonymous. > Bitcoin's address space is huge, something like 10^48. I can make a thousand of them in a few seconds, along with the private keys. I can send the money to any of them, and you will never know who owns it. I can send my money between these 1000 addresses as much as I want, and all you will see in the leger is money going from A to B to C, just like the rest of it. This principle is all about mixing to "clean" bitcoins, but it doesn't provide strong anonymity properties (if all of the addresses you use for mixing are only used for mixing your bitcoins, you haven't improved your anonymity). > Bitcoin network doesn't know any difference between me buying something on Overstock, or me sending the money to my brother across the globe, or to myself. Other than the globally unique addresses, which can be used to tie together groups of transactions or owners of accounts.
eloy 11y ago
But does it has the same scalability issues as Bitcoin? If yes, I don't give crytocurrencies a single chance to replace the current currencies.
mootothemax 11y ago
Does anyone know how anonymous transactions remain if e.g. law enforcement take your (unprotected) laptop from you? I've got to say, I don't have much confidence in the company itself, specifically: >Wilcox maintains his stealthy digital cash startup isn’t intended to facilitate crime, but also notes that the company isn’t liable for any criminal applications for which Zcash is used. It's almost like they've never heard of https://en.wikipedia.org/wiki/E-gold https://en.wikipedia.org/wiki/E-gold or its many, many variations.
- cyphar 11y ago
  > Does anyone know how anonymous transactions remain if e.g. law enforcement take your (unprotected) laptop from you? This is why you should do full disk encryption, and travel without your hard drive. At the end of the day, there's probably forensic methods on your laptop that would be far more damaging than just deanonymising your past transactions.
  - mootothemax 11y ago
    >This is why you should do full disk encryption, and travel without your hard drive. At the end of the day, there's probably forensic methods on your laptop that would be far more damaging than just deanonymising your past transactions. While that's all very good and all, it doesn't really answer my question :)
    - cyphar 11y ago
      > >This is why you should do full disk encryption, and travel without your hard drive. At the end of the day, there's probably forensic methods on your laptop that would be far more damaging than just deanonymising your past transactions. > While that's all very good and all, it doesn't really answer my question :) I probably should've proceeded that with "I don't know, but".
client4 11y ago
Rather than recreate, they should see what Dashcoin is doing. IMHO Dash is the most progressive altcoin working to fix major issues found with Bitcoin.
placeybordeaux 11y ago
Correct me if I am wrong, but to generate a Zcash coin you need to send a bitcoin to a escrow account, and to redeem it they will send a bitcoin from the escrow account to where ever you want? I would be much more comfortable with generation being tied to destroying bitcoins or simply running yet another blockchain and letting the market deal with exchanges from BTC to Z. Looks like they made some very cool progress though.
rtpg 11y ago
It's kind of frustrating as a person wanting a decentralised payments system having to work with people who want the most anonymous payments system possible. Enabling anonymous financial actions _is the very definition_ of money laundering. Though the protocol could be freely distributed, any form of business built on it will have a lot of trouble existing in any useful form. Starting from that point is going to make your life so much harder. And of course, the irony in trying to use Bitcoin as a basis for anonymous transactions is solved with Zerocoin. But I don't know how a law-abiding business can have reasonable knowledge of the parties in the transactions (a requirement to not be money laundering) without meeting the wishes of the fanbase.
- gavazzy 11y ago
  Actually, anonymous financial transactions are quite common. Every time you purchase something with cash, the seller receives payment with no knowledge of who you are or how you got the money. And the definition of money laundering is hiding the source of illegally obtained money. An anonymous transaction isn't laundering if there's nothing dirty about the money in the first place.
  - XorNot 11y ago
    Paying in cash involves turning up in person with cash. That's definitely not anonymous.
fernly 11y ago
This issue is mentioned in a small sub-comment and has drawn no replies but it seems to me like the Heffalump In the Room: "For its first four years online, a portion of every mined Zcash coin will go directly to Wilcox’s Zcash company and a smaller portion to a non-profit he’s creating to oversee the Zcash code and community longterm. Wilcox says that he plans for 1 percent of Zcash’s currency to ultimately go towards that non-profit, and 10 percent to be paid to the for-profit startup." Who is going to want to engage in commerce in a system that creams off a 10 percent vigorish on every transaction? Credit card companies are hated by small merchants for taking a third that much.
- x5n1 11y ago
  Credit card companies take at least that much from the transaction. They charge both the supplier and the holder.
  - runholm 11y ago
    Credit cards are more expensive than most would like them to be. We don't need another expensive system. Besides, credit cards offer protection in that they are able to give insurance on purchases by doing charge backs.
- jpatokal 11y ago
  10% of every mined coin, not transaction. Big difference.
kedean 11y ago
I applaud the cryptography work here, it seems like a damn cool application of ZKPs, but I think their missing what made Bitcoin work. The tech people took to BTC because it was something that they could verify worked correctly, and had no centralized party who could change it on a whim. Once it had the backing of those tech people, then it spread to everyone else. These guys might be able to get a small portion of customers who don't care about a centralized party, but that just isn't going to be enough, those aren't the people who are going to evangelize it.
davidgerard 11y ago
This literally has no use case other than illicit transactions - the one and only substantial Bitcoin use case in practice. They're even asked about this directly and can't come up with any! So the question is: can Zcash compete with Bitcoin in the darknet markets? Is there any DNM that does any substantial business in a crypto other than Bitcoin?
- ccarter84 11y ago
  > This literally has no use case other than illicit transactions My thoughts exactly. But they must have made a good case that there were other uses to their investors, they netted some pretty high-profile names. I would imagine Dash is getting traction on darknets, but I haven't seen anything on that one lately
quantumpotato_ 11y ago
Can someone explain how these "Zero Knowledge Proofs" are "untraceable"?

