Electric Coin Company Blog

"CYPHERPUNK ZERO Inspired by Zcash and Halo cryptography, the Cypherpunk Zero Creative Universe is a collaborative effort between ECC [2], illustrator Stranger Wolf [3] and select ecosystem partners. Consisting of a forthcoming series of webcomics, NFTs [1] and physical collectibles, the project explores the relationship between privacy, self-sovereignty and creative freedom." [1]: https://halo.electriccoin.co/nft/ [2]: https://electriccoin.co/ [3]: https://mobile.twitter.com/stranger__wolf

> * the fact that 20% of the block reward is given to the founders as a "fee". i.e. 6 people will end up with 20% of a "global currency". This applied to the first 4 years of issuance, so it's actually only 10% of the total supply, and it went to not just founders but also advisors, investors, etc, and some was donated to the Zcash foundation, so the portion that was personal profit for 6 people was much smaller! The bulk went into... paying salaries for quite a lot of developers. Since then another dev reward was agreed on (for the next 4 years), but this is going directly to the company+foundation directly building Zcash with no "founder share". TLDR: the share of the Zcash supply of which "6 people" are receiving through in-protocol issuance is much smaller than 20%. > * the fact that it's a "privacy focused" crypto-currency and the CEO said "we can make it private, but not for criminals" i.e. backdoored. (https://twitter.com/zooko/status/863202798883577856?s=20) Zooko did NOT mean backdoors; he meant things like KYC at exchanges and giving people the ability to voluntarily give "viewing keys" to law enforcement that prove which transactions they actually send/received. See some follow up tweets: https://twitter.com/zooko/status/863516385426755585 https://twitter.com/zooko/status/864342017605750784 > * the fact it's a crypto-currency with a CEO. Fair point! Zcash governance is definitely more centralized in that way (though there is a lot of community engagement,…

One of the applications are ZK-Rollups [1] which allow developers to move heavy computation off a blockchain. The blockchain receives the results and only validates proofs that they are valid. This is especially useful on Ethereum because its computational throughput is pretty low. There's also ZCash [2], which is a cryptocurrency that lets you make untraceable transactions. This is in stark contrast to Bitcoin or Ethereum, where transaction information is available publicly to everyone. They have a series of blog posts [3] on the math that actually makes it work under the hood. [1] https://ethereum.org/en/developers/docs/scaling/zk-rollups/ [2] https://z.cash [3] https://electriccoin.co/blog/snark-explain/

Grin and Beam use Mimblewimble, but Monero uses ring signatures to obscure the transaction graph (with every real input hiding among 16 decoys), and Zcash uses ZK-SNARK zero knowledge proofs [1]. This makes the latter two chains grow at a much faster rate [2] and makes nodes unable to identify the UTXO set of unspent outputs, making nodes much more resource intensive. [1] https://electriccoin.co/blog/explaining-halo-2/ [2] https://forum.grin.mw/t/scalability-vs-privacy-chart/8114

If interested in playing around with zero-knowledge proofs, recently was at a workshop with Ying Tong who has an exercise (and long associated slide deck) to walk through them using halo2 ( https://electriccoin.co/blog/explaining-halo-2/ ) to build your own zero knowledge proof https://github.com/therealyingtong/halo2-hope

Zerocash is now shielded by default (https://electriccoin.co/blog/new-releases-to-help-enable-zcash-shielde… does that count?

Zcash plans to switch to proof of stake by 2024: https://electriccoin.co/blog/ecc-roadmap-calls-for-focus-on-wallet-pro…

There are a lot of variations, but in Zerocash-style schemes (which can be viewed as massive ring signatures), each note has an associated 'nullifier'. Spending a note involves revealing its nullifier, and for the transaction to be valid, the nullifier must not have been used before. A nullifier is derived deterministically from private account data, and zero-knowledge proofs are used to show that a nullifier was dervied correctly without revealing the private account data. For more detail I think this is a good explanation: https://electriccoin.co/blog/zcash-private-transactions/

Zcash's privacy perspective seems to be highly flawed because of the way it was implemented though (optional opt-in privacy): https://news.bitcoin.com/not-so-private-99-of-zcash-and-dash-transacti… and https://electriccoin.co/blog/new-research-on-shielded-ecosystem/

> To expand on this a little bit, non-default privacy means that use of privacy features becomes de facto suspicious activity, thus rendering them useless. That's not a true statement as far as I understand how Zcash works. Right now there are >742K ZEC in the shielded Sapling pool, so there are quite a few people using it and you can not tell their shielded transactions apart. https://electriccoin.co/zcash-metrics/ > Another issue with Zcash is that it had a trusted setup, which is not an issue Monero has. Yes, but they took a number of steps to make sure that the ceremony for creating the trusted setup discarded the keys used and there was no one listening in. (they were geographically distributed and destroyed the hardware)

https://electriccoin.co/blog/ecc-timeline-updates-and-planning-for-202… Halo Arc removes the trusted setup and also sets shielded transactions by default. ECC also has announced that they intend to work on implementing shielded assests which seem compelling: https://electriccoin.co/blog/zsas-ecc-progress-and-next-steps/ One glaring issue is that there seems to be lots of tension between the community and the Zcash foundation (wrt power control).

