Thoughts on Zcash?

[TPTB_need_war]

I think Zcash introduces a new technology that can even be a subsitute for the bitcoin protocol

It requires a base coin in order to work. In this case the base coin is essentially a Bitcoin clone, so it is not a substitute for the Bitcoin protocol.

I think you mean distribution? After distribution all coins could be zerocoins.

? So what is the currency going to be Zcash or zerocoin?

Zcash is the new name for Zerocash (with some slight tweaks from the original Zerocash white paper but still overall the same design principles).

Zerocash's white paper had two types of coins in the system the regular non-anonymous basecoins and these can be minted into anonymous zerocoins.

Zerocoin (with capital Z) was an earlier design and white paper which was inferior to Zerocash. Not to be confused with the aforementioned zerocoins.

[TPTB_need_war]

https://www.reddit.com/r/Monero/comments/41vg68/monero_vs_zcash_eli5_fundamental_differences/cz63pqw

My point-by-point rebuttal to NobleSir:

https://www.reddit.com/r/ethtrader/comments/42rvm3/truth_about_ethereum_is_being_banned_at/czefpyb

We are waiting for a forthcoming blog post from Zcash for their perspective on this comparison.

[TPTB_need_war]

Again on why Zcash should be targeting corporate markets:

http://www.coindesk.com/blockstream-55-million-series-a

[AngusCanine]

I think Zcash introduces a new technology that can even be a subsitute for the bitcoin protocol

It requires a base coin in order to work. In this case the base coin is essentially a Bitcoin clone, so it is not a substitute for the Bitcoin protocol.

I think you mean distribution? After distribution all coins could be zerocoins.

? So what is the currency going to be Zcash or zerocoin?

Zcash is the new name for Zerocash (with some slight tweaks from the original Zerocash white paper but still overall the same design principles).

Zerocash's white paper had two types of coins in the system the regular non-anonymous basecoins and these can be minted into anonymous zerocoins.

Zerocoin (with capital Z) was an earlier design and white paper which was inferior to Zerocash. Not to be confused with the aforementioned zerocoins.

thank you for the enlightenment

[afbitcoins]

Also I remember hearing about an anonymisation technique in which you have to trust the person who generated the first block to destroy the private key without writing it down, otherwise they have the ability to decrypt the anonymisation forever after. Is this using that technique ? If so why trust they don't have the backdoor key handy ?

Your memory is only partially right. There is a potential problem with trusted setup. They have said they play to do this in some public ceremony with multiple parties so that unless ALL of those parties collude, the minting process is safe.

If all parties colluded they could print a unlimited number of coins undetected, however the privacy of transactions would not be affected. Essentially it is an economic threat of a poorly designed setup allowing parties to collude to print unlimited coins. There is not a privacy threat from collusion.

Good god that is like a million times worse. So they'd be able to 'print' unlimited quantity of money undetected ? And we trust that this inner circle present at the seeding ceremony are trustworthy !

    

[smooth]

Also I remember hearing about an anonymisation technique in which you have to trust the person who generated the first block to destroy the private key without writing it down, otherwise they have the ability to decrypt the anonymisation forever after. Is this using that technique ? If so why trust they don't have the backdoor key handy ?

Your memory is only partially right. There is a potential problem with trusted setup. They have said they play to do this in some public ceremony with multiple parties so that unless ALL of those parties collude, the minting process is safe.

If all parties colluded they could print a unlimited number of coins undetected, however the privacy of transactions would not be affected. Essentially it is an economic threat of a poorly designed setup allowing parties to collude to print unlimited coins. There is not a privacy threat from collusion.

Good god that is like a million times worse. So they'd be able to 'print' unlimited quantity of money undetected ? And we trust that this inner circle present at the seeding ceremony are trustworthy !

    

We don't know how the participants will be chosen, so perhaps best to wait and see before reaching conclusions.

[CoinHoarder]

Also I remember hearing about an anonymisation technique in which you have to trust the person who generated the first block to destroy the private key without writing it down, otherwise they have the ability to decrypt the anonymisation forever after. Is this using that technique ? If so why trust they don't have the backdoor key handy ?