205 points by rdl 11y ago

rdl 11y ago

I'm still a believer in a universe of huge numbers of diverse Chaumian token issuers intermediated by markets, but Zcash is an amazing system. Zooko, btw, used to work for DigiCash long ago. The world of anonymous ecash has been...without a lot of progress, overall. Hopefully Zcash changes this.

al2o3cr 11y ago

This will be massively labor-saving for a key cryptocurrency use-case: exchange operators who "get hacked" won't have to worry about whether they sufficiently hid the outbound funds... ;)

desireco42 11y ago
Excellent point! :)
ewillbefull 11y ago
One of the most important properties of Zcash is "selective disclosure." Effectively, you can audit and perform proofs-of-solvency with the same security as in other cryptocurrencies. But yes, if someone on the inside "steals" the money, nobody will figure out where it went.

ph33t 11y ago

Various governments were not happy with BitCoins ... I'm sure this will drive them crazy x10 if it catches on.

sarciszewski 11y ago

For anyone who wants to dive headfirst into the code: https://github.com/Electric-Coin-Company/zcash https://github.com/Electric-Coin-Company/zcash

kleer001 11y ago

I love the idea, but... > Zcash is launching as a for-profit company. That's their downfall right there. With someone visible to track they've given up the game before they started. Real people running real companies are really vulnerable. The real test of a security system is its weakest link. And that link is almost always a person. Right? IMHO the subtle political reason Bitcoin has gotten as far as it has is because it's creator has remained anonymous, and not tried to visibly profit from it. Why do I think that? Because governments are very territorial about their money. Banks too. The regulations for banks are pretty tough, as you may know, Know-Your-Customer edicts and such.

sarciszewski 11y ago
> That's their downfall right there. With someone visible to track they've given up the game before they started. Real people running real companies are really vulnerable. The real test of a security system is its weakest link. And that link is almost always a person. Right? The company that is launching this consists of a team of brilliant cryptographers and security engineers. How does "their identity is known" translate into an attack? How does "they're a for-profit company" weaken the security guarantees of a zero-knowledge proof?
- deleted 11y ago
  [deleted]
- rogerbinns 11y ago
  > How does "their identity is known" translate into an attack? They can be coerced into actions based on threats to themselves or relatives.
  - ewillbefull 11y ago
    Virtually everyone involved in Bitcoin's development is also well-known and presumably "coerceable." The company makes no difference as far as I can see.
    - 11y ago

e40 11y ago

Can someone ELI5 how Zcash works?

