9 ms·
Is Zcash’s encrypted blockchain Satoshi’s vision?
- IIAOPSW 9y agoNo. Two words. Trusted setup. Monero is way closer to Satoshi's vision, up to and including having an unknown inventor.
- JelteF 9y agoThe trusted setup is not as bad as those two words make it sound without any context: 1. All people present in the trusted setup would have to be colluding or be compromised to cause an issue. 2. Some of these people have reason to make the currency succeed, because they own large amounts of zcash. 3. Some show the lengths they went to to prevent compromise: https://petertodd.org/2016/cypherpunk-desert-bus-zcash-trusted-setup-ceremony https://petertodd.org/2016/cypherpunk-desert-bus-zcash-trust... One of my own opinions on collusion: If collusion was suggested by one or more of the people present in the setup it would be quite likely that another one would have come out and said something about it. This would have made zcash and the person itself very untrustworthy. This makes it likely that it wasn't worth the risk to the person thinking of collusion in the first place.
- nubela 9y agoErm, #1 is not that far from being achieved. IIRC, that's just 6 people, guarding hundreds of millions of dollars. There lies the inherent problem with "trusted setup", why leave there a possibility of 6 people not colluding? That just isn't scientific or exhuastive. Just drop the IFs, go with Monero's method of RingCT. Beside, Monero's privacy is a working feature today, with no pre-mines, unlike ZCash.
- sowithit 9y agoIt is not down to 6 people forever not colluding. It's down to 6 people not having colluded at one point in time in the past, each having been scrutinized during the procedure, with post-hoc inspection of the software and hardware. If those 6 people decided at any point after the procedure that they wanted to collude, then it would be too late for them to do so. Essentially they each produced a private key, and if each of them revealed their private key to the same party then that party could derive a master private key that would allow them to (among other things) mint Zcash for free (privacy wouldn't be broken). Assuming that any one of the 6 did in fact destroy/corrupt his private key without revealing it, then the collusion opportunity is forever lost.
- mercer 9y agoHonest question: what about the potential of someone kidnapping two or more of these people and forcing them to give up their keys? What would the consequence of that be?
- rspeer 9y agoMy understanding is that you would have to believe that they were kidnapped or otherwise under duress at the time that they did the trusted setup, which was on video. The trusted information (supposedly) can't be given up now because nobody has it: it was ceremonially destroyed in interesting ways.
- makomk 9y agoThe trusted setup is not necessarily an issue in practice, but it's something that Bitcoin was explicitly created to avoid and that makes it rather absurd to describe Zcash as "Satoshi's vision". Arguably it has as much or more in common with the older pre-Bitcoin cryptocurrencies than with Bitcoin.
- petertodd 9y agoI'd suggest you read my "Cypherpunk Desert Bus" article a little more closely, notably section 1.2 where I say: "Until the software and deterministic builds are audited, the entire ceremony is a bunch of crypto hocus pocus that means nothing." The trusted setup is really dubious and highly vulnerable; so far my efforts were wasted due to the fundamental problems that everyone in the multi-party-computation ran the exact same unaudited software.
- kobeya 9y agoThe other issue with zcash is an ever growing double-spend list. Monero also suffers this flaw, unfortunately. If either one scaled up to just bitcoin's level of activity, there'd be severe problems. Mimblewimble is far more likely to be a lasting privacy gain since the technology it is built upon, Blockstream's confidential transactions, has properties more like Bitcoin's in this regard, and perhaps even better as you can sync from a partially-pruned history.
- q-base 9y agoCould you elaborate on this flaw, or perhaps point to a link - especially with regards to Monero?
- dangero 9y agoYes, I'm pretty sure that neither Zcash or Monero allow double-spends. Wondering what the context of that statement could possibly be. Any successful cryptocurrency must solve the double-spend problem or there's no value in the ledger at all.
