ZeroCash: 2nd gen with anonymization starting from the coinbase transaction

[tacotime]

Not a lot is known about this, as M. Green has been keeping very quiet.  The most I know is from these slides.

The transcript from the presentation is here: http://pastebin.com/raw.php?i=q3rgh5ZY

Fun facts:
- ZRC uses Succinct Non-interactive ARguments of Knowledge (SNARKs) for proofs, which are only 288 bytes in size for 128-bits of security
- Tradeoff is the time it takes to generate proofs for splits/merges (measured in minutes)
- Verification of proofs in milliseconds
- Release date: May 2014

[1714119617]

1714119617

[1714119617]

1714119617

[MsCollec]

I checked their website and this was posted 'We will be updating this site soon to include details of our new version described by Matt Green at Real World Crypto 2014".

[Ganefull]

looking forward to this coin!

[vtbean79]

Looks interesting.

[apetersson]

i'd really like to know more since i am preparing a talk on this general topic. the video is now set to "private" on youtube.

[dewdeded]

Subbed.

[chuxiongtq]

very looking forward to this coin !!

[tacotime]

i'd really like to know more since i am preparing a talk on this general topic. the video is now set to "private" on youtube.

It's because the publication of the paper is forthcoming and the source code is proprietary.

http://www.scipr-lab.org/pub

(if it comes back online)

[sniveling]

Judging by the success of darkcoin we will see more anonymity features in new coins.

[Lethn]

I like coins that focus on anonymity for sure, I think it will be something like this that could possibly overtake Bitcoin because Bitcoin definitely isn't anonymous.

[tacotime]

Judging by the success of darkcoin we will see more anonymity features in new coins.

DarkCoin's CoinJoin is more a privacy feature, not true anonymity as provided by the use of ZKPs.

[blajde]

Judging by the success of darkcoin we will see more anonymity features in new coins.

DarkCoin's CoinJoin is more a privacy feature, not true anonymity as provided by the use of ZKPs.

Just wait for Darksend

[pennywise]

I'm also one of those who can't wait for zerocash.

I expect massive adoption by sites like silk road 2.0 and such. I expect several states declaring it illegal. And of course I expect its value to heavily rise in the middle of war with governments and other negative-hype-raising events.

It'll be grand, my friends.

[tacotime]

I'm also one of those who can't wait for zerocash.

I expect massive adoption by sites like silk road 2.0 and such. I expect several states declaring it illegal. And of course I expect its value to heavily rise in the middle of war with governments and other negative-hype-raising events.

It'll be grand, my friends.

In the video Dr. Green urged everyone to be cautious about the adoption of the currency -- there's one pitfall if I understand correctly, and that is that since everything is obscured (even the generation of new coins via block subsidy), you can't observe actual inflation in the currency (just try to predict it based on the programming of the source code).  That is, if there were a bug and someone were to generate 2 billion coins (as what happened with Bitcoin), there's no real way to observe that.

[mamamia2014]

It seems it is really something new!
Can u help introduce more on this project?
Or where can I get more info?

Very interested!

[ljp7839008]

need more info

[tacotime]

It seems it is really something new!
Can u help introduce more on this project?
Or where can I get more info?

Very interested!

You'll have to attend the Oakland symposium.

Zerocash: Decentralized Anonymous Payments from Bitcoin   (to appear)
Eli Ben-Sasson, Alessandro Chiesa, Christina Garman, Matthew Green, Ian Miers, Eran Tromer, and Madars Virza
2014 IEEE Symposium on Security & Privacy (Oakland 2014)

http://www.ieee-security.org/TC/SP2014/

[iddo]

FYI there's a newer ZeroCash talk by Eli Ben-Sasson at:
https://www.youtube.com/watch?v=l7LSSE0bRRo
Note: I personally neither approve nor disapprove of anything said there.

[dewdeded]

ZeroCash ETA?

[dewdeded]

0,9 GB Public Key? WAAAAAT?

[ymer]

0,9 GB Public Key? WAAAAAT?

"Set up by a trusted party"

"Propietary source code"

-Jews made it

[lingyong1992]

Can you explain it more clearly?
I just want to know more about it .
Maybe it is a good coin.

[duola9527]

good idea! we need more info.

[ymer]

Can you explain it more clearly?
I just want to know more about it .
Maybe it is a good coin.

https://www.youtube.com/watch?v=l7LSSE0bRRo

He says that it's better than other previous ideas that required a centralized bank to anonymize and mint coins... then he says that his coin needs a "trusted party" to generate public keys and that it's not open source.

scam Jewcoin

[gooby]

It seems it is really something new!
Can u help introduce more on this project?
Or where can I get more info?

