4 ms·

I disagree that these are disqualifying, and also disagree Monero is a better alternative, but you missed one big one I do find worrying about zcash: there's no

I disagree that these are disqualifying, and also disagree Monero is a better alternative, but you missed one big one I do find worrying about zcash: there's no way to verify supply. Not only do you have to trust the trusted setup, but if the cryptography is broken it will be very difficult to find out there's no way to verify that coins are not being created from this air.

john_alan 6y ago
> and also disagree Monero is a better alternative It's empirically better. Monero uses zero-knowledge proofs for the range proof, cryptographically protects the sender, receiver and notional. Monero uses known, audited cryptographic primitives, elliptic curve Diffie-Hellman over curve25519, EdDSA signature over the twisted Edwards variant of the same curve, libsodium. Monero is much less likely to have a production exploit than zcash. Are you saying if you needed to send money privately you'd actually choose Zcash over Monero?
- Ar-Curunir 6y ago
  > Monero uses known, audited cryptographic primitives, elliptic curve Diffie-Hellman over curve25519, EdDSA signature over the twisted Edwards variant of the same curve, libsodium. The cryptographic primitives in zcash are also audited. It's also the case that the cryptography underlying the next generation of zkSNARKs (which will be used by zcash) is the same as what Monero uses for range proofs; it's trustless (or low trust). > Monero uses zero-knowledge proofs for the range proof, cryptographically protects the sender, receiver and notional. Again, this is an over-simplification; the anonymity set is smaller, and moreover more difficult to analyze.
- gtrhtrhtrhtr 6y ago
  Monero is cool, but it has fundamental flaws: its anonymity set. And ring signatures is not standard crypto at all. Less complexity than zk-SNARKs for sure, but there's a trade off in confidentiality.
ianmiers 6y ago
Auditing the supply would mean transaction amounts were public. That kills privacy. Theres a reason exactly none of the privacy coins, including Zcash, Grin, Beam, Monero and Mobilecoin do it. Hiding transaction values is table stakes for getting privacy right. (but not nearly enough. see https://slideslive.com/38911785/satoshi-has-no-clothes-failures-in-onchain-privacy https://slideslive.com/38911785/satoshi-has-no-clothes-failu... and https://www.monerooutreach.org/breaking-monero/poisoned-outputs.html https://www.monerooutreach.org/breaking-monero/poisoned-outp...)

john_alan 6y ago

> and also disagree Monero is a better alternative It's empirically better. Monero uses zero-knowledge proofs for the range proof, cryptographically protects the sender, receiver and notional. Monero uses known, audited cryptographic primitives, elliptic curve Diffie-Hellman over curve25519, EdDSA signature over the twisted Edwards variant of the same curve, libsodium. Monero is much less likely to have a production exploit than zcash. Are you saying if you needed to send money privately you'd actually choose Zcash over Monero?

Ar-Curunir 6y ago
> Monero uses known, audited cryptographic primitives, elliptic curve Diffie-Hellman over curve25519, EdDSA signature over the twisted Edwards variant of the same curve, libsodium. The cryptographic primitives in zcash are also audited. It's also the case that the cryptography underlying the next generation of zkSNARKs (which will be used by zcash) is the same as what Monero uses for range proofs; it's trustless (or low trust). > Monero uses zero-knowledge proofs for the range proof, cryptographically protects the sender, receiver and notional. Again, this is an over-simplification; the anonymity set is smaller, and moreover more difficult to analyze.
gtrhtrhtrhtr 6y ago
Monero is cool, but it has fundamental flaws: its anonymity set. And ring signatures is not standard crypto at all. Less complexity than zk-SNARKs for sure, but there's a trade off in confidentiality.

ianmiers 6y ago

Auditing the supply would mean transaction amounts were public. That kills privacy. Theres a reason exactly none of the privacy coins, including Zcash, Grin, Beam, Monero and Mobilecoin do it. Hiding transaction values is table stakes for getting privacy right. (but not nearly enough. see https://slideslive.com/38911785/satoshi-has-no-clothes-failures-in-onchain-privacy https://slideslive.com/38911785/satoshi-has-no-clothes-failu... and https://www.monerooutreach.org/breaking-monero/poisoned-outputs.html https://www.monerooutreach.org/breaking-monero/poisoned-outp...)