3 ms·

Zcash knew the problem of backdoor-able initial setup, they understood that it can raise serious doubts on the trustworthiness of their system, they even named

Zcash knew the problem of backdoor-able initial setup, they understood that it can raise serious doubts on the trustworthiness of their system, they even named the initial key material for setup as "cryptographic toxic waste". As an attempt to bring confidence to the setup ceremony, Zcash used a multiparty setup of 6 people, and invited prominent developers of the cryptocurrency community to participate. The setup was performed at each person's own undisclosed geolocation, and coordinated online. The rough idea was, if at least one participant during the setup was honest, properly destructed the secret, and wasn't hacked, the setup will be secure. The prominent Bitcoin developer, Peter Todd was invited to participate, too. You can read his entertaining blogpost about the setup procedure at here. https://web.archive.org/web/20161114214233/https://petertodd.org/2016/cypherpunk-desert-bus-zcash-trusted-setup-ceremony https://web.archive.org/web/20161114214233/https://petertodd... The funny and alarming story is, after he finished the setup, he became increasingly suspicious about the security of the procedures, especially casted doubts on some technical problems that prevented reproducible build (!!!) of the setup programs. And he later had withdrawn his blogpost and all the claims of security altogether. To me, it's alarming, in the end, we'll never get solid security guarantees.

RexetBlell 8y ago
Check out this podcast about the Zcash ceremony: https://www.wnycstudios.org/story/ceremony https://www.wnycstudios.org/story/ceremony
- just_one_time_ 8y ago
  Peter is a man child looking for controversy.
socrates1024 8y ago
Note that the technical problems made it more complicated and messy to reproduce the build, but didn't outright prevent it. Mainly the executable binaries were reproducible, but other metadata in the disk image changed each time. https://github.com/zcash/mpc/issues/2 https://github.com/zcash/mpc/issues/2
- petertodd 8y ago
  As you know, my complaints with regard to the reproducible build were not that the scripts themselves didn't work - indeed I fixed an issue related to that - but that the direct dependencies of the build were both high entropy (e.g. very specific nightly builds of a niche Linux distribution) and themselves not at all reproducible. Your reply here is highly misleading, even lying by omission.
dlubarov 8y ago
> Zcash used a multiparty setup of 6 people That's true of the original (Sprout) SNARK, but the newer (Sapling) SNARK used a much more scalable MPC ceremony, which they called Powers of Tau: https://z.cash.foundation/blog/powers-of-tau/ https://z.cash.foundation/blog/powers-of-tau/ There was a public call for participation at the time, so if you wanted to be sure that the ceremony was not corrupted, you could just participate yourself. For backwards compatibility, the Sprout SNARK can still be used, so if the original ceremony was compromised, an attacker could still create coins "out of thin air". But converting a Sprout account to a Sapling account requires making the amount public, so if the number of coins converted exceeded the intended currency supply, that would be detected. Worst case scenario, a hard fork could be arranged to disable the Sprout SNARK.
- matthewdgreen 8y ago
  The original Sprout SNARK has been disabled and replaced with a new implementation based on the powers of tao ceremony. You can still spend Sprout coins, but not with the old parameters.
deleted 8y ago
[deleted]

RexetBlell 8y ago

Check out this podcast about the Zcash ceremony: https://www.wnycstudios.org/story/ceremony https://www.wnycstudios.org/story/ceremony

just_one_time_ 8y ago
Peter is a man child looking for controversy.

socrates1024 8y ago

Note that the technical problems made it more complicated and messy to reproduce the build, but didn't outright prevent it. Mainly the executable binaries were reproducible, but other metadata in the disk image changed each time. https://github.com/zcash/mpc/issues/2 https://github.com/zcash/mpc/issues/2

petertodd 8y ago
As you know, my complaints with regard to the reproducible build were not that the scripts themselves didn't work - indeed I fixed an issue related to that - but that the direct dependencies of the build were both high entropy (e.g. very specific nightly builds of a niche Linux distribution) and themselves not at all reproducible. Your reply here is highly misleading, even lying by omission.

dlubarov 8y ago

> Zcash used a multiparty setup of 6 people That's true of the original (Sprout) SNARK, but the newer (Sapling) SNARK used a much more scalable MPC ceremony, which they called Powers of Tau: https://z.cash.foundation/blog/powers-of-tau/ https://z.cash.foundation/blog/powers-of-tau/ There was a public call for participation at the time, so if you wanted to be sure that the ceremony was not corrupted, you could just participate yourself. For backwards compatibility, the Sprout SNARK can still be used, so if the original ceremony was compromised, an attacker could still create coins "out of thin air". But converting a Sprout account to a Sapling account requires making the amount public, so if the number of coins converted exceeded the intended currency supply, that would be detected. Worst case scenario, a hard fork could be arranged to disable the Sprout SNARK.

matthewdgreen 8y ago
The original Sprout SNARK has been disabled and replaced with a new implementation based on the powers of tao ceremony. You can still spend Sprout coins, but not with the old parameters.

deleted 8y ago

[deleted]