Very interested!

[lingyong1992]

Can you explain it more clearly?
I just want to know more about it .
Maybe it is a good coin.

https://www.youtube.com/watch?v=l7LSSE0bRRo

He says that it's better than other previous ideas that required a centralized bank to anonymize and mint coins... then he says that his coin needs a "trusted party" to generate public keys and that it's not open source.

scam Jewcoin

What the meaning of "trusted party" .
I think the trusted party is a centralized bank.

[ymer]

Can you explain it more clearly?
I just want to know more about it .
Maybe it is a good coin.

https://www.youtube.com/watch?v=l7LSSE0bRRo

He says that it's better than other previous ideas that required a centralized bank to anonymize and mint coins... then he says that his coin needs a "trusted party" to generate public keys and that it's not open source.

scam Jewcoin

What the meaning of "trusted party" .
I think the trusted party is a centralized bank.

Trusted party is someone that isn't you (or your ZeroCoin client), and since the project is not open source then you will have to trust your key to whoever this guy decides these "trusted parties" are going to be.

This is a centralized coin in disguise.

[lingyong1992]

Can you explain it more clearly?
I just want to know more about it .
Maybe it is a good coin.

https://www.youtube.com/watch?v=l7LSSE0bRRo

He says that it's better than other previous ideas that required a centralized bank to anonymize and mint coins... then he says that his coin needs a "trusted party" to generate public keys and that it's not open source.

scam Jewcoin

What the meaning of "trusted party" .
I think the trusted party is a centralized bank.

Trusted party is someone that isn't you (or your ZeroCoin client), and since the project is not open source then you will have to trust your key to whoever this guy decides these "trusted parties" are going to be.

This is a centralized coin in disguise.

Why it don't open the source?

[ymer]

Can you explain it more clearly?
I just want to know more about it .
Maybe it is a good coin.

https://www.youtube.com/watch?v=l7LSSE0bRRo

He says that it's better than other previous ideas that required a centralized bank to anonymize and mint coins... then he says that his coin needs a "trusted party" to generate public keys and that it's not open source.

scam Jewcoin

What the meaning of "trusted party" .
I think the trusted party is a centralized bank.

Trusted party is someone that isn't you (or your ZeroCoin client), and since the project is not open source then you will have to trust your key to whoever this guy decides these "trusted parties" are going to be.

This is a centralized coin in disguise.

Why it don't open the source?

Because they want to control it, but they market it as anonymous and decentralized to attract people to it.

[nakaone]

I think some of the core developers of bitcoin in the xcp thread already told that this is at most half true

[lingyong1992]

Can you explain it more clearly?
I just want to know more about it .
Maybe it is a good coin.

https://www.youtube.com/watch?v=l7LSSE0bRRo

He says that it's better than other previous ideas that required a centralized bank to anonymize and mint coins... then he says that his coin needs a "trusted party" to generate public keys and that it's not open source.

scam Jewcoin

What the meaning of "trusted party" .
I think the trusted party is a centralized bank.

Trusted party is someone that isn't you (or your ZeroCoin client), and since the project is not open source then you will have to trust your key to whoever this guy decides these "trusted parties" are going to be.

This is a centralized coin in disguise.

Why it don't open the source?

Because they want to control it, but they market it as anonymous and decentralized to attract people to it.

hahah.....
I see....

[digicoin]

Any update?

[illodin]

Any update?

Hopefully in 2015.

[softron]

Look intresting, ill follow this coin on launch

[AnonyMint]

I'm also one of those who can't wait for zerocash.

I expect massive adoption by sites like silk road 2.0 and such. I expect several states declaring it illegal. And of course I expect its value to heavily rise in the middle of war with governments and other negative-hype-raising events.

It'll be grand, my friends.

In the video Dr. Green urged everyone to be cautious about the adoption of the currency -- there's one pitfall if I understand correctly, and that is that since everything is obscured (even the generation of new coins via block subsidy), you can't observe actual inflation in the currency (just try to predict it based on the programming of the source code).  That is, if there were a bug and someone were to generate 2 billion coins (as what happened with Bitcoin), there's no real way to observe that.

Worse than that, if the creator of the master configuration parameters for Zerocash wants he can create unlimited coins and no one will ever know.

This was also true with Zerocoin, except that the counterfeit coins would need to be less than the mints minus spends.

Creating the master key in a ceremony doesn't guarantee the computer isn't backdoored or someone isn't using technology to sniff over the air-gap. And no one will ever know if it was intercepted or not. It is impossible to know the money supply.

Worse yet, 9ms verification is still way too slow to scale to any reasonable number of transactions per block, unless we only allow server farms to be full nodes (well Bitcoin is headed that way any way with one pool controlling more than 50% of the mining hash rate now).

