Author

Topic: [ANN] Zcoin (XZC) - Implementing ZKP privacy without trusted setup - page 328. (Read 663307 times)

full member
Activity: 136
Merit: 100
I heard many people talking about this coin in this forum. What is the difference between this coin and other anon coins?
I am just a layman and don't understand all the technical jargons. If anyone can explain to me, I can decide for myself whether this coin is worth buying.

What i need to find out is also how does Zerocoin scale compared to Zcash/Monero and that would be an important question to answer.


Great draft! Thanks  Wink

Also curious about scalability, if crypto adoption really kicks in I'm sure we will see some stalled networks.

This link explains it somewhat: http://blog.zcoin.tech/zcoin-and-zcash/

Basically Zcoin trades off larger storage space on the blockchain in favour of faster compute times and lesser memory requirements on the client side.

Quote
Zcoin’s private transactions are not memory-intensive as with Zcash. On a quad-core benchmark server, generating a private transaction with “Zerocoin mint” and “Zerocoin spend” consumes ~10 seconds of compute time. Thus, sending a private transaction with Zcoin could be between 5-200 times faster than Zcash, depending on device.

On the other hand, Zcoin’s private transaction sizes are about 50 times larger than Zcash’s transaction sizes. This will not be a limiting issue for several reasons. One easy fix would be to update Zcoin to support pruning:

In his whitepaper, Satoshi had mentioned “pruning” as a solution to Bitcoin’s potential future scalability issue. Surprisingly, it’s not discussed often. When there is greater demand for Zcoin transactions than its capacity, Zcoin can build pruning into the protocol. This way, the storage requirements for Zcoin could be minimal.

By stubbing off branches in the merkle tree to save storage space, pruning could be built into Zcoin in a similar fashion as described in Satoshi’s whitepaper
full member
Activity: 136
Merit: 100
For those interested in knowing how Zcoin's implementation of Zerocoin compares to other current anonymity solutions:

https://github.com/zcoinofficial/zcoin/wiki/How-does-Zcoin-compare-to-other-anonymity-methods%3F

Quote
Bitcoin and preceding alternative cryptocurrencies have attempted to solve this problem through the use of transaction mixers or ring signatures. However, they score poorly on this metric called the traceability set. The traceability set is a key metric to understanding how private a cryptocurrency is. The traceability set in formerly proposed solutions is limited by the size of the mixing cycle or ring signature. Each mixing cycle or ring signature is limited by the number of transactions per cycle, which is transitively limited by the the block size of the cryptocurrency. Thus, the traceability set in previous attempts at privacy tends to only be a few hundred.

With ZCoin utilizing the Zerocoin protocol, the traceability set is on a dramatically higher magnitude. Instead of having a traceability set limited to the few hundreds, ZCoin has a traceability set that encompasses all minted coins in the ZCoin system. Thus, the magnitude of the traceability could be in the order of millions, rather than hundreds. So its privacy level is magnitudes higher than all previous cryptocurrency.

The other problem is that tumbling methods are only secure under the assumption of a lack of topological analysis and pre-existing network data, which is an incorrect threat model. As I mentioned earlier, there have been multiple research papers demonstrating that taking a separate network topology like Facebook can be used to de-anonymize a cryptocurrency as long as a long chain of transaction history exists. With all previous cryptocurrencies, a long chain of transactions is publicly viewable on the blockchain and prone to topological analysis.

With ZCoin, this long chain of transaction history simply does not exist, and there is zero information leakage about the sender and receiver of a transaction, so it is not prone to topological analysis and so the link between the sender and receiver disappears.

ZCoin uses zero-knowledge cryptographic proofs. A zero-knowledge proof is a method in which one person can prove to another person that a given statement is true, without conveying any information apart from the fact that the statement is indeed true.
legendary
Activity: 2716
Merit: 1094
Black Belt Developer

ASICs actually ARE good from a network security standpoint. But that's neither here nor there - most people can take the time to learn how to utilize AWS, don't blame others for your laziness.

The thing that gets lost in all of this is mining SHOULD be hard, it's not easy to mine gold, why should crypto mining be the same? To me the more difficult to accomplish such a task, the more value it gives to it.

I work hard at my dayjob to accumulate extra funds to buy crypto, likewise why shouldn't a miner have to put in a little work to get their share as well?

If it's too easy, everybody will do it and it will be devalued.
That's how everything works: a balance is always found, given enough time.
member
Activity: 81
Merit: 1002
It was only the wind.
So no one has issues with this coin being funneled into the mouths of a handful of people? Botnets and AWS, it's the same shit. Whole reason I've been bringing it up over the last couple weeks. Why would developers pick a random version of Lyra, even if there going to eventually switch?