The encrypted memo field of Zcash could lend itself to some interesting use-cases outside of transaction processing. https://electriccoin.co/blog/encrypted-memo-field/ It looks like this capability is being expanded with in-band secret distribution: https://zips.z.cash/protocol/canopy.pdf

I'm not up on the math, but https://electriccoin.co/blog/halo-recursive-proof-composition-without-… sounded like that sort of thing.

Not to mention this one, which covers more hash algorithms: https://electriccoin.co/blog/lessons-from-the-history-of-attacks-on-se…

> I don't have the same good feelings about the hashes or the asymmetric crypto yet. You might be interested in https://electriccoin.co/blog/lessons-from-the-history-of-attacks-on-se… (caveat: it’s a few years old, and it might have mistakes). It’s an empirical view on the history of hash functions. The results were very interesting to me. Against collision attacks, it kind of seems like we figured out how to make hash functions secure against them in the 2000’s (compared to block ciphers, which I guess we mostly figured out in the 1970’s). Against preimage attacks, it seems like we figured out how to make hash functions secure against them as soon as we invented secure hash functions at all — in the 1990’s.

Git isn't relying on collision-resistance, it's relying on second-preimage[0] resistance, which is to say: in order to sneak a hash collision in to a git repository, you have to sneak _something else_ that's already trusted (e.g. via code review) into the repository; collisions can't (yet) be generated for arbitrary hashes. I haven't heard of any second-preimage attacks against MD5, much less SHA-1, so mlindner was correct in asserting that MD5 would be fine (assuming 128 bits are enough). See also the analysis in [1]. More to the point, if you're able to sneak something into a repository in the first place (e.g. a benign file that generates a collision with a malicious file), then you're probably able to sneak in something more directly (e.g. [2]) that won't rely on both getting something in a trusted repository and then cloning from a different, untrusted source. [0]: https://en.wikipedia.org/wiki/Preimage_attack [1]: this is getting a bit old, but should still be relevant? https://electriccoin.co/blog/lessons-from-the-history-of-attacks-on-se… [2]: https://en.wikipedia.org/wiki/IDN_homograph_attack

Sure. Starting from the academic beginning and then going to commercial usage: Zerocash[0], a paper from 2014 (I'm an author on it), proposes using zksnarks to get a public ledger + privacy with no centralized parties. Instead of identifying the origin of your money on the blockchain and moving it to someone, you just prove in zero-knowledge your payment is correct. This showed strong privacy on a public blockchain was feasible. But slow (2 minutes per payment IIRC) Three years and much work by others later, it takes ~2 to 3 seconds on a Pixel three to make a zk-proof for a payment. This can be optimized down to 1 second fairly easily (on that you have only my assertion currently) This is commercially deployed in Zcash (the above mentioned coin with usability and adoption issues), a few other straight up forks, and a new coin called IronFish. And related protocols are in a few things on Ethereum (e.g., Aztec). If you want to test performance numbers, you can download one of these systems and try it yourself (Nighthawk is a decent mobile wallet for Zcash) Current technical objections (again, beyond criticisms of Zcash as a coin itself) 1) Current ZK proofs require trusted setup. New ZK proofs developed by engineers at Zcash removed this[1]. So its not longer an issue for the technology (or for Zcash once it's deployed) 2) you have to scan the blockchain to get notified of payments. No, this happens to be how Zcash does it. As I said in a separate comment, it's easy to…

There are a few reasons. 1. Audibility. I know for certain that my BTC is safe, sitting in a UTXO that everyone in the universe can see. Counterparties can verify the provenance of the coin. With Zcash and Monero, you face the risk of (invisible/unknown) inflation (a property of an unauditable supply), protocol bugs (such as failures in the zkp) and counterparty rejection due to lack of coin provenance. This risk affects the market price. Both these scenarios have happened, and could happen again. The first generation of ZEC had a broken zkp, which could be traced back to errata in the academic paper. [1] XMR (and other CryptoNote deriv coins) were failing to check for low order keys, so you could 8x-spend tx's. 2. Lack of exchange exchange support for US people, eg: real USD into XMR. 'not on coinbase'. * Kraken does XMR, but they also do not have a bitlicense (NY residents are blocked). * Gemini only has ZEC [1] https://electriccoin.co/blog/zcash-counterfeiting-vulnerability-succes… [2] https://jonasnick.github.io/blog/2017/05/23/exploiting-low-order-gener…

Even stranger are comments made in this link: https://electriccoin.co/blog/defense-against-counterfeiting-in-shielde… Especially this part: >Upon detecting this condition, the Zcash Company would begin its investigation into the possible source of the vulnerability as well as which pool, or pools, are affected. If we are able to identify that the bug affects only a single shielded pool, we might choose to effectively deactivate that pool by invalidating any of its outgoing transactions. A necessary consequence of this action is that any legitimate funds would also be lost forever in the affected pool. The mechanisms for this remote disabling are not mentioned in detail, and I don’t really mind, but this feature seems difficult to square with their desire for transparency. It’s an anti-feature perhaps serving a justifiable goal, but if this feature is possible to be abused, how would we even know if it had been?