<story><title>Zerocash: Decentralized Anonymous Payments from Bitcoin [pdf]</title><url>http://zerocash-project.org/media/pdf/zerocash-extended-20140518.pdf</url></story><parent_chain></parent_chain><comment><author>nullc</author><text>It&amp;#x27;s a little disappointing to see how much ZeroCash is hyped compared to Bytecoin (&lt;a href=&quot;https://bytecoin.org/&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;bytecoin.org&amp;#x2F;&lt;/a&gt;), since the former is still vaporware while the latter is something real that you can go use right now.&lt;p&gt;While the CRS ZK-SNARK stuff used for ZeroCash is very exciting technology, the cryptographic assumptions are very new and kinda sketchy. The fact that there is a trusted initialization is unfortunate, especially since compromise of the initialization results in unbounded and undetectable inflation (well I suppose you can detect it once a single altruist ends up with more coins than ought to exist!). ... though it has implications which go far beyond transaction anonymity.&lt;p&gt;The Bytecoin approach is based on much simpler cryptography— a schnorr ring signature in the curve25519 group. The anonymity it provides is theoretically more limited— sort of like a CoinJoin where even ofline people or even already spent coins can be joined with you—, but because it doesn&amp;#x27;t required gigabytes of signing keys or tens of seconds of computation to sign it might be more anonymous in practice just due to being easier to use. (Oh yea, and did I mention, it&amp;#x27;s already in use so at the moment it&amp;#x27;s infinitely more private! :) )&lt;p&gt;So far all of these anonymous systems have a number of interesting limitations in common. For example, none of them support any kind of pruning so a verifying node has state that grows forever— as compared to Bitcoin where if you&amp;#x27;re just verifying new blocks (as opposed to helping initialize new peers) you can forget the old state... e.g. right now a Bitcoin full verifier technically only needs about 300MBytes of storage.  So this privacy stuff comes at a rather extreme cost. I&amp;#x27;ve suggested some ways to improve this (basically expiring old coins), but they reduce the anonymity set and have some usability tradeoffs.&lt;p&gt;In any case, it&amp;#x27;s certantly better to see things like ZeroCash and Bytecoin being worked on... I&amp;#x27;m really skeptical about the wisdom of splitting up the crypto-currency adoption network effect just to introduce some new transaction features. But certantly doing it with substantive new features is way better than just-another-worthless-clone. ... especially when there is running code and not merely a whitepaper. :)</text></comment>
<story><title>Zerocash: Decentralized Anonymous Payments from Bitcoin [pdf]</title><url>http://zerocash-project.org/media/pdf/zerocash-extended-20140518.pdf</url></story><parent_chain></parent_chain><comment><author>rdl</author><text>This is, for me, the single most interesting thing in the Bitcoin&amp;#x2F;Blockchain world.&lt;p&gt;I love the idea of Cryptocurrencies in general (and got interested in computers, cryptography, security, and cypherpunks around the same time in ~1992), but without something which makes every transaction unlinkable, and thus preserves fungibility of the currency, I find things like Bitcoin a step back from Chaumian blinded tokens.  There&amp;#x27;s the potential for coin validation in regular bitcoin, and once there&amp;#x27;s technical potential, it can become mandated.  Once that happens, even if it starts for something &amp;quot;nice&amp;quot; like preventing large thefts, it can turn into censorship.&lt;p&gt;&lt;i&gt;With&lt;/i&gt; zerocash, I could see blockchain-based anonymous systems coexisting for low-throughput, high-persistence systems mainly going to blockchain tech, and high-throughput, non-inherent-decentralized systems doing their own Chaumian blinded token currencies.  And &amp;quot;currencies&amp;quot; not just being used for human payments, but lots of forms of resource allocation.</text></comment>