http://spar.isi.jhu.edu/~mgreen/ZerocoinOakland.pdf http://spar.isi.jhu.edu/~mgreen/ZerocoinOakland.pdf, which is the fundamental piece of new cryptography whic

http://spar.isi.jhu.edu/~mgreen/ZerocoinOakland.pdf http://spar.isi.jhu.edu/~mgreen/ZerocoinOakland.pdf, which is the fundamental piece of new cryptography which enables it to work, doesn't make any sense to me. At the very least, the authors have made the formulation so unclear that you could start to suspect the authors were deliberately trying to obfuscate it. They define a function ZKSoK(c, w, r), and it would make sense not to use c, w, and r to mean anything else in the short definition of the construction. However, the authors chose to also use c for the hash used to make it non-interactive, and r_i for a series of random numbers. Using the same variable name for two different things makes it hard to work out what they mean, but as far as I can tell, the c that is the function parameter is public knowledge, w can be computed from public information, and ZKSoK does actually depend on the r that is the function parameter, and the validation of the proof does not actually check that S is correct (c is computed as c <- g^S * h^r mod p, but it is useless if you can spend a zerocoin using any arbitrary S that doesn't actually correspond to any real c) as it claims. In the 15 page version, they claim that the proof of the soundness of the ZKSoK proof can be found in "the full version of this paper" - perhaps that text makes things clearer, but they don't seem to provide a reference to it.