Worse, why would they have the rows increase with every block?
sr. member
Activity: 476
Merit: 250
Price should alredy be at 0.03 now, considering that after zcash launch zcoin will be forgotten.

zcash future are 0.24 each (120 usd each zcash).

Zcash is an LLC registered in the US, which unfortunately very much makes it vulnerable to pressure from FBI and other suits (in fact they could be subpoenad by the NSA just like Lavabit), and it has the toxic waste problem. Zcoin is... I don't know what it is, apparently no registered company at all, and it uses the RSA-2048 number for its crypto setup (as you can see right here), which has been publicly available for 25 years and means there is no possibility of toxic waste in the developers' hands.

Also the Zerocash protocol hides all amounts, which in theory allows an adversary to use an exploit to generate currency while remaining undetected forever, while in Zcoin amounts are public yet transactions are still private, as explained in my other post above.

In essence, Zcoin has its strengths exactly where Zcash has its weaknesses. Not saying Zcash sucks, it certainly is a cool project with an amazing dev team. But to think that Zcoin has no reason to exist when Zcash is out is just foolish.

Agreed with this. I think zcoin could exist along side zcash.
member
Activity: 117
Merit: 10
ASICs actually ARE good from a network security standpoint. But that's neither here nor there - most people can take the time to learn how to utilize AWS, don't blame others for your laziness.

That seems like a weird statement coming from you. Most people can learn how to use AWS, but very few people can use them for free or quasi-free.
member
Activity: 81
Merit: 1002
It was only the wind.
H/s is decreasing.......getting really tough to mine....plus price isn't helping either
I've got 1,560 8-cores on it atm.
ec2?
Yup.

Curious. What method do you use to connect to such a large number of instances? I'm assuming you're sending identical commands to them all at once through an SSH client, but I also assume you didn't cut and paste 1000 different IP's into the SSH client to make the initial connections.

Following this thread over the past couple weeks has been a great learning experience when it comes to VPS mining techniques. Thanks to those who have shared experiences here. Those were just the threads I needed to pull in Google searches to get better set up for Zcash mining.

You don't actually need to connect to them Smiley
Setup an automatic startup, also maybe some monitoring and automatic recovery scripts on one machine. Test everything works ok. Then clone it indefinitely, as much as your funds allow. Pretty simple actually, if you have access to cheap VPS power...

Dead on. I use a run-once script on creation that sets up the env and downloads needed shit from my website.
legendary
Activity: 1246
Merit: 1000

ASICs actually ARE good from a network security standpoint. But that's neither here nor there - most people can take the time to learn how to utilize AWS, don't blame others for your laziness.

The thing that gets lost in all of this is mining SHOULD be hard, it's not easy to mine gold, why should crypto mining be the same? To me the more difficult to accomplish such a task, the more value it gives to it.

I work hard at my dayjob to accumulate extra funds to buy crypto, likewise why shouldn't a miner have to put in a little work to get their share as well?
hero member
Activity: 882
Merit: 500
Is price zcoin price rising since zcash launch is near or not?
legendary
Activity: 1764
Merit: 1024
So no one has issues with this coin being funneled into the mouths of a handful of people? Botnets and AWS, it's the same shit. Whole reason I've been bringing it up over the last couple weeks. Why would developers pick a random version of Lyra, even if there going to eventually switch?

Worse, why would they have the rows increase with every block?

That's what I meant, it's not Lyra2 or Lyra2v2, it's a weird ass version I guess that doesn't have mature CPU or GPU mining software out for. Obscurity? They don't plan on keeping it either, which makes it all the weirder.

So no one has issues with this coin being funneled into the mouths of a handful of people? Botnets and AWS, it's the same shit. Whole reason I've been bringing it up over the last couple weeks. Why would developers pick a random version of Lyra, even if there going to eventually switch?

Well a lot of these miners/botnets are dumping these mined coins on the exchanges which also allows distribution Cheesy With the early stages of any coin, it is always a handful of people who benefit (those who figure out how to get a miner working for the coin and get in early enough).

The whole point of this weird Lyra version was to make it CPU limited until they figured out an ideal algo (which they thought would be MTP). You would think that CPU mined algos would be the best in ensuring a fair distribution but due to AWS and botnets, maybe GPU friendly algos are better. But making it GPU friendly does it make it less asic resistant? Granted, the algo right now is in urgent need of replacement and I know that the devs are currently deliberating their options and were actively soliciting opinions on slack.

You could do that with a normal algo if it's just a placeholder. There was no reason to make it a weird version of Lyra unless they wanted to keep it in the handful of peoples hands.

Lyra2 is a CPU algo, they could've used Cryptonote, m7m, yescrypt... There are other choices.