vessenes 11y ago
Zero Knowledge proofs take the place of a digital signature proving ownership of an address in Bitcoin. Well, that's explain like you're a crypto undergrad. But, it's a start. There's quite a lot of interesting cryptography and engineering involved in making this work; the last zerocash presentation I saw in 2014 mentioned they had been working on shrinking ZK proofs from 25k down to a manageable size for a blockchain.
fryguy 11y ago
I haven't read the Zcash paper, but my understanding of its predecessor could be simplified to: * To "create" zcash, you put a random number into a box that can't be opened and a proof that you spent bitcoin to a special kind of bitcoin address. * To "spend" zcash, you reveal the random number that you put in the box (to prevent double spending), and you prove that one of the boxes contains that number (without revealing which box it is). Then you can take the same amount of bitcoin from any of the special addresses above.
Atheros 11y ago
I commend fryguy for trying. People with PhD's in computer science have trouble figuring out how Zcash works. It seems to require a very strong mathematics background and it's an order of magnitude more complicated than Bitcoin. I don't think that you're going to get a good ELI5 for it for a while. Zcash is based on Zerocash. In case you ever want to feel like a simpleton: http://zerocash-project.org/media/pdf/zerocash-extended-20140518.pdf http://zerocash-project.org/media/pdf/zerocash-extended-2014...

jhasse 11y ago

For anyone interested in how Zcash (formely Zerocoin) works and who understands German, I've written my Bachelor thesis about it in 2013: http://www.math.uni-bremen.de/~jhasse/Kryptografische%20Grundlagen%20von%20Bitcoin.pdf http://www.math.uni-bremen.de/~jhasse/Kryptografische%20Grun... (Part IV)

vessenes 11y ago
Hey! Can you help me understand something about Zcash? Do buckets need to be decrypted for the network on spend? Or is there a way to append a zk-proof that the bucket contains enough to fund follow-on buckets? I'm probably wasting your time a little by asking, but I don't want to rely on my own reading to get a solid understanding.
- jhasse 11y ago
  What exactly are buckets? I think they used some other terminology back in the Zerocoin days.
  - vessenes 11y ago
    The github explains that you create a transaction as follows: 1) You have 50 coins in a 'bucket' or address? 2) You send 18 to a friend 3) You send 32 t yourself. So you create two encrypted buckets, 18 in one, and 32 in the other. They seem to be the equivalent of UTXOs. I'm not clear if they need to be 'revealed' to be spent though.
    - jhasse 11y ago
      IIRC: No, they aren't "revealed". The 32 newly created coins in your bucket will be made public with a "commitment". I think this was called forging a Zerocoin. When you use them later you're using a zero-knowledge proof, which means others can't link the coins you spend with the forged coins from earlier.
  - ewillbefull 11y ago
    Buckets are basically Coins from the original paper. It was changed because a `Coin` implies things that it actually isn't, but bucket is an even worse name, so it'll probably either be called Coin again or perhaps "pour output" or something.

droffel 11y ago

I'm not really sure how Zcash's privacy features differentiate it from a Cryptonote protocol, like Monero. Disclosure: I own Bitcoin, but do not currently own any Monero. I have no financial incentive to promote it, I'm just legitimately curious as to how Zcash is different.

jerguismi 11y ago
Yep, also dash is privacy-oriented.
ewillbefull 11y ago
Monero and other ring signature schemes can only feasibly "mix" your transactions with a small number of previous transaction outputs, opening the door to statistical attacks. Zcash mixes your transaction with every previous transaction. In fact, it goes to great lengths to make transactions indistinguishable from each other.