- kobeya 9y agoHere's a stack exchange question: https://monero.stackexchange.com/questions/2158/what-is-moneros-mechanism-for-defending-against-a-double-spend-attack https://monero.stackexchange.com/questions/2158/what-is-mone... TL;DR Monero requires every transaction input to include a "key image" (an elliptic curve point, looks like a public key). The key image is deterministically constructed from the actual coin being spent, without actually revealing which one it is. So making sure the chain never contains a repeated key image is sufficient to make sure that no coin is ever spent more than once, without actually knowing whether any one specific coin is spent. This is how Monero achieves its inflation/non-cloning guarantee. (There was a famous double-spending bug in CryptoNote protocols you might have heard about that resulted in limitless inflation. This was because the Ed25519 signature scheme used has a co-factor of 8, a stupid performance "enhancement" that DJB should really re-think. As a result, a given key-image had a 1-in-8 chance of being malleable by adding a point of order 8. It's fixed by checking that the key image is actually contained in the group. These sorts of unexpected consequences are why serious cryptographers don't use co-factors other than 1, or other fiddly tricks that get you small constant implementation gains with risky not well studied trade-offs. This is also why the current push to standardize on DJB designed crypto solutions is borderline insanity. But I digress.) The mathematics of what zerocash does is wildly different, but it serves essentially the same purpose. Each private/anonymous spend in zerocash has some bits associated with it that are generated in a non-linking way from the input being spent. As long as there are never two transactions in the entire block chain history with the same value for this field, there are no double-spends. ----- The problem is that these can never go away. In bitcoin if a coin is spent, you can prune knowledge of that coin from your local history. This is what the "-prune" option does in recent versions of Bitcoin Core. You still need to receive and process the transaction once when you sync the chain, but you can then throw it away if you are space constrained. Mimblewimble potentially improves the situation even better by boiling down each transaction to just a single EC point, the script kernel, such that a client needs only the current UTXO set and the full history of all these kernels to do initial sync. The rest of the data can well and truly be forgotten. But although those kernels are needed for initial sync, pruning nodes can throw them away afterwards. They are not needed for the validation of future blocks in any way. TL;DR: The amount of data a verifier needs to keep around to validate a new block in bitcoin depends only on the number of unspent outputs. The full block chain is only needed for initial sync. This is asymptotically O(current size of bitcoin ecosystem). The amount of data needed by Monero or Zerocash, on the other hand, is (a constant factor of) the entire block chain used by these systems. This is asymptotically O(every transaction ever). Monero and ZCash are chugging along now, but every single block found increases the amount of data a verifier needs to keep around. That doesn't scale....
- tromp 9y agoMimblewimble [0] is a radically different approach to privacy and fungibility, making all transactions look alike. [0] http://mimblewimble.cash/ http://mimblewimble.cash/
- IIAOPSW 9y agoThis is a cool project. Thanks for sharing the link. I'll totally buy/mine some GRIN when it comes out. Things I like so far: 1) Solves privacy and scaling in a single elegant stroke. 2) Inventors seem to be anonymous. I didn't try too hard to identify them but Tom Elvis Jedusor is the French name of Lord Voldemort. This is an important feature for privacy focused coins and for cryptocurrency as a political statement (not just as a technology). 3) The website, by eschewing flashy web2.0 design and and buzzwords, clearly sets itself apart from the typical "lets get rich quick" coin. Although I am disappointed the white paper isn't done in LaTeX. Reasons I'm skeptical (perhaps you can address these): 1) Missed the boat on first mover advantage. Monero seems to solve the privacy problem good enough. Perhaps it is unreasonable to expect people to completely swap over to a new coin whenever there's an advance in tech. Especially when word of the new coin has to spread through grass roots instead of a centralized mechanism. 2) Elliptic curve crypto is vulnerable to quantum computers. IMO this is a ticking time bomb. 3) Expanding on point 2, bitcoin intentionally made a habit of layering "proven" crypto methods on top of each other. Eg both SHA256 and RIPEMD160 hash functions are used so that if a weakness is found in one hash the other is still ok. So far as I can tell mimblewimble has a single point of failure (elliptic curve cryptography).