This iteration will never be in a widely adopted serious coin.

They need more years to improve it and for cryptanalysis to vet it. Can you imagine putting this new crypto in a coin then later it is broken and chaos reigns.

Exciting development, but nothing for us to use any time soon.

Actually the original Zerocoin is superior but for a different application.

P.S. Just wait until DarkCoin's CoinJoin is denial-of-service attacked (if necessary I will do it to prove it is vulnerable, will wait until it becomes more popular then bet short on it and DOS-attack it). Tried to tell them that, but they didn't want to listen. Oh well. CoinJoin can't be protected against this because it is a two-step process (not atomic). Go read my debate with gmaxwell in the CoinJoin thread. Blacklisting input addresses is futile.

[illodin]

Creating the master key in a ceremony doesn't guarantee the computer isn't backdoored or someone isn't using technology to sniff over the air-gap. And no one will ever know if it was intercepted or not. It is impossible to know the money supply.

I suggest we trust this in the hands of Chris Angel.

P.S. Just wait until DarkCoin's CoinJoin is denial-of-service attacked (if necessary I will do it to prove it is vulnerable, will wait until it becomes more popular then bet short on it and DOS-attack it). Tried to tell them that, but they didn't want to listen. Oh well. CoinJoin can't be protected against this because it is a two-step process (not atomic). Go read my debate with gmaxwell in the CoinJoin thread. Blacklisting input addresses is futile.

iirc drk dev asked you to exploit it in the test net setting but you disappeared. 
It's possible I remember wrong though.

[AnonyMint]

P.S. Just wait until DarkCoin's CoinJoin is denial-of-service attacked (if necessary I will do it to prove it is vulnerable, will wait until it becomes more popular then bet short on it and DOS-attack it). Tried to tell them that, but they didn't want to listen. Oh well. CoinJoin can't be protected against this because it is a two-step process (not atomic). Go read my debate with gmaxwell in the CoinJoin thread. Blacklisting input addresses is futile.

iirc drk dev asked you to exploit it in the test net setting but you disappeared.  
It's possible I remember wrong though.

They never PM'ed me as I requested. I don't spend my time monitoring that DK thread that has several pages per day of new posts.

Did they attempt to do anything to deal with DOS-attacks? The problem is that if you blacklist the input address, someone can just go create another input address (even passing through another instance of the mixer). If they are sharing a single blacklist coin-wide, then it is not a decentralized coin (i.e. some pools could lie and cause addresses to become unspendable). Etc, etc, etc.

Nothing in their whitepaper about DOS protection:

http://darkcoin.io/downloads/DarkcoinWhitepaper.pdf

[illodin]

Did they attempt to do anything to deal with DOS-attacks? The problem is that if you blacklist the input address, someone can just go create another input address (even passing through another instance of the mixer). If they are sharing a single blacklist coin-wide, then it is not a decentralized coin (i.e. some pools could lie and cause addresses to become unspendable). Etc, etc, etc.

A cost of 0.1 DRK was added that is not returned but distributed to the miners if the client misbehaves, so organizing a dos could become a costly endeavor. Again, possible I got it wrong. Someone else please verify.

[AnonyMint]

Did they attempt to do anything to deal with DOS-attacks? The problem is that if you blacklist the input address, someone can just go create another input address (even passing through another instance of the mixer). If they are sharing a single blacklist coin-wide, then it is not a decentralized coin (i.e. some pools could lie and cause addresses to become unspendable). Etc, etc, etc.

A cost of 0.1 DRK was added that is not returned but distributed to the miners if the client misbehaves, so organizing a dos could become a costly endeavor. Again, possible I got it wrong. Someone else please verify.

I just replied on that point:

https://bitcointalk.org/index.php?topic=421615.msg6000702#msg6000702

I am thinking DOS can still occur free-of-charge in the signing of the outputs.

[hashnine]

scam Jewcoin

NO GRACIAS JEW.

"Set up by a trusted party"

"Propietary source code"

-Jews made it

Why nobody ban this anti-semite guy?

[ymer]

scam Jewcoin

NO GRACIAS JEW.

"Set up by a trusted party"

"Propietary source code"

-Jews made it

Why nobody ban this anti-semite guy?

It's a scam coin made by a jew, what's antisemite about pointing it out?

[AnonyMint]

Developer of Darkcoin has confirmed my suspicions:

https://bitcointalk.org/index.php?topic=421615.msg6004394#msg6004394

[AnonyMint]

More explanation of Zerocash:

https://www.youtube.com/watch?v=FXU65XsLiFk#t=605

This is how I figured it worked. In fact, I had recently figured out that Pinnochio could be used with hashes and a hash accumulator. So they implemented it.

