3 ms·
> There's gotta be a way to do consensus about zero-knowledge proofs that's a little more... you know ... decentralized. Not really, no. There is no known sche
by kobeya 9y ago
> There's gotta be a way to do consensus about zero-knowledge proofs that's a little more... you know ... decentralized.
Not really, no. There is no known scheme that has similar properties but non-trusted setup. There's not a proof that it's impossible either, so something might get invented. But at the moment, no.
That said I share the criticism. Even with trusted setup it could have been done much better.
- knocte 9y ago> There is no known scheme that has similar properties but non-trusted setup. There's not a proof that it's impossible either, so something might get invented. But at the moment, no. Already invented. It's called MimbleWimble.
- kobeya 9y ago... that's a system with entirely different properties.
- knocte 9y agoAnd? It provides privacy.
- kobeya 9y agoWith a very different set of tradeoffs. MW does not provide anonymity. It provides, at best, pseudo-anonymity with coinjoin mixing by default, with N=2 in the implementations being considered. Careful repeated application with the right counter-parties can compound that into larger anonymity sets. That's a step forward from bitcoin, for sure. And if you're very careful, it could achieve whatever privacy requirement you might have. The Zcash-like approach on the other hand is to provide a transaction mode where your anonymity set is everyone who has ever transacted with the system before. That's N=everybody; the source of funds is entirely obscured. The two achieve totally different goals, with a different set of tradeoffs. Apples to oranges.
- plasticmachine 9y agoI’m a massive MW proponent but the privacy claims are very weak compared to ZCash and Monero. What MW does well is scalability.
- gojomo 9y agoIf I understand correctly a recent presentation by Eli Ben-Sasson, one of ZCash's scientists, there is now at least one ZK system with this 'transparent' property (needing no trusted setup), but it is not yet practical for a blockchain currency. See Ben-Sasson on "STARK": https://www.youtube.com/watch?v=HJ9K_o-RRSY https://www.youtube.com/watch?v=HJ9K_o-RRSY