- tromp 9y ago> Reasons I'm skeptical (perhaps you can address these): 1) Monero may have first mover advantage in the privacy realm, but at the cost of prunability. Grin not only avoids that cost but further improves prunability beyond bitcoin. To me the first mover advantage will always belong to bitcoin, which will likely adopt privacy improving features in the long term. 2+3) Indeed; when evidence appears of quantum computers becoming feasible at breaking EC crypto, current blockchains will need to adopt post-quantum crypto methods of signing transactions, and migrate existing balances. Since EC crypto is more heavily ingrained into Grin, it may have a much harder time than the more modular bitcoin design, or even find it impossible to do so. I'm not aware of any post-quantum equivalent to Pedersen commitments. My hope is that quantum computer development runs into insurmountable barriers...
- zooko-at-zcash 9y agoI really don't like the reliance on the Ceremony to prevent counterfeiting, but it is the only way science has yet discovered for how to enable full-strength (encryption-based) privacy. Fortunately, science continues to advance and I hope we'll be able to upgrade to a trapdoor-free cryptographic proof system someday.
- jameskegel 9y agoNo. Absolutely no. Satoshi didn't envision a corporation pulling strings behind the scenes just in case some bad guys might use it some day down the line.
- Ar-Curunir 9y agoYup, Satoshi totally didn't create a protocol where the cops can already figure that stuff out themselves without any outside help...
- krisives 9y agoDigital chain of signatures, the rest is icing on the cake.
- Ar-Curunir 9y agoI mean, the entire architecture of Zerocash is completely different, so...
- nextstep 9y agoWhat? How could any protocol requiring a trusted setup be considered close to Satoshi's vision?
- neuralzen 9y agoCryptoNote coins (Monero and Aeon) are leagues closer to Satoshi's vision.
- aryehof 9y agoMy guess is that Satoshi's vision wasn't that Bitcoin would start a frenzy of "blockchain technology" endeavors that feature the movement of capital to promoters and investors, and between speculators.
- zby 9y agoI cannot find it now - but I am sure that he wrote somewhere about competing currencies and lateral inflation.
- danieldrehmer 9y agoif you find a link for this, I bet many of us would love to read it
- jancsika 9y agoThere's evidence the vision didn't include investors and speculators. The "generate coins" button in the old GUI depends on their absence. Even GPU mining made that button obsolete.
- dangero 9y agoThe unfortunate thing to me about Zcash is that privacy is opt-in. It would be like if Signal was default no privacy, but then you could enable it per message if you wanted to send something secret. Governments could just ban you from turning the privacy on and we've already seen this happen with TOR. Opting into privacy "raises suspicion", and we need services where privacy is enabled by default. Monero does this.
- sowithit 9y agoIt's just as possible to not use Monero's mix-ins as it is to use Zcash's transparent addresses. So no, Monero doesn't win here.
- gingeropolous 9y agonot true. Monero has had forced ringsize > 1 (the new term for mixin, because mixin implies active mixing) since around 2016 or so. http://moneroblocks.info/stats/ring-size http://moneroblocks.info/stats/ring-size ooh i can edit. And the recent fork increased the minimum to 5. Hopefully some magic math will soon make it possible for a minimum of 10.
- silur 9y agoyou can interpret this as a problem and as a solution too. Yes, ztransactions will could dye your money so no exchange will accept it because you are a terrorist and the US can ban the usage of ztransactions. In my opinion it's better like this, since the overall goal is to not rely on exchanges and regulatory thirdparties. In a P2P economy (which is this technology is meant to lead us) fungibility problems are not a thing beacuse there is no relative central party to make a standard.