Your memory is only partially right. There is a potential problem with trusted setup. They have said they play to do this in some public ceremony with multiple parties so that unless ALL of those parties collude, the minting process is safe.

If all parties colluded they could print a unlimited number of coins undetected, however the privacy of transactions would not be affected. Essentially it is an economic threat of a poorly designed setup allowing parties to collude to print unlimited coins. There is not a privacy threat from collusion.

Good god that is like a million times worse. So they'd be able to 'print' unlimited quantity of money undetected ? And we trust that this inner circle present at the seeding ceremony are trustworthy !

     

We don't know how the participants will be chosen, so perhaps best to wait and see before reaching conclusions.

They are using multi party computation, which is a transparent way to generate the starting seed. See my post up-thread.... there will be no "ceremony".

[smooth]

[dEBRUYNE]

Also I remember hearing about an anonymisation technique in which you have to trust the person who generated the first block to destroy the private key without writing it down, otherwise they have the ability to decrypt the anonymisation forever after. Is this using that technique ? If so why trust they don't have the backdoor key handy ?

Your memory is only partially right. There is a potential problem with trusted setup. They have said they play to do this in some public ceremony with multiple parties so that unless ALL of those parties collude, the minting process is safe.

If all parties colluded they could print a unlimited number of coins undetected, however the privacy of transactions would not be affected. Essentially it is an economic threat of a poorly designed setup allowing parties to collude to print unlimited coins. There is not a privacy threat from collusion.

Good god that is like a million times worse. So they'd be able to 'print' unlimited quantity of money undetected ? And we trust that this inner circle present at the seeding ceremony are trustworthy !

    

LucyLovesCrypto is right and describes the weaknesses, and potential threats of it perfectly. I also elaborated on it here -> https://forum.bitcoin.com/post16245.html#p16245

[paratox]

Also I remember hearing about an anonymisation technique in which you have to trust the person who generated the first block to destroy the private key without writing it down, otherwise they have the ability to decrypt the anonymisation forever after. Is this using that technique ? If so why trust they don't have the backdoor key handy ?

Your memory is only partially right. There is a potential problem with trusted setup. They have said they play to do this in some public ceremony with multiple parties so that unless ALL of those parties collude, the minting process is safe.

If all parties colluded they could print a unlimited number of coins undetected, however the privacy of transactions would not be affected. Essentially it is an economic threat of a poorly designed setup allowing parties to collude to print unlimited coins. There is not a privacy threat from collusion.

I think that will be the biggest problem. Why should anyone trust a few people(from a "for profit" company) to not profit if they have the possibility to do it without anyone noticing it?  Thats a no-brainer...

Who said there will only be a few people from the company at this ceremony? Maybe they are inviting mother teresa, ghandi, oprah, and pinnochio.

You are right, they didn't say that all the parties will be from their company. I shouldn't have made such a hasty comment.

[CoinHoarder]

Your memory is only partially right. There is a potential problem with trusted setup. They have said they play to do this in some public ceremony with multiple parties so that unless ALL of those parties collude, the minting process is safe.

If all parties colluded they could print a unlimited number of coins undetected, however the privacy of transactions would not be affected. Essentially it is an economic threat of a poorly designed setup allowing parties to collude to print unlimited coins. There is not a privacy threat from collusion.

Good god that is like a million times worse. So they'd be able to 'print' unlimited quantity of money undetected ? And we trust that this inner circle present at the seeding ceremony are trustworthy !

     

LucyLovesCrypto is right and describes the weaknesses, and potential threats of it perfectly. I also elaborated on it here -> https://forum.bitcoin.com/post16245.html#p16245

Umm... no he is not correct. They have already stated how they are going to generate the seed.