[MatthewLM]

This will apparently be made open-source at some future date, "when it's ready". It wont be proprietary. Not, at least, according to this video: https://www.youtube.com/watch?v=l7LSSE0bRRo

The main problem is the trustability of the keys. Maybe they could figure out a way to make the keys trustless.

[bigc1984]

Can you explain it more clearly?
I just want to know more about it .
Maybe it is a good coin.

https://www.youtube.com/watch?v=l7LSSE0bRRo

He says that it's better than other previous ideas that required a centralized bank to anonymize and mint coins... then he says that his coin needs a "trusted party" to generate public keys and that it's not open source.

scam Jewcoin

What the meaning of "trusted party" .
I think the trusted party is a centralized bank.

Trusted party is someone that isn't you (or your ZeroCoin client), and since the project is not open source then you will have to trust your key to whoever this guy decides these "trusted parties" are going to be.

This is a centralized coin in disguise.

Yea this coin is garbs.

[linko]

We'll be presenting our Zerocash paper on Tuesday at the IEEE S&P (Oakland) conference in San Jose. Full paper & website up next week.

https://twitter.com/matthew_d_green/status/465963763028340736

[shaul]

The website for Zerocash is up:
http://zerocash-project.org/

There are two versions of the paper:
Presentation version:
http://zerocash-project.org/media/pdf/zerocash-oakland2014.pdf

Extended version:
http://zerocash-project.org/media/pdf/zerocash-extended-20140518.pdf

[lunokhod2]

The website for Zerocash is up:
http://zerocash-project.org/

There are two versions of the paper:
Presentation version:
http://zerocash-project.org/media/pdf/zerocash-oakland2014.pdf

Extended version:
http://zerocash-project.org/media/pdf/zerocash-extended-20140518.pdf

Now that the paper is published, I am curious if someone could answer a question about the setup of the initial zerocash parameters and trusted third parties.

Concerning the original zerocoin paper (which is supposed to be implemented in Anoncoin), it has been noted that the initial setup could be done using RSA-UFOs, without trusted third parties. Before the zerocash paper came out, the Anoncoin developers claimed that this could not be done with zerocash. Is this still true? Given the similarity in the original zerocoin and zerocash approaches, it is not immediately obvious why this would be the case.

[zzojar]

Can we get a little more succinct info that summarizes that dude's extensive diatribe?

[xfr]

Basically it's a clone of Pinocchio
The zkSNARKs sound fancy but no real improvement over the previous EC pairing commitments

[bullgates]

Interesting

[JimPeopleburger]

I'm watching

[c4p0ne]

By not opening up the source, these guys are gonna fuck up bigtime. I believe there is in fact a level of control they're intending on exercising over ZeroCash that is unwholesome and repellant to adoption. They need to open it up *immediately* upon release. The code needs to be scrutinized heavily by a community of tens of thousands if it's ever going to get any traction at all. Forget about opening it up at "some later time when it's ready". You see, by "ready", they mean when it's already gained sufficient enough usage as to decrease the chances of adoption of a superior implementation using their algos.

Sneaky, sneaky, sneaky and it's gonna bite them in the fucking cock if they proceed in that greedy, counterproductive manner.

[MyPotPlantDied]

I have been waiting for this coin to come out for what seems like ages but recently I heard a rumour that since the developers are all well known, they might be scared off by the US govt. Obviously the powers that be would not want something like this coming out.

Same goes for Dark Wallet - I heard their web site was taken down for a while due to their involvement with encryption and privacy. It's back now but don't forget what happened to Lavabit and Truecrypt. There are forces actively working against anything involving encryption and privacy.

I do hope we hear more about what's going on with Zerocash soon!

[mrcashking]

I can't wait until this is released. I think it will be released in January 2015. Just a guess.

[coins101]

Watching and waiting for launch.

This is going to be one of the more notable coins to come out.

The BitLicences uncertainty will be an issue for the developers. They have connections outside the USA, so I would recommend they launch outside US borders.

[Patel]

Watching and waiting for launch.

This is going to be one of the more notable coins to come out.

The BitLicences uncertainty will be an issue for the developers. They have connections outside the USA, so I would recommend they launch outside US borders.

Is Zerocash still being developed?

[tacotime]

Is Zerocash still being developed?

I assume that Green's lab is working on it. This is academia, everything takes a year or two longer than people think it will.

[coins101]

well, they recently added a new url:

zca.sh

[Djinou94]

zero dead

[smoothie]

still not released?

[BearBonds]

check out https://bitcointalk.org/index.php?topic=423348