5 ms·

The Security Behind the Birth of Zcash

61 points by mrb 10y ago

exolymph 10y ago
Obligatory link to Peter Todd's experience of participating in this ceremony (for lack of a better word) — as a skeptic, no less — which is an excellent read for the opsec alone: https://petertodd.org/2016/cypherpunk-desert-bus-zcash-trusted-setup-ceremony https://petertodd.org/2016/cypherpunk-desert-bus-zcash-trust...
- lccarrasco 10y ago
  Thanks for sharing, really fascinating :).
saycheese 10y ago
>> "The number of people who really understand zk-SNARKs, and therefore the Zcash protocol, is probably small enough that you could feed them all with one Thanksgiving turkey." If the list is so small, who are they?
- s_q_b 10y ago
  More importantly, where are they having this turkey? In all seriousness though, if I were one of a handlful of people who understood a rising anonymous currency platform, I wouldn't want to be publicly exposed that way.
  - kbody 10y ago
    Indeed, even though a couple popular cryptographers have vouched, it's still not the classic definition of peer-reviewed for something that ground-breaking. That aside, the MPC (Multi-Party Computation) setup is more of a security theater than actual security. It completely goes against of what cryptography is all about and I'm puzzled as to why any cryptographer would base their system's security in such a way.
    - petertodd 10y ago
      Do you mean to say the Zcash trusted setup shouldn't have used MPC? Or do you mean to say Zcash itself is fudnementally flawed due to the trusted setup?
      - kbody 10y ago
        The second one mainly. There is probably a way to do MPC in a truly trustless manner but that's another big challenge and Zcash investors were probably getting impatient so they pushed for a launch.
    - moyix 10y ago
      It actually is the classic definition of peer reviewed! The paper on Zerocash (renamed Zcash) was published at the IEEE Symposium on Security and Privacy: http://zerocash-project.org/media/pdf/zerocash-oakland2014.pdf http://zerocash-project.org/media/pdf/zerocash-oakland2014.p... It's a peer-reviewed conference and basically the top venue (along with Usenix Security and ACM CCS) for academic computer security. I'm not sure what you mean by "for something that ground-breaking"?
      - lmeyerov 10y ago
        Oakland is more of a systems security conference, so peer review here speaks more to the architectural thinking, and says little about the deeper math. Same thing for Usenix. I'd want to see somewhere like Crypto/EuroCrypt, or maybe IACR, to call it peer reviewed. Even then, it may pass largely on novelty & prestige. (For background, I used to publish at this conference and others, did my share of paper reviewing, and my colleagues were working on e-cash crypto around the time of bitcoin's rise.)
        moyix 10y ago
        My impression with Crypto is that people who focus more on the applied side of cryptography have found it difficult to get papers accepted there. [My own background is firmly in systems security – I've had papers at Oakland and CCS – and I'm not as familiar with the crypto side]
  - deleted 10y ago
    [deleted]
- jackgavigan 10y ago
  Probably the authors of the Zerocash paper (http://zerocash-project.org/paper http://zerocash-project.org/paper), the authors of the Zcash protocol (https://github.com/zcash/zips/blob/master/protocol/protocol.pdf https://github.com/zcash/zips/blob/master/protocol/protocol....) and str4d.