After a little research, they seem to have figured out a good way to do this using multi party computation. Using MPC to generate the seed was talked about in the original version of Zerocoin, and it seems like they will use their own version of it for Zerocash. If you look into the (now proven false rumors) that Anoncoin was going to implement Zerocoin there is a lot of discussion about MPC. The whitepaper for the MPC math they will use to generate the seed is written by the authors of the Zerocash whitepaper. https://forum.z.cash/t/trusted-setup-phase/68/2

Touche 

[TPTB_need_war]

Guys when you get past your vested interests which clouds your vision, then you'll eventually realize as I had already explained in excruciating detail, that Zcash is the only technology that can realistically give us (and more importantly corporations) privacy on public block chains due to the insoluble meta-data and overlapping rings anonymity unmasking issue for Cryptonote/RingCT (and any other mixing solution for anonymity such as CoinJoin/Dash, CoinShuffle, etc.).

The zerocoin mixer can be periodically reset, forcing all anonymous zerocoins to cash out periodically to basecoins which can be re-minted into the next instance of the zerocoin mixer. In this way, it can be proven that no zerocoins were created out-of-thin-air. All the anonymous mixing that occurs in the zerocoins can remain fully masked because the zerocoins balance can be merged before un-minting back to a basecoin.

So the problem is easily resolved. And the anonymity is not compromised even if the master private key was.

Corporations are going to generate their own masterkey in a consortium ceremony, so they will be in control of their destiny on this. Again I urge Zcash to focus on the corporate market.

[smooth]

The zerocoin mixer can be periodically reset, forcing all anonymous zerocoins to cash out periodically to basecoins which can be re-minted into the next instance of the zerocoin mixer. In this way, it can be proven that no zerocoins were created out-of-thin-air. All the anonymous mixing that occurs in the zerocoins can remain fully masked because the zerocoins balance can be merged before un-minting back to a basecoin.

So the problem is easily resolved. And the anonymity is not compromised even if the master private key was.

The process of resetting the mixer and forcing people to remint does compromise anonymity. If you were an adversary and wanted to spy on zerocash users, forcing such a reset (and then spying on them while redeeming and reminting) would be precisely one way you could go about doing it. This general pattern is a classic exploit method (e.g. force/trick user to reset password; intercept new password, etc.).

[CoinHoarder]

The zerocoin mixer can be periodically reset, forcing all anonymous zerocoins to cash out periodically to basecoins which can be re-minted into the next instance of the zerocoin mixer. In this way, it can be proven that no zerocoins were created out-of-thin-air. All the anonymous mixing that occurs in the zerocoins can remain fully masked because the zerocoins balance can be merged before un-minting back to a basecoin.

So the problem is easily resolved. And the anonymity is not compromised even if the master private key was.

The process of resetting the mixer and forcing people to remint does compromise anonymity. If you were an adversary and wanted to spy on zerocash users, forcing such a reset (and then spying on them while redeeming and reminting) would be precisely one way you could go about doing it. This general pattern is a classic exploit method (e.g. force/trick user to reset password; intercept new password, etc.).

I don't get how you can spy on someone if you don't know who owns what address. They could simply generate a new address for the reset and then send it straight back to the zerocoin layer, no?

This is actually the first time I've heard about it being able to be reset like that. I think that is a pro, not a con. It would give users the peace of mind that no one's printing money from time to time, even though everyone cab be fairly sure that they aren't since the seed will be generated using MPC transparently.

The only thing about this coin I'm not liking is the percentage of each block that goes to a corporation. I hope AnonyMint will free us from corporate tyranny? I guess if you are not implementing ZC technology then someone else will eventually fork it and cut the corporation out of the loop. However, network effects can grow quite fast...

[smooth]

The zerocoin mixer can be periodically reset, forcing all anonymous zerocoins to cash out periodically to basecoins which can be re-minted into the next instance of the zerocoin mixer. In this way, it can be proven that no zerocoins were created out-of-thin-air. All the anonymous mixing that occurs in the zerocoins can remain fully masked because the zerocoins balance can be merged before un-minting back to a basecoin.

So the problem is easily resolved. And the anonymity is not compromised even if the master private key was.

The process of resetting the mixer and forcing people to remint does compromise anonymity. If you were an adversary and wanted to spy on zerocash users, forcing such a reset (and then spying on them while redeeming and reminting) would be precisely one way you could go about doing it. This general pattern is a classic exploit method (e.g. force/trick user to reset password; intercept new password, etc.).