xiphias 11y ago

Zerocash had a possible backdoor, which was its' biggest drawback. I don't see it mentioned on the web page, which seems like they're hiding it (it's cruital to know who we need to trust with the setup part, and whether anybody has the right to take part in it). ,,Security of Π relies on a trusted party running Setup to generate the public parameters (once and for all). This trust is needed for the transaction non-malleability and balance properties but not for ledger indistinguishability'' - from the zerocash paper

ewillbefull 11y ago
Zcash is planning to use a new multi-party trusted setup scheme that allows a group to securely compute the mathematical structures necessary to protect the zero-knowledge proof integrity. (Secure Sampling of Public Parameters for Succinct Zero Knowledge Proofs, Ben-Sasson, E. ; Chiesa, A. ; Green, M. ; Tromer, E. et al.) Only if every member of this group were compromised or dishonest will the setup fail. That is, only 1/N participants need to be honest.
- mangeletti 11y ago
  Would this new "multi-party trusted setup" happen to be based on a block chain of its own? If so, then they've introduced a new sort of meta 51% attack potential in a system that gives no economic incentive to mine (i.e., 51% attack is much easier when its not "51% of everyone trying to earn coins", but instead is "51% of those donating computing to protect zero-knowledge proof"), right? If not so, then how? (rewind to Jan 2, 2009...)
  - jhasse 11y ago
    I haven't read the paper, so correct me if I'm wrong: I think the "multi-party trusted setup" isn't about a blockchain or something complex. It's just an algorithm to set up some initial values.
  - swordswinger12 11y ago
    Most zk-SNARK constructions are in the "common reference string" model, which requires a one-time trusted setup of a random string accessible to all parties: https://en.wikipedia.org/wiki/Common_reference_string_model https://en.wikipedia.org/wiki/Common_reference_string_model

ctoth 11y ago

Of course, once these techniques were in place, they conclusively destroyed the ability of governments to control the flow of electronic funds, anywhere, anytime, for any purpose. As it happened, this process had pretty much destroyed any human control at all over the modern electronic economy. By the time people figured out that raging nonlinear anarchy was not exactly to the advantage of anyone concerned, the process was simply too far gone to stop. All workable standards of wealth had vaporized, digitized, and vanished into a nonstop hurricane of electronic thin air. Even physically tearing up the fiber optics couldn't stop it; governments that tried to just found that the whole encryption mess oozed swiftly into voice mail and even fax machines. ... Alex did not find it surprising that people like the Chinese Triads and the Corsican Black Hand were electronically minting their own cash. He simply accepted it: electronic, private cash, unbacked by any government, untraceable, completely anonymous, global in reach, lightninglike in speed, ubiquitous, fungible, and usually highly volatile. Of course, such funds didn't boldly say "Sicilian Mafia" right on the transaction screen; they usually had some stuffy official-sounding alias such as "Banco Ambrosiano ATM Euro-DigiLira," but the private currency speculators would usually have a pretty good guess as to the solvency of the issuers. - Heavy Weather

imglorp 11y ago
Paper cash is mostly untraceable, so we're not really changing that much. BTC is much more traceable.
- ctoth 11y ago
  Which is why I made this comment on a thread about a new digital currency that according to the title is untraceable, and not a thread about BTC.
- SuddsMcDuff 11y ago
  Don't rely on paper cash being around for that much longer either - http://www.zerohedge.com/news/2016-01-23/norways-biggest-bank-demands-cash-ban http://www.zerohedge.com/news/2016-01-23/norways-biggest-ban...

kchoudhu 11y ago

Oh good, Roger Ver is involved as an investor. Steer clear, fellas. Steer clear.

duskwuff 11y ago
Mind explaining who this is, and why this is an issue? (I genuinely have no idea, and I figure you can probably explain better than a Google search could.)
- kchoudhu 11y ago
  His wikipedia page is a good place to start: https://en.wikipedia.org/wiki/Roger_Ver https://en.wikipedia.org/wiki/Roger_Ver * He sold explosives on ebay back in the day, and went to prison for it. * He renounced his US citizenship to avoid paying taxes... * ...but was for some reason VERY annoyed when the US government wouldn't let him back in. * Of course he funded Ross Ulbricht's defense in the Silkroad trial. Mostly though, he is the subject of waaaay too many posts on /r/buttcoin. Who you take money from shows what kind of organization you want to build. ZCash is currently failing this test for me.
- ufo 11y ago
  His mtgox video is emblematic[1]. Mtgox was at the time the largest bitcoin exchange in the world but it was insolvent due to stealing/misplacing customer funds. Roger made a video saying everything was fine and then mtgox went under a couple of months later. He then tried to spin that he was just talking about "liquidity" and not "solvency" but thats a really shitty excuse. [1] https://www.youtube.com/watch?v=UP1YsMlrfF0 https://www.youtube.com/watch?v=UP1YsMlrfF0.

