<story><title>Zerocoin: making Bitcoin anonymous</title><url>http://blog.cryptographyengineering.com/2013/04/zerocoin-making-bitcoin-anonymous.html</url></story><parent_chain></parent_chain><comment><author>A1kmm</author><text>&lt;a href=&quot;http://spar.isi.jhu.edu/~mgreen/ZerocoinOakland.pdf&quot; rel=&quot;nofollow&quot;&gt;http://spar.isi.jhu.edu/~mgreen/ZerocoinOakland.pdf&lt;/a&gt;, which is the fundamental piece of new cryptography which enables it to work, doesn&apos;t make any sense to me.&lt;p&gt;At the very least, the authors have made the formulation so unclear that you could start to suspect the authors were deliberately trying to obfuscate it. They define a function ZKSoK(c, w, r), and it would make sense not to use c, w, and r to mean anything else in the short definition of the construction. However, the authors chose to also use c for the hash used to make it non-interactive, and r_i for a series of random numbers. Using the same variable name for two different things makes it hard to work out what they mean, but as far as I can tell, the c that is the function parameter is public knowledge, w can be computed from public information, and ZKSoK does actually depend on the r that is the function parameter, and the validation of the proof does not actually check that S is correct (c is computed as c &amp;#60;- g^S * h^r mod p, but it is useless if you can spend a zerocoin using any arbitrary S that doesn&apos;t actually correspond to any real c) as it claims.&lt;p&gt;In the 15 page version, they claim that the proof of the soundness of the ZKSoK proof can be found in &quot;the full version of this paper&quot; - perhaps that text makes things clearer, but they don&apos;t seem to provide a reference to it.</text></comment>
<story><title>Zerocoin: making Bitcoin anonymous</title><url>http://blog.cryptographyengineering.com/2013/04/zerocoin-making-bitcoin-anonymous.html</url></story><parent_chain></parent_chain><comment><author>ezyang</author><text>Here is a puzzle for HNers. Suppose that I am a user who wants to anonymize some Bitcoins, and I am willing to wait expected time N before redeeming my Zerocoins. What is the correct probability distribution for me to pick my wait time from?</text></comment>