I don't get how you can spy on someone if you don't know who owns what address. They could simply generate a new address for the reset and then send it straight back to the zerocoin layer, no?

TPTB's premise is that IP addresses and other metadata are being spied on. You can't transact in basecoins, even just to move from one mixer to another, without encountering that exposure.

I don't agree with him that transacting in zerocash without worrying about your metadata exposure is of any real value, and neither does anyone else, but that's a different issue.

Also, TPTB operates under the premise that miners will be centralized and engage in 51% policy attacks. If they do that they can refuse to allow you to move your basecoins to the new mixer unless you identify yourself.

I agree with you that the possibility of moving to a reset coin has some potential value. It also has potential risks. The more times your have to perform the setup, the more opportunities there are for it to be compromised. Especially if it becomes routine and people get careless. Zcash has not said anything about planning to do these kinds of resets, as far as I've seen.

The above comments are in regard to a permisionless cryptocurrency ledgers, not permissioned blockchains.

[benthach]

i've reads get rich scam after scam in this altcoin section alone. these scammers give cryptocurrency a bad name.
their idea is pure repeat scam fuel by whales/hype. the people who keep losing money and keep them afloat to find new scam ideas are dumb people like you and your below/above posters hoping to get a piece of their many pies.

[CoinHoarder]

TPTB's premise is that IP addresses and other metadata are being spied on. You can't transact in basecoins, even just to move from one mixer to another, without encountering that exposure.

I don't agree with him that transacting in zerocash without worrying about your metadata exposure is of any real value, and neither does anyone else, but that's a different issue.

Also, TPTB operates under the premise that miners will be centralized and engage in 51% policy attacks. If they do that they can refuse to allow you to move your basecoins to the new mixer unless you identify yourself.

I agree with you that the possibility of moving to a reset coin has some potential value. It also has potential risks. The more times your have to perform the setup, the more opportunities there are for it to be compromised. Especially if it becomes routine and people get careless. Zcash has not said anything about planning to do these kinds of resets, as far as I've seen.

The above comments are in regard to a permisionless cryptocurrency ledgers, not permissioned blockchains.

Thanks... it is hard to know what TPTB has been talking about since he just says "read my thread". You summed it up nicely... I've been wondering what he has been talking about and too lazy/busy to read his long threads.

I am sure governments and/or government contractors and/or corporations are probably scraping metadata from Bitcoin (and possibly other cryptocurrencies.) I haven't done a ton of research on the subject like you guys, but I tend to agree with you that if you wanted to be as private/anonymous as possible, you would still need to try and obscure your metadata even while using Zcash. If the view key is ever compromised then so is your privacy, and it would also be necessary if they do a reset. I don't think this will be a huge issue for corporations though, because really we are talking about IP (or possibly computer hardware/software (or OS) versions) leaks... which they wouldn't really be too worried about I don't think. They are more worried about financial privacy than anonymity, so that their competition is kept in the dark.

If it is true that, with the Zcash view key, someone can see all transactions that ever occurred on that account, then I see this as a major blow to the functionality of Zcash. Perhaps there is still space for a technology like Monero with per-transaction view keys (and hopefully Monero will be combined with some type of CT implementation soon.) I can't imagine corporations wanting to open their books to anyone and everyone that they need to prove to that any certain transaction(s) occurred. I am still confused if the Zcash view key reveals all transactions for any certain account, or if can be done on a transaction-by-transaction basis.

[TPTB_need_war]

TPTB's premise is that IP addresses and other metadata are being spied on. You can't transact in basecoins, even just to move from one mixer to another, without encountering that exposure.

My point is (especially for corporations) all their proprietary data privacy is done in zerocoins and then balances combined into basecoins to cash out of the mixer, which doesn't reveal anything but the agggregate value of the private data that is in the zerocoins. That is a distinct and epic advantage over Cryptonote/RingCT.

smooth, I don't understand why you are being irrational and wasting your time down a dead-end. Surely there are more valuable and more productive things for you to work on than continue with what will eventually fail and have to be abandoned. It is very perplexing to me. You say you are hedged/diversified, so I don't understand the religious behavior.