DCKing 11y ago

There's an interesting property of fully untraceable currency, and that's that it's possible to perform 'perfect crimes' [1]. Often the weakness in committing, say, a kidnapping or a drug sale is handling the associated money obtained with it which can be traced back to people due to circumstances. Fully untraceable currency by definition completely avoids these circumstances. The inevitable question "should we want this?" is moot because evidently such systems are possible (iff they provide a practical currency for such transactions) and will inevitably be used for this. Furthermore, Bitcoin already achieves something close to it in practice. It's just worth pointing out that untraceability will have nasty consequences as well as good ones. As an interesting aside, David Chaum, who has lately been infamous for advocating ways to backdoor encryption, may be considered the father of fully untraceable (but not decentralized) digital currencies. Ironically, after [1] was published others in the cryptographic community spend a number of papers on building what they called 'fair' blind signatures, which constituted basically of varieties of Chaum's basic idea but where untraceability could be lifted by an "independent party posessing the right private key" (i.e. a public "police backdoor"). They were trying to backdoor Chaum's encryption... [1]: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.465.9796&rep=rep1&type=pdf http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.465...

otoburb 11y ago
>>[...] others in the cryptographic community [built] what they called 'fair' blind signatures [...] where untraceability could be lifted by an "independent party posessing the right private key" (i.e. a public "police backdoor"). They were trying to backdoor Chaum's encryption... Chaum himself is advocating not just for any ol' backdoor, but for a flavour of "multi-sovereign-party public police backdoor" if you believe the Wired article that explained his proposal.[1] [1] http://www.wired.com/2016/01/david-chaum-father-of-online-anonymity-plan-to-end-the-crypto-wars/ http://www.wired.com/2016/01/david-chaum-father-of-online-an...
dmix 11y ago
Currency is merely one investigative method. There are plenty of others and like all crypto systems there will be cracks, people will make OPSEC mistakes, and ultimately law enforcement agencies have access to hacking/CNE. Additionally, the money by itself may be anonymous, but that person will have to convert it to other currency or make purchases. Those purchases may be physical objects like cars, or rent, or any other large purchase which the person will have to demonstrate how they could afford to purchase it. The IRS would still be able to detect irregularities in consumption. If anything it will be a boone for the information security industry, they will have to stop selling snakeoil and start selling solutions that actually prevent peoples money from being stolen.

DickingAround 11y ago

There's a customer-base problem here. Bitcoin's expansion is based on who is willing to consider something different. A new alt-coin promising to do the kinds of things Bitcoin does but better (not crack new customers) can only exist by taking Bitcoin's market-share (which is not big). Being honest with ourselves, this is likely to get lost in the noise until bitcoin is large enough and this weakness of it is exploited enough that a substantial amount of people look for an alternative.

dmix 11y ago
The iPhone still exists despite Android coming out. I see no need for a single currency at a time. There may be ultimately a winner, but there is no stopping each from finding their own niche. What if Bitcoin becomes the currency of Wall St - which is better served by pseudonymous currency - while ZCash fills the more privacy oriented niche for projects like Open Bazaar?

bduerst 11y ago

>Zcash isn’t intended to facilitate crime, but also notes that the company isn’t liable for any criminal applications for which Zcash is used. “The people who built the first cars weren’t held responsible for car accidents or bank robberies,” Good luck with that, especially as a registered for-profit organization. Car manufacturers are required to report VIN numbers and allow for license plates, on top of a number of other mandatory regulations. Road access is also a priviledge, and automobiles not meeting certain standards are not allowed.

dmix 11y ago
Car manufacturers can report VIN numbers without destroying their business. If zcash is compelled to then they're business will no longer exist, as the primary incentive to using it (privacy) is no longer there. The question is whether a judge is willing to destroy a company in order to pursue law enforcement goals. Regardless, this doesn't mean zcash will die necessarily. As it will be open-source and has the ability to continue functioning without a centralized organization.
- gamblor956 11y ago
  Zcash can't get around financial institution regulations simply by disclaiming liability. If that worked, banks and other institutions would have done so by now. But yes, a judge would be perfectly willing to destroy a company in violation of the law. See, e.g., Aereo and its ilk.
  - dmix 11y ago
    Indeed, but as consumers this doesn't affect us if an OSS version comes out as a result? Nor would it be an effective law enforcement tactic.
    - bduerst 11y ago
      It would definitely affect user adoption with the majority of merchants.