This goes back to the first point, why would you make it a CPU algo which is heavily dominated by botnets and AWS instances? A more uniform distribution would go to GPU miners. They could've just made it a ASIC algo like x11 or sha-256 and it would've accomplished the same thing.

There are plenty of GPU algos that are ASIC resistant and going round about to a handful of people getting the majority of the distribution, both of which you don't want. AWS users and botnets.

It's already hypothesized that the devs are dumping coins... What are also the chances they made this into a coin they could easily mine that others don't have much experience in on purpose? Just happened that this shitcoin got off the ground... somehow. They don't even have a timeline for their new 'real' algo, probably due to the amount of money they're making.

just favours a different crowd; everyone will have a whinge if x mining method isn't within their grasp.

Oh yeah? So you think ASICs are good too? You want a bunch of coins going to a handful of people, right? And people will whine if they are making buttloads of money and don't think other people should too.
legendary
Activity: 1052
Merit: 1004
full member
Activity: 136
Merit: 100
Here's a layman's explanation of how Zerocoin works:

https://github.com/zcoinofficial/zcoin/wiki/A-layman's-explanation-on-how-Zerocoin-works

Quote
Most cryptocurrencies including Bitcoin rely on public ledgers. This means that all transactions are public, and the history of a coin can be traced from its inception, and all the transactions that it has been involved in.

Although the ownership of addresses are not known, through advances in statistical analysis and other meta-data (such as IP, time, use of exchanges), researchers have managed to reasonably accurately tie ownership of addresses to a real life identity.

As the blockchain forms a permanent record, they can be endlessly analyzed and once the identity is revealed, all the history of the coin is also tied to the identity.

This can be problematic for example if someone used Bitcoin to do some illegal activity and that particular Bitcoin somehow ended up in your hands, you may be implicated just by virtue of being in possession of that Bitcoin. On the other hand, if you are company or merchant, obviously you don't want competitors to know your transactions. In this case with Bitcoin blockchain you cannot archived that.

Some have tried to make it harder to do this by using coin mixers/tumblers. However, this involves trusting that the mixer/tumbler will not steal your money and also is not secretly recording how the coins are being mixed.

Zerocoin technology, which Zcoin uses allows the anonymization of coins that doesn't require you to put your trust in a mixer.

The easiest way to visualize Zerocoin tech is a black box, where everyone who wants to anonymize their coins places their coins in it. When they are ready to spend the coin, they produce a proof that they did place coins in the box, but the proof does not state which coin they placed. The proof could refer to any of the millions of coins in the box, and nobody knows which coin the proof is referring to. The proof simply states that the creator of the proof has placed a coin in the box, without giving any specific information about which coin it is. When other people see this proof, they have no idea who created this proof but are mathematically convinced that it is a valid proof. If the proof is valid, the proof entitles the proof creator to create a new coin with no transaction history and not related to any of the coins in the box, provided that it is of the same value. This means there is no linkage between the deposit transaction into the box and the redemption transaction whereby a coin is taken from the box.

The innovative part of Zerocoin is how this proof is generated where although you deposited the money into the box (and this transaction is recorded in the blockchain), you are somehow able to prove that you deposited into the box, without revealing which 'deposit' transaction was originally yours, hence the term 'zero knowledge proof'.
hero member
Activity: 2548
Merit: 626
wolf wolf, you aren't even donating to the pool, you slut  Grin
hero member
Activity: 636
Merit: 516
just favours a different crowd; everyone will have a whinge if x mining method isn't within their grasp.
member
Activity: 81
Merit: 1002
It was only the wind.
H/s is decreasing.......getting really tough to mine....plus price isn't helping either

I've got 1,560 8-cores on it atm.

ec2?

Yup.
full member
Activity: 136
Merit: 100
So no one has issues with this coin being funneled into the mouths of a handful of people? Botnets and AWS, it's the same shit. Whole reason I've been bringing it up over the last couple weeks. Why would developers pick a random version of Lyra, even if there going to eventually switch?

Well a lot of these miners/botnets are dumping these mined coins on the exchanges which also allows distribution Cheesy With the early stages of any coin, it is always a handful of people who benefit (those who figure out how to get a miner working for the coin and get in early enough).

The whole point of this weird Lyra version was to make it CPU limited until they figured out an ideal algo (which they thought would be MTP). You would think that CPU mined algos would be the best in ensuring a fair distribution but due to AWS and botnets, maybe GPU friendly algos are better. But making it GPU friendly does it make it less asic resistant? Granted, the algo right now is in urgent need of replacement and I know that the devs are currently deliberating their options and were actively soliciting opinions on slack.
full member
Activity: 136
Merit: 100
I heard many people talking about this coin in this forum. What is the difference between this coin and other anon coins?
I am just a layman and don't understand all the technical jargons. If anyone can explain to me, I can decide for myself whether this coin is worth buying.