Sometimes we need to slay our malformed babies in order to give way for planting our seed again. I took the axe to the desks w.r.t. to my WordUp software when Atari's Tramiel decided to buy Federated Dept Stores and focus on making calculators instead of competing with Apple and Windows! That was a wise move as my LinkedIn career history shows.

I don't agree with him that transacting in zerocash without worrying about your metadata exposure is of any real value, and neither does anyone else, but that's a different issue.

I think I already explained how the issue (especially for corporations) is much more compelling. So far, I have seen no rebuttal to the specifics I explained w.r.t. to corporate use. I am still awaiting Zcash's promised blog post comparing their technology to Cryptonote/RingCT.

Appeal to authority is useless. Open source your reasons.

Also, TPTB operates under the premise that miners will be centralized and engage in 51% policy attacks. If they do that they can refuse to allow you to move your basecoins to the new mixer unless you identify yourself.

What I believe about mining is irrelevant to this issue (although I do believe it is possible to decentralize PoW control while centralizing verification for scaling, thus to get best of both), because I am asserting the big market for privacy is not from hiding from the government (which I pointed out to you many times can charge the cost of 51% attack to society as China apparently has done to Bitcoin! and thus different game theory economics than a miner that needs to be profitable) and a viewkey should be provided to the government so they don't need to block your transactions (which applies to every anonymous coin). So the point is that Zcash will provide provable privacy against everyone except the government (whereas Monero/CN/RingCT/CoinJoin/CoinShuffle/Dash/ShadowCash will not).

Note I have not forgotten my past point that the government can't necessarily keep secrets we are forced to give them, because they have employees which may not always be loyal, e.g. Edward Snowden. Thus again I see block chain privacy as more useful for corporations which can negotiate with the government to provide controlled access and not a viewkey to all transactions. We individuals can't negotiate with the totalitarianism that society will go through over the next decade or two.

I agree with you that the possibility of moving to a reset coin has some potential value. It also has potential risks. The more times your have to perform the setup, the more opportunities there are for it to be compromised. Especially if it becomes routine and people get careless. Zcash has not said anything about planning to do these kinds of resets, as far as I've seen.

Again if the corporations who want to use it all participate in the multi-party setup, they would have to collude to cheat themselves, which doesn't make any sense.

P.S. You might look into the timing side-channel attacks issue as a potential point of comparison to bring Zcash back down to similar level of anonymity reliability as RingCT (but I doubt it):

https://github.com/Electric-Coin-Company/zcash/issues/5

[smooth]

TPTB's premise is that IP addresses and other metadata are being spied on. You can't transact in basecoins, even just to move from one mixer to another, without encountering that exposure.

My point is (especially for corporations) all their proprietary data privacy is done in zerocoins and then balances combined into basecoins to cash out of the mixer, which doesn't reveal anything but the agggregate value of the private data that is in the zerocoins. That is a distinct and epic advantage over Cryptonote/RingCT.

Now you're on to this corporate blockchain thing which is probably okay if you are looking for a short term payoff (but you better hurry, as that iron is hot right now).

However, it is largely irrelevant to the question of decentralized cryptocurrency and certainly to Zcash, the cryptocurrency that is being launched (though maybe not the company launching it, as they could potentially get some business building blockchain applications for businesses, as Blockstream an others seem to be doing).

As for you giving me career and financial advice, I'll not comment beyond this non-comment comment.

Anyway, if you want to build other applications based on the technology behind Zcash (the OP asked this), you can ignore Zcash (which is otherwise a rather uninteresting Bitcoin fork) and focus on libsnark.

[TPTB_need_war]

TPTB's premise is that IP addresses and other metadata are being spied on. You can't transact in basecoins, even just to move from one mixer to another, without encountering that exposure.

My point is (especially for corporations) all their proprietary data privacy is done in zerocoins and then balances combined into basecoins to cash out of the mixer, which doesn't reveal anything but the agggregate value of the private data that is in the zerocoins. That is a distinct and epic advantage over Cryptonote/RingCT.

