Topic: █████ ***** THE ZEROCASH SOURCE - Truly anonymous coin ***** █████ - page 6. (Read 53600 times)

nothing new. maybe in nov/dec. stay tuned.

Soon™

Any news?

you should take a look at page 1.

Hi folks! Can anybody say if I can buy(invest) in ZEROCoin now?

Regards.

hello surfer43,

its a little bit confusing but believe me, nothing like this will be implemented in Bitcoin   .

so i explain it to you:


old site: http://zerocoin.org/

new site : http://zerocash-project.org/

on the new website you can read:

"Zerocash extends the protocol and software underlying Bitcoin by adding new, privacy-preserving payments. In doing so it forms a new protocol that, while using some of the same technology and software as Bitcoin, is distinct from it. This new protocol has both anonymous coins, dubbed zerocoins, and non-anonymous ones, which, for purposes of disambiguation, we call basecoins."



stay tuned  

http://zerocoin.org seems to say that Zerocash will not be a new altcoin, but rather will be implemented into the Bitcoin protocol.


I think this is a wording issue where they just inserted "Zerocash" where they were talking about the original Zerocoin, but I may be wrong. Because http://zerocash-project.org still talks about Zerocash as a new altcoin.

yeah, they want to release it in the end of 2014.

So this ever going to exist in real life?

Potentially there is an alternative means of employing Zerocash in an altcoin which could ameliorate the above problem.

If a new Zerocash instance was created periodically, users were allowed to mint instance coins and then unmint (cash out) within a fixed period of time for each instance, then it would clear if the output cash out money supply was greater than the input minted money supply.

Since the creator of the setup parameters is unable to break the anonymity, anyone could create the setup parameters and if the money supply doesn't match after the instance is terminated, then that entity would no longer be trusted.

However there are still several things I don't like about this:

1. The complex unvetted new crypto could still potentially be broken by cryptanalysis over time. (and all the public history of anonymity would then suddenly be revealed to the adversary)

2. What to do if an instance's output money supply doesn't match the input? Ban all those coins? Yuk!

3. The entire thing rests on building reputations and reputation is a slippery slope to centralized hell:

Here's a tutorial for the zk-SNARKs:https://github.com/scipr-lab/libsnark/blob/master/src/gadgetlib2/examples/tutorial.cpp

Very low level, and it doesn't demonstrate circuit loops, but interesting nonetheless. Looking forward mostly for the TinyRAM circuit generator.

How do you trust Zerocash, when the NSA could serve the creators of the setup parameters with a national security gag order on the eve of the public ceremony?

There are other advanced technical means that might be used to intercept the setup parameters even at such a ceremony, e.g. the NSA can reprogram the microcode of CPUs using built in backdoors and there is technology for jumping the air gap and intercepting the computations inside the computer.

And we will never know if the money supply is being inflated away since the money supply is invisible.

Woah, is this for real? http://www.scipr-lab.org/code

The zk-SNARK source code!?!

Came as a sudden surprise.

Add an analysis of XC...

PoS can never remain decentralized:

https://bitcointalksearch.org/topic/m.6501833

The supernode (analogous to the masternode in DarkCoin) concept is fundamentally flawed (Sybil attacks etc). See my comments about problems with reputation at the link above and about DarkCoin at the following link:

https://bitcointalksearch.org/topic/m.7513111

I have written some detailed information at the following linked thread, some of which is missing from your above summary:

https://bitcointalksearch.org/topic/m.6662978

Let is attempt the simplest summary, and readers who want to dig deeper can click the link above.

The resource requirements of the full client for Zerocoin are impractical, unless you want to centralize mining. Also all transaction amounts have to be the same, so you would run into the same issue as CryptoNote has (see below).

Zerocash hides the money supply (i.e. it is unknown), it is unvetted extremely complex new crypto (vetting takes years or a decade), and the setup parameters can not EVER be proven to not be backdoored, thus there will be no way to know if some entity (has cracked the crypto or intercepted the setup parameters and) is creating coins for free. Sorry but aren't we trying to get away from fiat central banking money where a centralized entity can print money at-will?

Many ways the NSA can get those setup parameters:

http://www.infowars.com/intel-ceo-refuses-to-answer-questions-on-whether-nsa-can-access-processors/

http://www.forbes.com/sites/steveblank/2013/07/15/your-computer-may-already-be-hacked-nsa-inside/

http://www.eweek.com/security/nsa-can-hack-you-even-if-you-arent-connected-to-the-internet.html

http://www.gizmag.com/malware-jump-air-gap/30056/

Include also if the people doing the setup have been served a national security letter gag order which compels them to do the setup and give the parameters to the NSA and not tell anyone.

The anonymity of CryptoNote (i.e. ByteCoin, Monero, and clones) requires that all transaction amounts be broken into separate transactions for standardized fragments which causes massive blockchain bloat (for any reasonable level of anonymity) and the blockchain can never be pruned. There is already a problem with Bitcoin's blockchain being too large and it doesn't have this massive bloat. In short, CryptoNote (and Zerocoin) can't scale.

