Wait what? ZC can't be transferred?
Here is how it will (probably) work:
1. Zerocoin Mint Transaction In your wallet, you will convert a part (or all) of your ANC into zerocoins, with 1 ANC = 1 Zerocoin. The Zerocoins will be denominated in factors of 10, so you will need to choose how to do this. Your wallet will store some information for each zerocoin you generate (like the coin serial number, an associated random number used to generate the coin, and the denomination). The blockchain will record information saying that "your public ANC address sent X ANC to the zerocoin pool."
2. Zerocoin Spend TransactionYou tell your wallet to redeem some zerocoins to a specified ANC address. This part is done using zero-knowledge proofs and the private info in your wallet so that you don't disclose who you are. This ANC address could be yours (if you want to "wash" your coins) or someone elses (if you want to do an anonymous transaction). 1 ANC will be credited to this ANC address for each Zerocoin that is redeemed.
The end result is the following: The person who receives the ANC from the Zerocoin spend transaction won't know who they came from. All they will know is that they come from 1 of the people who ever owned zerocoins up to that date. As the number of people owning zerocoins will likely be VERY large, it will be impossible to guess who that person is. This differs from most other mixing services where the number of people you are mixed with is small, allowing you to play guessing games to eventually figure out who sent the coins.
The only thing you will need to worry about is the following: If the number of people who contributed to the zerocoin pool for denomination X is small, you are in danger of being found out. The wallet should thus tell you how many coins are in the escrow pool for each denomination. Even if this number is large, there is a possibility that all these coins belong to the same person! Thus it would also be a good idea for the wallet to tell you how many unique ANC addresses were used in the zerocoin mint transactions.
Why would anyone use other denominations than 1 ZC?
Because there is a transaction cost for each zerocoin proof. Miners need to verify each proof (which is considerably harder than just verifying a hash), and to incentivize them to do so, each zerocoin that is spent will have a small transaction fee. For a 1000 ANC transaction, you could either redeem 1000 zerocoins each with a 1 ANC denomination (with 1000 times the transaction fee), or just 1 zerocoin with a 1000 ANC denomination (with just 1 transaction fee). I think that darkcoin does something similar.
I have no idea what the transaction fees will be, but I suspect it will probably be 10 times larger than the normal fee of 0.01, so lets say it is 0.1 ANC
I think that there are two ways to deal with the fee. Lets say you want to send 1 ANC to someone.
(1) You could mint a zerocoin with a denomination of 1.1 ANC. When you redeem the coin, the 0.1 fee goes to the miner and the 1 ANC goes to the recipient.
(2) You could mint a zerocoin with a denomination of 1 ANC, and then a second one with the denomination of the fee, 0.1 ANC. To send 1 ANC to someone, you would need to send a 1 ANC zerocoin to them, plus send a 0.1 ANC zerocoin to the miner.
Option 1 is faster, as only 1 proof needs to be verified, but if you change the transaction fee at a later date, that would really screw things up. For option 2, the miner would need to verify twice as many zerocoin proofs in order to get the fee.
For the sake of simplicity (specially for casual users), the wallet software should have an "anonymous send" function which would both mint and spend ZC to a destination ANC address using the most appropriate denomination, so that the user doesn't have to know ZC or understand what is going on behind the scenes. ANC has to be simple in order to be popular, and advanced users will always be able to mint ZC manually.
The only thing users would have to understand is that "normal" send is not quite anonymous, and "anonymous send" is a bit more expensive because of the intermediary ZC step.
One problem with doing this is that your transaction could be deanonymized by a timing analysis. If you buy X zerocoins, and then immediately spend the same amount, that would look really suspicious in the block chain.
Another possible solution might be instead to have all coins in your wallet immediately converted to zerocoins. Perhaps the wallet could say "You just recieved X ANC. Would you like to convert them to Zercoins?"
That would still be too complex for casual users, for they would necessarily need to "know" Zerocoins. The whole idea of having "anon coins" and "zero coins" somehow co-existing in the same wallet is counter-intuitive. The ANC team should "hide" ZC from casual users that just want to have their ANC transactions fully anonymous.
That said, I understand the problem you are posing. What about keeping my original "anonymous send" concept, but warn the user that a fast/immediate "anonymization" of a transaction might look suspicious in the blockchain? The software could then ask the user how long he or she would be willing to wait for the whole transaction to complete, and then work in the backgroung, breaking the mint/spend in several steps within the specified time, allowing a random delay before the next spend.
Also, ANC should really drop the "Zerocoin" terminology in the user interface. We don't need two "coins" as there is really just one coin, which is ANC. For UI purposes, how about simply calling zerocoins "vouchers", which can be redeemed for ANC at a later time?
I'm a casual user and really do not have any problem with ANC with option to change them in ZC, if that will be easy like one or few clicks.
Or if would be possible, it is ok to be like now just ANC, and all will know that ZC is inside, with anonymity.
Who do not want to be anon, why use ANC anyway..
Hello to all ANC fans and watchers, I was on vacation