Now you're on to this corporate blockchain thing which is probably okay if you are looking for a short term payoff (but you better hurry, as that iron is hot right now).

However, it is largely irrelevant to the question of decentralized cryptocurrency and certainly to Zcash, the cryptocurrency that is being launched (though maybe not the company launching it, as they could potentially get some business building blockchain applications for businesses, as Blockstream an others seem to be doing).

Yeah exactly what I am thinking. They should realize who will butter their bread and it won't be us unless they understand the speculator market which they seem to not understand based on the 11% "premine". Frankly, if they were very astute, they'd do both and move their investor's investment to the corporation and copy/partner with Blockstream, and then launch a fair mined or ICO Zcash to our speculator markets.

As for longer-term user-level privacy markets (after the 2017 - 2032 totalitarianism that will fuck up everything first), that is much too far out for me to work on (I will be age ~70 by then). I've instead chosen to work in the area of combining crypto currency with social networking and go for large scale user adoption which my historic forte.

I wouldn't be a good asset for Zcash, because although I could bring some more pragmatic marketing and business acumen to those math/hacker nerds, and I think I may have better block chain tech than Blockstream (at least for the moment afaik and in some facets), Blockstream has the inertia/reputation with the corporates. So Zcash should go that direction (and Maxwell, Poelstra, Shen-noether have been very condescending to me). Maybe one day in future I can afford to hire a cryptographer who understands zk-snarks fully.  I am getting too old to go back to school to study more math courses (I was getting back into it in my mid-40s when my daughter started to show acumen for math, but then suddenly I got so ill  and my ex yanked my kids from me any way). I have to make my major career move and try to make my big impact on society now with the skills I have. And my greatest forte is in combining programming, marketing, and user interface design.

When you see the names and concepts I have and am implementing, I am confident there will be many here who realize they made an entirely inaccurate appraisal of my capabilities.

As for you giving me career and financial advice, I'll not comment beyond this non-comment comment.

Apologies (for public statement) I just don't understand and thus it comes across to me as stubbornness or myopia. I guess you are doing it for the love of having your own project, not for any other rational reason. If you want to tell me in private, I can make a promise not to use it against you. If not, fine.

I mean I know (according to you) your opportunity cost. Perhaps one of the differences is afaik you've worked in finance (presumably closed away from the end users) so this is breath of fresh air for you to work with a wider community. Whereas my entire career I was B2C focused and thus always got stroked by the end users.

But you see I want 10 million end users, not just a 100 - 1000 speculators. And I want them to talk about the features they want and love, not about exchanges, shorting, etc..

Different interests perhaps...

Anyway, if you[readers, not TPTB necessarily] want to build other applications based on the technology behind Zcash (the OP asked this), you can ignore Zcash (which is otherwise a rather uninteresting Bitcoin fork) and focus on libsnark.

Yep.

Edit: but there is no way your Aeon nor Monero can achieve the user adoption level I will achieve. Not even within orders-of-magnitude. So as for applying zk-snarks to the user markets, the one with more marketshare will be in the driver's seat. Open source is not typically a product. Those who market products (e.g. Android which is Linux) are in the driver's seat.

Edit#2 (after some hours of sleep): one retort to my prior edit is that there will be products built on top of Monero/Aeon (and perhaps Cryptonote/RingCT coins in general including BBR) such as perhaps (if someone markets a end user product employing) the OpenBaazar fork which drive popular adoption. The fundamental chicken-and-the-egg dilemma of currency is that until the masses have the currency, they can't spend the currency. And if you just airdrop them currency, then they just dump it to speculators if there is no ecosystem that incentivizes them to use the currency as a recycling unit-of-exchange. This is one reason I encouraged the OpenBaazar fork to be currency agnostic even while adding XMR support. Because it is unpredictable which crypto currency will attain a widespread ecosystem. Even Bitcoin is not used by females and general demographics and is rather a young white male Libertarian technonerd demographic. To attain these economies-of-scale and ecosystem across all demographics requires an ecosystem that interests all those demographics. Given what I know about those who are creating altcoins, afaics none of them have the experience and focus to achieve a widespread demographics ecosystem.