4 ms·

The trusted setup is not as bad as those two words make it sound without any context: 1. All people present in the trusted setup would have to be colluding or

by JelteF 9y ago

The trusted setup is not as bad as those two words make it sound without any context: 1. All people present in the trusted setup would have to be colluding or be compromised to cause an issue. 2. Some of these people have reason to make the currency succeed, because they own large amounts of zcash. 3. Some show the lengths they went to to prevent compromise: https://petertodd.org/2016/cypherpunk-desert-bus-zcash-trusted-setup-ceremony https://petertodd.org/2016/cypherpunk-desert-bus-zcash-trust... One of my own opinions on collusion: If collusion was suggested by one or more of the people present in the setup it would be quite likely that another one would have come out and said something about it. This would have made zcash and the person itself very untrustworthy. This makes it likely that it wasn't worth the risk to the person thinking of collusion in the first place.

nubela 9y ago
Erm, #1 is not that far from being achieved. IIRC, that's just 6 people, guarding hundreds of millions of dollars. There lies the inherent problem with "trusted setup", why leave there a possibility of 6 people not colluding? That just isn't scientific or exhuastive. Just drop the IFs, go with Monero's method of RingCT. Beside, Monero's privacy is a working feature today, with no pre-mines, unlike ZCash.
- sowithit 9y ago
  It is not down to 6 people forever not colluding. It's down to 6 people not having colluded at one point in time in the past, each having been scrutinized during the procedure, with post-hoc inspection of the software and hardware. If those 6 people decided at any point after the procedure that they wanted to collude, then it would be too late for them to do so. Essentially they each produced a private key, and if each of them revealed their private key to the same party then that party could derive a master private key that would allow them to (among other things) mint Zcash for free (privacy wouldn't be broken). Assuming that any one of the 6 did in fact destroy/corrupt his private key without revealing it, then the collusion opportunity is forever lost.
mercer 9y ago
Honest question: what about the potential of someone kidnapping two or more of these people and forcing them to give up their keys? What would the consequence of that be?
- rspeer 9y ago
  My understanding is that you would have to believe that they were kidnapped or otherwise under duress at the time that they did the trusted setup, which was on video. The trusted information (supposedly) can't be given up now because nobody has it: it was ceremonially destroyed in interesting ways.
makomk 9y ago
The trusted setup is not necessarily an issue in practice, but it's something that Bitcoin was explicitly created to avoid and that makes it rather absurd to describe Zcash as "Satoshi's vision". Arguably it has as much or more in common with the older pre-Bitcoin cryptocurrencies than with Bitcoin.
petertodd 9y ago
I'd suggest you read my "Cypherpunk Desert Bus" article a little more closely, notably section 1.2 where I say: "Until the software and deterministic builds are audited, the entire ceremony is a bunch of crypto hocus pocus that means nothing." The trusted setup is really dubious and highly vulnerable; so far my efforts were wasted due to the fundamental problems that everyone in the multi-party-computation ran the exact same unaudited software.

by JelteF 9y ago

nubela 9y ago

Erm, #1 is not that far from being achieved. IIRC, that's just 6 people, guarding hundreds of millions of dollars. There lies the inherent problem with "trusted setup", why leave there a possibility of 6 people not colluding? That just isn't scientific or exhuastive. Just drop the IFs, go with Monero's method of RingCT. Beside, Monero's privacy is a working feature today, with no pre-mines, unlike ZCash.

sowithit 9y ago
It is not down to 6 people forever not colluding. It's down to 6 people not having colluded at one point in time in the past, each having been scrutinized during the procedure, with post-hoc inspection of the software and hardware. If those 6 people decided at any point after the procedure that they wanted to collude, then it would be too late for them to do so. Essentially they each produced a private key, and if each of them revealed their private key to the same party then that party could derive a master private key that would allow them to (among other things) mint Zcash for free (privacy wouldn't be broken). Assuming that any one of the 6 did in fact destroy/corrupt his private key without revealing it, then the collusion opportunity is forever lost.

mercer 9y ago

Honest question: what about the potential of someone kidnapping two or more of these people and forcing them to give up their keys? What would the consequence of that be?

rspeer 9y ago
My understanding is that you would have to believe that they were kidnapped or otherwise under duress at the time that they did the trusted setup, which was on video. The trusted information (supposedly) can't be given up now because nobody has it: it was ceremonially destroyed in interesting ways.

makomk 9y ago

The trusted setup is not necessarily an issue in practice, but it's something that Bitcoin was explicitly created to avoid and that makes it rather absurd to describe Zcash as "Satoshi's vision". Arguably it has as much or more in common with the older pre-Bitcoin cryptocurrencies than with Bitcoin.

petertodd 9y ago

I'd suggest you read my "Cypherpunk Desert Bus" article a little more closely, notably section 1.2 where I say: "Until the software and deterministic builds are audited, the entire ceremony is a bunch of crypto hocus pocus that means nothing." The trusted setup is really dubious and highly vulnerable; so far my efforts were wasted due to the fundamental problems that everyone in the multi-party-computation ran the exact same unaudited software.