  - plasticmachine 10y ago
    Thanks for confirming that you rushed unproven, untested cryptography into a production system meant to defend user's privacy and their money. Speaking of - why did you rush it out? Because your investors wanted to make profit? Absolutely despicable.
- Animats 10y ago
  I went to the EE380 talk at Stanford where Eran Tromer explained the theory.[1][2] The claims were very broad, and I didn't understand exactly what was supposed to have been proven. A lot of material was covered very fast. Watch the video and try to figure it out. [1] http://web.stanford.edu/class/ee380/ http://web.stanford.edu/class/ee380/ [2] https://www.youtube.com/watch?v=KP8TPeYQyN4 https://www.youtube.com/watch?v=KP8TPeYQyN4
- wslh 10y ago
  This is a prerelease for our soon to be published: "zk-SNARK explained: basic principles" here: https://drive.google.com/file/d/0B57LWnAurZr_OGhVOENnbHRoaGM/view?usp=sharing https://drive.google.com/file/d/0B57LWnAurZr_OGhVOENnbHRoaGM...
based2 10y ago
http://zerocash-project.org/media/pdf/zerocash-extended-20140518.pdf http://zerocash-project.org/media/pdf/zerocash-extended-2014...
quickben 10y ago
Do you guys know of a decent overview website for all these new hipster currencies? But I mean a realistic one, including info such as: - how much it has been pre-mined. - why is it being pushed ( research, corp goals, etc) - limits (does one need a GPU to use it or can it execute on a CPU) I know of few places that have lists, but I get the impression that people start currencies lately as a shot at getting rich if they take off, and not from a realistic need to do so.
- maxerickson 10y ago
  Zcash is materially different than Bitcoin, so it at least isn't any more hipster than Bitcoin itself. Unlike Bitcoin, Zcash transactions can be shielded to hide the sender, recipient, and value of all transactions on the blockchain. https://z.cash/ https://z.cash/
  - plasticmachine 10y ago
    It uses completely unproven cryptography that may quite possibly be horribly broken. If you have a better definition of "hipster" than "use something for the sake of it, regardless of practicality" I'd love to hear it.
    - maxerickson 10y ago
      Oh, I will continue to own $0 in Zcash, but trying to provide actual confidential transactions isn't "for the sake of it, regardless of practicality", there is a clear motivation.
      - plasticmachine 10y ago
        No, it is. Those already exist in the form of Monero. Using some new-fangled, likely broken cryptography, is very hipster.
        mrb 10y ago
Animats 10y ago
The developers don't need to steal. They're making money from early mining. Here's ZCash right now, down about 99% from the initial price.[1] The market cap keeps rising as the price falls, indicating it is being mined way too fast for the market. [1] https://coinmarketcap.com/currencies/zcash/ https://coinmarketcap.com/currencies/zcash/
- saycheese 10y ago
  Agree with the analysis, puzzles me why the currency doesn't balance the cost of mining in a way that doesn't significantly devalue existing holdings. It would be interesting to see an estimate of the cost to mine the coins at the rate they're being mined. If the cost is more than the face value of the coin, seems like something funny is going on.

