I've heard that NXT is working on a zerocoin implementation.
If so, how do you plan to address these limitations?
Zerocoin has a number of serious limitations:
- It uses cutting-edge cryptography which may turn out to be insecure, and which is understood by relatively few people (compared to ECDSA, for example).
- It produces large (20kbyte) signatures that would bloat the blockchain (or create risk if stuffed in external storage).
- It requires a trusted party to initiate its accumulator. If that party cheats, they can steal coin. (Perhaps fixable with more cutting-edge crypto.)
- Validation is very slow (can process about 2tx per second on a fast CPU), which is a major barrier to deployment in Bitcoin as each full node must validate every transaction.
- The large transactions and slow validation also means costly transactions, which will reduce the anonymity set size and potentially make ZC usage unavailable to random members of the public who are merely casually concerned about their privacy.
- Uses an accumulator which grows forever and has no pruning. In practice this means we'd need to switch accumulators periodically to reduce the working set size, reducing the anonymity set size. And potentially creating big UTXO bloat problems if the horizon on an accumulator isn't set in advance.
I prefer to trust a peer reviewed algo by Matt Green than any ad hoc mixing technique. We dont have to run faster than the bear, we just have to run faster than the slowest guy.
What I mean is that currently everything is totally open and correlatable. ANYTHING is better than that. That being said, we might as well go with the theoretically best solution and that in my opinion and many others is zerocoin's approach. Also, if it does get cracked, then it becomes the same as it is now.
All of the performance and storage issues are said to be solved with zerocoin2, which we will incorporate as soon as it is available to us. Hopefully in a prerelease. Validation times are ~10 milliseconds, size is 288 bytes
The trusted party is a onetime thing. My plan was to ask Anon to be videoed creating the initial dataset on a totally isolated computer. Then we copy the data onto portable storage put it in a faraday cage and detonate an EMP to erase everything on the computer that generated the initial data. Just dont tell Anon about this plan!
As far as issues with accumulators, that is part of the blackbox maths. I will have to defer to Matt Green to address such issues. We have a very talented community, if there comes a time that we need to take corrective action for issues like you are talking about I am confident that we will solve them
James