Hi Shanem,

I have done a draft writeup for this Cheesy

Most cryptocurrencies including Bitcoin rely on public ledgers where all transactions are public and the history of a coin can be traced from its inception. Some have tried to make it harder to do this by using coin mixers/tumblers but they involve trusting the mixer/tumbler in that they won't steal your money and that they aren't secretly recording how the coins are being mixed. Zerocoin technology allows the anonymization of coins that doesn't require you to put your trust in a mixer.

The easiest way to visualize Zerocoin tech is a huge jar where everyone who wants to anonymize their coins places their coins in the jar without revealing who they are and then at will, when they show the requisite proof that they did put coins in the jar, they are entitled to redeem any other person's coin in the jar that is of the same value thus the link between the coin that was put in the jar and the new coin she has taken out of the jar is broken. This is alike to having everyone put a quarter in the jar and have it sit there and when they want to spend their coin, they can then dip into the jar and pull out a quarter.

There are other anonymity solutions such as Monero's ring signatures or Dash's private send or Zcash's zerocash implementation. Each has their respective pros and cons.

With Zerocoin, some of its perceived advantages are:
a) Ability to choose whether to do a public or private transaction (which you can't do with Zcash or Monero) (some may see this as a weakness and prefer anonymity by default)
b) Very much less computationally intensive than Zcash to generate transactions so regular computers can still use Zcoin.
c) No need to place any trust in mixers or wait for it to be mixed (such as in Dash)
d) Possibly greater anonymity than Monero since Monero requires it to be 'mixed' with similar denominations transactions in the past so if your denomination is rather unique, it may stand out. However as time passes, this becomes less of a problem.
e) Based on very well reviewed cryptography compared to Zcash which is based on cutting edge tech. With Zcash, the sender, recipient and value are not revealed at all. From an anonymity standpoint this is great however if a bug is discovered and a hacker can secretly mint coins, this is very hard to detect! Total supply of Zcash cannot be determined.
f) Arguably less controversial 'parameter' generation than Zcash. Zcash relies on the initial secret being destroyed and they have figured out a way in which unless all participants collude to not destroy the secret, then the secret is destroyed. Zerocoin uses parameters generated from an a academic challenge (https://github.com/zcoinofficial/zcoin/wiki/Parameters-in-set-up-phase-for-Zerocoin-in-ZCoin)

There are also drawbacks to Zerocoin's implementation of course which is why all these solutions have a role:
a) Locked to fixed denominations 1, 25, 50, 100 for Zerocoin. Meaning you can only put fixed denominations in the jar.
b) When you choose to put a coin in the jar and immediately redeem a new coin, there might be some analysis that can guess that the person putting in and taking out is the same person.
c) Still computationally intensive compared to Monero

What i need to find out is also how does Zerocoin scale compared to Zcash/Monero and that would be an important question to answer.



legendary
Activity: 1764
Merit: 1024
So no one has issues with this coin being funneled into the mouths of a handful of people? Botnets and AWS, it's the same shit. Whole reason I've been bringing it up over the last couple weeks. Why would developers pick a random version of Lyra, even if there going to eventually switch?
legendary
Activity: 2576
Merit: 1073
H/s is decreasing.......getting really tough to mine....plus price isn't helping either
I've got 1,560 8-cores on it atm.
ec2?
Yup.

Curious. What method do you use to connect to such a large number of instances? I'm assuming you're sending identical commands to them all at once through an SSH client, but I also assume you didn't cut and paste 1000 different IP's into the SSH client to make the initial connections.

Following this thread over the past couple weeks has been a great learning experience when it comes to VPS mining techniques. Thanks to those who have shared experiences here. Those were just the threads I needed to pull in Google searches to get better set up for Zcash mining.

You don't actually need to connect to them Smiley
Setup an automatic startup, also maybe some monitoring and automatic recovery scripts on one machine. Test everything works ok. Then clone it indefinitely, as much as your funds allow. Pretty simple actually, if you have access to cheap VPS power...
full member
Activity: 176
Merit: 100
H/s is decreasing.......getting really tough to mine....plus price isn't helping either
I've got 1,560 8-cores on it atm.
ec2?
Yup.

Curious. What method do you use to connect to such a large number of instances? I'm assuming you're sending identical commands to them all at once through an SSH client, but I also assume you didn't cut and paste 1000 different IP's into the SSH client to make the initial connections.

Following this thread over the past couple weeks has been a great learning experience when it comes to VPS mining techniques. Thanks to those who have shared experiences here. Those were just the threads I needed to pull in Google searches to get better set up for Zcash mining.
Jump to: