5 ms·

Zerocash had a possible backdoor, which was its' biggest drawback. I don't see it mentioned on the web page, which seems like they're hiding it (it's cruital to

by xiphias 11y ago

Zerocash had a possible backdoor, which was its' biggest drawback. I don't see it mentioned on the web page, which seems like they're hiding it (it's cruital to know who we need to trust with the setup part, and whether anybody has the right to take part in it). ,,Security of Π relies on a trusted party running Setup to generate the public parameters (once and for all). This trust is needed for the transaction non-malleability and balance properties but not for ledger indistinguishability'' - from the zerocash paper

ewillbefull 11y ago
Zcash is planning to use a new multi-party trusted setup scheme that allows a group to securely compute the mathematical structures necessary to protect the zero-knowledge proof integrity. (Secure Sampling of Public Parameters for Succinct Zero Knowledge Proofs, Ben-Sasson, E. ; Chiesa, A. ; Green, M. ; Tromer, E. et al.) Only if every member of this group were compromised or dishonest will the setup fail. That is, only 1/N participants need to be honest.
- mangeletti 11y ago
  Would this new "multi-party trusted setup" happen to be based on a block chain of its own? If so, then they've introduced a new sort of meta 51% attack potential in a system that gives no economic incentive to mine (i.e., 51% attack is much easier when its not "51% of everyone trying to earn coins", but instead is "51% of those donating computing to protect zero-knowledge proof"), right? If not so, then how? (rewind to Jan 2, 2009...)
  - jhasse 11y ago
    I haven't read the paper, so correct me if I'm wrong: I think the "multi-party trusted setup" isn't about a blockchain or something complex. It's just an algorithm to set up some initial values.
  - swordswinger12 11y ago
    Most zk-SNARK constructions are in the "common reference string" model, which requires a one-time trusted setup of a random string accessible to all parties: https://en.wikipedia.org/wiki/Common_reference_string_model https://en.wikipedia.org/wiki/Common_reference_string_model
- xiphias 11y ago
  Sounds cool, it would be good to make the paper free as well, if the code is open source. Actually it would be even better to update the Zerocash paper so that people can understand the current zcash implementation. The source code maybe open, but the documentation seems far behind the source code. I'm sure that the protocol is sound, and you put lots of effort in it, but it's hard to understand for me, unlike the original Bitcoin. I loved reading BitcoinJ source code, as it is well documented and it's an easy to understand way to see that at least the BitcoinJ based wallets really do the same thing than what was present in the Bitcoin Whitepaper. Still, I guess I'm the minority, and many people will just trust the developers and use the system as long as it works. Anyways good luck, and I hope we will have fungibility in Bitcoin itself in the next few years.
MCRed 11y ago
Shouldn't those parameters then be well known to everybody? And subject to investigation? Can you give more detail as to why this is a backdoor?
sarciszewski 11y ago
> I don't see it mentioned on the web page, which seems like they're hiding it https://github.com/Electric-Coin-Company/zcash https://github.com/Electric-Coin-Company/zcash Not very well, if at all.
- ewillbefull 11y ago
  The actual setup of the parameters hasn't occured and will use a much more secure construction which isn't complete yet. The software is still in alpha.
jhasse 11y ago
This could be done by multiple people. The "trusted party" doesn't need to be one person, it could just be the bitcoin miners of a given time frame (without them agreeing, just use their hash values).

by xiphias 11y ago

ewillbefull 11y ago

Zcash is planning to use a new multi-party trusted setup scheme that allows a group to securely compute the mathematical structures necessary to protect the zero-knowledge proof integrity. (Secure Sampling of Public Parameters for Succinct Zero Knowledge Proofs, Ben-Sasson, E. ; Chiesa, A. ; Green, M. ; Tromer, E. et al.) Only if every member of this group were compromised or dishonest will the setup fail. That is, only 1/N participants need to be honest.

mangeletti 11y ago
Would this new "multi-party trusted setup" happen to be based on a block chain of its own? If so, then they've introduced a new sort of meta 51% attack potential in a system that gives no economic incentive to mine (i.e., 51% attack is much easier when its not "51% of everyone trying to earn coins", but instead is "51% of those donating computing to protect zero-knowledge proof"), right? If not so, then how? (rewind to Jan 2, 2009...)
- jhasse 11y ago
  I haven't read the paper, so correct me if I'm wrong: I think the "multi-party trusted setup" isn't about a blockchain or something complex. It's just an algorithm to set up some initial values.
- swordswinger12 11y ago
  Most zk-SNARK constructions are in the "common reference string" model, which requires a one-time trusted setup of a random string accessible to all parties: https://en.wikipedia.org/wiki/Common_reference_string_model https://en.wikipedia.org/wiki/Common_reference_string_model
xiphias 11y ago
Sounds cool, it would be good to make the paper free as well, if the code is open source. Actually it would be even better to update the Zerocash paper so that people can understand the current zcash implementation. The source code maybe open, but the documentation seems far behind the source code. I'm sure that the protocol is sound, and you put lots of effort in it, but it's hard to understand for me, unlike the original Bitcoin. I loved reading BitcoinJ source code, as it is well documented and it's an easy to understand way to see that at least the BitcoinJ based wallets really do the same thing than what was present in the Bitcoin Whitepaper. Still, I guess I'm the minority, and many people will just trust the developers and use the system as long as it works. Anyways good luck, and I hope we will have fungibility in Bitcoin itself in the next few years.

MCRed 11y ago

Shouldn't those parameters then be well known to everybody? And subject to investigation? Can you give more detail as to why this is a backdoor?

sarciszewski 11y ago

> I don't see it mentioned on the web page, which seems like they're hiding it https://github.com/Electric-Coin-Company/zcash https://github.com/Electric-Coin-Company/zcash Not very well, if at all.

ewillbefull 11y ago
The actual setup of the parameters hasn't occured and will use a much more secure construction which isn't complete yet. The software is still in alpha.

jhasse 11y ago

This could be done by multiple people. The "trusted party" doesn't need to be one person, it could just be the bitcoin miners of a given time frame (without them agreeing, just use their hash values).