imaginenore 11y ago

Bitcoin is already very untraceable. Yes, there's a public ledger of all transactions, but it has no identifying information. There are some public addresses whose owners are known, because they volunteered that information. Exchanges also know the owners of certain addresses. But that's about it. Bitcoin's address space is huge, something like 10^48. I can make a thousand of them in a few seconds, along with the private keys. I can send the money to any of them, and you will never know who owns it. I can send my money between these 1000 addresses as much as I want, and all you will see in the leger is money going from A to B to C, just like the rest of it. Bitcoin network doesn't know any difference between me buying something on Overstock, or me sending the money to my brother across the globe, or to myself.

ewillbefull 11y ago
This video should give you a better idea of how anonymous Bitcoin is. https://www.youtube.com/watch?v=AypRF9q0llU https://www.youtube.com/watch?v=AypRF9q0llU There are also several startups dedicated to performing Bitcoin blockchain analysis for this specific purpose.
- imaginenore 11y ago
  Do you realize that this video doesn't contradict what I said? The hacker got caught, and (some of) the money got returned, and that's what they are showing in that video. If the guy didn't get caught, they would have never found anything, unless the thief is dumb enough to send these coins to his exchange. If it were me, I would randomly mix 40,000 coins between random addresses, random amounts, random times for like a year. Never using the same address again. I would mix them with other coins. You might end up with 10,000 addresses holding random amounts of coins, but that's not a big deal at all. You need some cash? LocalBitcoins in a neighboring town. Or create an online business and buy your own product from yourself. Or build a website, put ads on it, and buy quality traffic with bitcoin (arbitrage).
cyphar 11y ago
> Bitcoin is already very untraceable. Yes, there's a public ledger of all transactions, but it has no identifying information. There are some public addresses whose owners are known, because they volunteered that information. Exchanges also know the owners of certain addresses. But that's about it. That isn't true. Bitcoin transactions can be traced like almost all other transaction types (even more so because it's a public leger), the only difference is that the end points are pseudonymous (sure, they might not have your names, but they do have unique identifiers, like account numbers). It's a mistake to consider the above as being "untraceable" or anonymous. > Bitcoin's address space is huge, something like 10^48. I can make a thousand of them in a few seconds, along with the private keys. I can send the money to any of them, and you will never know who owns it. I can send my money between these 1000 addresses as much as I want, and all you will see in the leger is money going from A to B to C, just like the rest of it. This principle is all about mixing to "clean" bitcoins, but it doesn't provide strong anonymity properties (if all of the addresses you use for mixing are only used for mixing your bitcoins, you haven't improved your anonymity). > Bitcoin network doesn't know any difference between me buying something on Overstock, or me sending the money to my brother across the globe, or to myself. Other than the globally unique addresses, which can be used to tie together groups of transactions or owners of accounts.

eloy 11y ago

But does it has the same scalability issues as Bitcoin? If yes, I don't give crytocurrencies a single chance to replace the current currencies.

mootothemax 11y ago

Does anyone know how anonymous transactions remain if e.g. law enforcement take your (unprotected) laptop from you? I've got to say, I don't have much confidence in the company itself, specifically: >Wilcox maintains his stealthy digital cash startup isn’t intended to facilitate crime, but also notes that the company isn’t liable for any criminal applications for which Zcash is used. It's almost like they've never heard of https://en.wikipedia.org/wiki/E-gold https://en.wikipedia.org/wiki/E-gold or its many, many variations.