Neither of the two do anything to obscure your IP address, and Tor/I2P are thought to be honey pots for national security agencies (Wikipedia says "who has the incentive to provide all this server bandwidth for free").

The need to obscure your IP address is less of an issue for Zerocash since it hides even the amount of the transaction, but this causes the money supply to be hidden as well which seems like an unacceptable tradeoff. Nevertheless, the authorities can see you are transacting to the Zerocash network even if they can't see the details, in theory the bezerk hunt for money during the coming sovereign debt collapse post-2016 will use the law to compel you to reveal secrets or face jail:

http://www.nestmann.com/could-the-government-force-you-to-tell-your-deepest-darkest-secrets

CryptoNote doesn't hide the amount and the payer is mixed with a limited number of numerous other potential payers, so the IP correlation can be used to narrow the possibilities statistically and home in on identity, by observing patterns across all users. Thus the lack of IP address obfuscation in CryptoNote (assuming Tor is really a honey pots, and or most users fail to employ Tor) reduces the anonymity.

CoinJoin’s algorithm suffers from not being atomic and thus it can be repeatedly jammed by an adversary, i.e. denial-of-service. This is because first the inputs have to be collected, then the outputs have to blind signed with a group signature, and then finally all inputs have to signed. If any one of the participant senders fails to complete all the steps, the transaction is jammed and the process must start again. All proposals for throttling or blacklisting adversaries was argued to be ineffective and intractable. Darkcoin innovated CoinJoin by adding a collateral payment which is forfeited by participants who fail to complete all steps. This requires a random master node to break the unlinkability as it knows the matching output of each input. It is assumed that not all master nodes will be adversaries and thus sending multiple times through different master nodes will provide a probablistic level of unlinkability. The master nodes are purchased and it isn’t clear that a sufficiently powerful adversary couldn't sufficiently Sybil attack by acquiring a larger percentage of the master nodes. There is also concern this might also enable the adversary to steal collateral payments. Also the master nodes aren’t untraceable and thus could perhaps be held liable by governments for breaking AML and KYC laws. CoinJoin and Darkcoin suffer from the simultaneity timing problem that other spenders need to send spends of the same amount simultaneously.

None of these coins do anything to solve the centralization of mining, wherein one or two pools now control more than 50% of the Bitcoin mining hash rate.

Also many of these coins run into chaotic problems with their organization, e.g. apparently someone created a private GPU miner for Monero and is mining 50% of the coins for himself. Apparently there is no funding means or organization to rectify this.


I read the research paper for UFOs. It is based on number theoretic assumptions and I am unaware if these assumptions have been sufficiently vetted.

Realize the NSA may have as much as the $3 trillion missing black budget at their disposal (the money former Secretary of Defense Donald Rumsfeld announced was missing the day before 9/11 and then all the records were destroyed at the Pentagon by the attack the next day).

http://www.wired.com/2013/09/black-budget-what-exactly-are-the-nsas-cryptanalytic-capabilities/


Correct.

Lastly remember all the coins are currently based on asymmetric public key cryptography, which can be cracked with a quantum computer if the NSA ever is able to create one. As well the NSA might have cracked some of the number theoretic factoring assumptions or backdoored the constants.

http://beta.slashdot.org/story/191445

https://www.schneier.com/crypto-gram-9911.html#EllipticCurvePublic-KeyCryptography

http://crypto.stackexchange.com/questions/10263/should-we-trust-the-nist-recommended-ecc-parameters

If you really want to be sure, you need to move to Lamport signatures which are not based on number theoretic assumptions.



I don't think so...

http://en.wikipedia.org/w/index.php?title=Onion_routing&oldid=592703635#Weaknesses

https://tails.boum.org/doc/about/warning/index.en.html#index4h1

https://tails.boum.org/doc/about/warning/index.en.html#index7h1

http://en.wikipedia.org/wiki/Tor_%28anonymity_network%29#Exit_node_eavesdropping


https://www.schneier.com/essays/archives/2013/10/attacking_tor_how_th.html

http://armstrongeconomics.com/2014/06/22/nsa-gathers-all-communications-everywhere/

Well hopefully there is a way to generate the parameters in a trust-less way, they just don't know how yet.

In fact, it is possible to generate the security parameters in a completely trustless manner for the original Zerocoin protocol of Miers et al. (Zerocoin: Anonymous Distributed E-Cash from Bitcoin). All you need to do is generate a number that contains two large prime numbers, and whose factorization is unknown. Amazingly, you can generate such numbers using RSA UFOs, and this is the approach that Anoncoin has chosen for their implementation of Zerocoin.

Unfortunately, you can not do the same thing with the newer Zerocash protocol of Ben-Sasson (Zerocash: Decentralized Anonymous Payments from Bitcoin).

"We're building a system that will not have a back door"... Well there's no way of knowing that the security parameters do not contain a back door, so we have to trust the people who generate them. Hopefully someone will figure out a way to generate them in a provably trustworthy fashion. I don't know if that's possible.

Matt Green aims to fudamentally change the way we interact

http://imgur.com/a/J6vO8#Vmo8rt9

i guess on crypsy and the others...i dont know yet.