61 points by mrb 10y ago

Obligatory link to Peter Todd's experience of participating in this ceremony (for lack of a better word) — as a skeptic, no less — which is an excellent read for the opsec alone: https://petertodd.org/2016/cypherpunk-desert-bus-zcash-trusted-setup-ceremony https://petertodd.org/2016/cypherpunk-desert-bus-zcash-trust...

lccarrasco 10y ago
Thanks for sharing, really fascinating :).

saycheese 10y ago

>> "The number of people who really understand zk-SNARKs, and therefore the Zcash protocol, is probably small enough that you could feed them all with one Thanksgiving turkey." If the list is so small, who are they?

s_q_b 10y ago
More importantly, where are they having this turkey? In all seriousness though, if I were one of a handlful of people who understood a rising anonymous currency platform, I wouldn't want to be publicly exposed that way.
- kbody 10y ago
  Indeed, even though a couple popular cryptographers have vouched, it's still not the classic definition of peer-reviewed for something that ground-breaking. That aside, the MPC (Multi-Party Computation) setup is more of a security theater than actual security. It completely goes against of what cryptography is all about and I'm puzzled as to why any cryptographer would base their system's security in such a way.
  - petertodd 10y ago
    Do you mean to say the Zcash trusted setup shouldn't have used MPC? Or do you mean to say Zcash itself is fudnementally flawed due to the trusted setup?
    - kbody 10y ago
      The second one mainly. There is probably a way to do MPC in a truly trustless manner but that's another big challenge and Zcash investors were probably getting impatient so they pushed for a launch.
  - moyix 10y ago
    It actually is the classic definition of peer reviewed! The paper on Zerocash (renamed Zcash) was published at the IEEE Symposium on Security and Privacy: http://zerocash-project.org/media/pdf/zerocash-oakland2014.pdf http://zerocash-project.org/media/pdf/zerocash-oakland2014.p... It's a peer-reviewed conference and basically the top venue (along with Usenix Security and ACM CCS) for academic computer security. I'm not sure what you mean by "for something that ground-breaking"?
    - lmeyerov 10y ago
      Oakland is more of a systems security conference, so peer review here speaks more to the architectural thinking, and says little about the deeper math. Same thing for Usenix. I'd want to see somewhere like Crypto/EuroCrypt, or maybe IACR, to call it peer reviewed. Even then, it may pass largely on novelty & prestige. (For background, I used to publish at this conference and others, did my share of paper reviewing, and my colleagues were working on e-cash crypto around the time of bitcoin's rise.)
      - moyix 10y ago
        My impression with Crypto is that people who focus more on the applied side of cryptography have found it difficult to get papers accepted there. [My own background is firmly in systems security – I've had papers at Oakland and CCS – and I'm not as familiar with the crypto side]
- deleted 10y ago
  [deleted]
jackgavigan 10y ago
Probably the authors of the Zerocash paper (http://zerocash-project.org/paper http://zerocash-project.org/paper), the authors of the Zcash protocol (https://github.com/zcash/zips/blob/master/protocol/protocol.pdf https://github.com/zcash/zips/blob/master/protocol/protocol....) and str4d.
- plasticmachine 10y ago
  Thanks for confirming that you rushed unproven, untested cryptography into a production system meant to defend user's privacy and their money. Speaking of - why did you rush it out? Because your investors wanted to make profit? Absolutely despicable.
Animats 10y ago
I went to the EE380 talk at Stanford where Eran Tromer explained the theory.[1][2] The claims were very broad, and I didn't understand exactly what was supposed to have been proven. A lot of material was covered very fast. Watch the video and try to figure it out. [1] http://web.stanford.edu/class/ee380/ http://web.stanford.edu/class/ee380/ [2] https://www.youtube.com/watch?v=KP8TPeYQyN4 https://www.youtube.com/watch?v=KP8TPeYQyN4
wslh 10y ago
This is a prerelease for our soon to be published: "zk-SNARK explained: basic principles" here: https://drive.google.com/file/d/0B57LWnAurZr_OGhVOENnbHRoaGM/view?usp=sharing https://drive.google.com/file/d/0B57LWnAurZr_OGhVOENnbHRoaGM...

based2 10y ago

http://zerocash-project.org/media/pdf/zerocash-extended-20140518.pdf http://zerocash-project.org/media/pdf/zerocash-extended-2014...

quickben 10y ago

Do you guys know of a decent overview website for all these new hipster currencies? But I mean a realistic one, including info such as: - how much it has been pre-mined. - why is it being pushed ( research, corp goals, etc) - limits (does one need a GPU to use it or can it execute on a CPU) I know of few places that have lists, but I get the impression that people start currencies lately as a shot at getting rich if they take off, and not from a realistic need to do so.

maxerickson 10y ago
Zcash is materially different than Bitcoin, so it at least isn't any more hipster than Bitcoin itself. Unlike Bitcoin, Zcash transactions can be shielded to hide the sender, recipient, and value of all transactions on the blockchain. https://z.cash/ https://z.cash/
- plasticmachine 10y ago
  It uses completely unproven cryptography that may quite possibly be horribly broken. If you have a better definition of "hipster" than "use something for the sake of it, regardless of practicality" I'd love to hear it.
  - maxerickson 10y ago
    Oh, I will continue to own $0 in Zcash, but trying to provide actual confidential transactions isn't "for the sake of it, regardless of practicality", there is a clear motivation.
    - plasticmachine 10y ago
      No, it is. Those already exist in the form of Monero. Using some new-fangled, likely broken cryptography, is very hipster.
      - mrb 10y ago

Animats 10y ago

The developers don't need to steal. They're making money from early mining. Here's ZCash right now, down about 99% from the initial price.[1] The market cap keeps rising as the price falls, indicating it is being mined way too fast for the market. [1] https://coinmarketcap.com/currencies/zcash/ https://coinmarketcap.com/currencies/zcash/

saycheese 10y ago
Agree with the analysis, puzzles me why the currency doesn't balance the cost of mining in a way that doesn't significantly devalue existing holdings. It would be interesting to see an estimate of the cost to mine the coins at the rate they're being mined. If the cost is more than the face value of the coin, seems like something funny is going on.