cyphar 11y ago
> Does anyone know how anonymous transactions remain if e.g. law enforcement take your (unprotected) laptop from you? This is why you should do full disk encryption, and travel without your hard drive. At the end of the day, there's probably forensic methods on your laptop that would be far more damaging than just deanonymising your past transactions.
- mootothemax 11y ago
  >This is why you should do full disk encryption, and travel without your hard drive. At the end of the day, there's probably forensic methods on your laptop that would be far more damaging than just deanonymising your past transactions. While that's all very good and all, it doesn't really answer my question :)
  - cyphar 11y ago
    > >This is why you should do full disk encryption, and travel without your hard drive. At the end of the day, there's probably forensic methods on your laptop that would be far more damaging than just deanonymising your past transactions. > While that's all very good and all, it doesn't really answer my question :) I probably should've proceeded that with "I don't know, but".

client4 11y ago

Rather than recreate, they should see what Dashcoin is doing. IMHO Dash is the most progressive altcoin working to fix major issues found with Bitcoin.

placeybordeaux 11y ago

Correct me if I am wrong, but to generate a Zcash coin you need to send a bitcoin to a escrow account, and to redeem it they will send a bitcoin from the escrow account to where ever you want? I would be much more comfortable with generation being tied to destroying bitcoins or simply running yet another blockchain and letting the market deal with exchanges from BTC to Z. Looks like they made some very cool progress though.

rtpg 11y ago

It's kind of frustrating as a person wanting a decentralised payments system having to work with people who want the most anonymous payments system possible. Enabling anonymous financial actions _is the very definition_ of money laundering. Though the protocol could be freely distributed, any form of business built on it will have a lot of trouble existing in any useful form. Starting from that point is going to make your life so much harder. And of course, the irony in trying to use Bitcoin as a basis for anonymous transactions is solved with Zerocoin. But I don't know how a law-abiding business can have reasonable knowledge of the parties in the transactions (a requirement to not be money laundering) without meeting the wishes of the fanbase.

gavazzy 11y ago
Actually, anonymous financial transactions are quite common. Every time you purchase something with cash, the seller receives payment with no knowledge of who you are or how you got the money. And the definition of money laundering is hiding the source of illegally obtained money. An anonymous transaction isn't laundering if there's nothing dirty about the money in the first place.
- XorNot 11y ago
  Paying in cash involves turning up in person with cash. That's definitely not anonymous.

fernly 11y ago

This issue is mentioned in a small sub-comment and has drawn no replies but it seems to me like the Heffalump In the Room: "For its first four years online, a portion of every mined Zcash coin will go directly to Wilcox’s Zcash company and a smaller portion to a non-profit he’s creating to oversee the Zcash code and community longterm. Wilcox says that he plans for 1 percent of Zcash’s currency to ultimately go towards that non-profit, and 10 percent to be paid to the for-profit startup." Who is going to want to engage in commerce in a system that creams off a 10 percent vigorish on every transaction? Credit card companies are hated by small merchants for taking a third that much.

x5n1 11y ago
Credit card companies take at least that much from the transaction. They charge both the supplier and the holder.
- runholm 11y ago
  Credit cards are more expensive than most would like them to be. We don't need another expensive system. Besides, credit cards offer protection in that they are able to give insurance on purchases by doing charge backs.
jpatokal 11y ago
10% of every mined coin, not transaction. Big difference.

kedean 11y ago

I applaud the cryptography work here, it seems like a damn cool application of ZKPs, but I think their missing what made Bitcoin work. The tech people took to BTC because it was something that they could verify worked correctly, and had no centralized party who could change it on a whim. Once it had the backing of those tech people, then it spread to everyone else. These guys might be able to get a small portion of customers who don't care about a centralized party, but that just isn't going to be enough, those aren't the people who are going to evangelize it.

davidgerard 11y ago

This literally has no use case other than illicit transactions - the one and only substantial Bitcoin use case in practice. They're even asked about this directly and can't come up with any! So the question is: can Zcash compete with Bitcoin in the darknet markets? Is there any DNM that does any substantial business in a crypto other than Bitcoin?

ccarter84 11y ago
> This literally has no use case other than illicit transactions My thoughts exactly. But they must have made a good case that there were other uses to their investors, they netted some pretty high-profile names. I would imagine Dash is getting traction on darknets, but I haven't seen anything on that one lately

quantumpotato_ 11y ago

Can someone explain how these "Zero Knowledge Proofs" are "untraceable"?