- gingeropolous 9y ago> In a P2P economy (which is this technology is meant to lead us) fungibility problems are not a thing beacuse there is no relative central party to make a standard. wat? fungibility is not about a standard. fungibility applies at every level. "Hrmmm yes while you are looking at this car here I'm just going to scan your blockchain activity and hrmmmmm it seems that you are in about the top 30% of income in this country so yessss the price of this car is X" boom. That car salesman just defacto made your tracecoin less valuable than some poor shmuck in the lower 50%.
- georgecarlin 9y agoI think the fact that there is no Satoshi means that 1. his/her/their vision is up for grabs and 2. whoever did create Bitcoin didn't want people continuously asking him/her/them what their vision for this is. It hasn't even been 10 years, why are we already arguing over catechism?
- madmax108 9y agoIs it just me or are more and more stories which look like fluff pieces for ZCash coming up on the HN frontpage? If they were a startup, I'd guess they were prepping for an IPO/acquisition. Most of them have titles with rhetorical questions, and come across as marketing pieces more than anything else. Really weird.
- sowithit 9y agoI actually found it interesting to read Zooko's opinions about the market opportunity (namely, replacing fiat currencies in countries where they are unstable) and why governments might not hate Zcash (namely, because transactions can contain identifying information as they are encrypted). I don't actually agree with him, and I question if he truly believes those answers, but I was interested to read his public opinions.
- Legogris 9y agoAlong the same line, you get public endorsements and comments from people like Snowden and Assange. ZCash, as opposed to f.e. Monero, is a private company and consciously spending time, money and effort on brand-building and PR. Nothing really weird with that IMO.
- zooko-at-zcash 9y agoFor the record, someone who gives an interview to a journalist almost never gets a say over what headline it gets published under. Did you read the article? I really liked the way it came out! Also for the record, we didn't ask Assange or Snowden to start accepting donations in Zcash or anything. Or at least, I didn't. It's quite possible some other members of the Zcash community did without my knowledge. [New account because I can't remember my password and when I ask it to the reset the password on zooko-zcash it says "sorry there is no valid email address associated with that account". Maybe it thinks "zooko@z.cash" is not a valid email address.]
- wildchild 9y agoBitcoin eliminates requirement of the trusted 3rd party. Zcash core flows: - Trusted setup - 20% tax on blockchain Zcash and Bitcoin are orthogonal.
- mmel 9y agoI ignore all pre-mined cash grabs
- RandVal30142 9y agoZcash takes one of the only novel parts of Bitcoin, not requiring trust in a central authority, and pitches it into the garbage. The garbage is likely where Zcash belongs.
- rspeer 9y agoSomeone explain this part to me: > I would be happy if Zcash and Bitcoin could serve as a gateway from an unstable currency (Venezuelan Bolivar) to a stable currency (EURO/USD) How would this actually happen? Who is on the other side of this transaction? Who would want to cash out their Bitcoin in Venezuelan bolivar? I assume the Bitcoin trades that actually occur in Venezuela are for USD and black-market goods, not for bolivar.
- irremediable 9y agoPresumably one might want to trade the BTC for bolivar to immediately spend them somewhere?
- rspeer 9y agoNot that I have experience in the matter, but I have heard that spending bolivar in Venezuela means waiting in long lines for goods with artificial prices, whereas you can buy whatever you want in USD. I suspect that the bolivar/BTC trade is just a feel-good story, and the reality is that Bitcoin is not available to ordinary Venezuelans.
- tromp 9y agoWhen Zooko says that Zcash "is a kind of money that doesn’t come from any government or company" he is only 90% correct...
- 0xlullaby 9y agoThat's a highly insulting question. The Zcash guys are working together with JP Morgan. Maybe you should take a look at the genesis block of bitcoin, in case you don't know what it is about.
- arisAlexis 9y agono because of the trusted setup it can never be.
- silur 9y agoaccusing a chaumian crypto violating the satoshi vision is like ranting about windows not being POSIX enough