I am also wondering if the use of zero knowledge proofs can considerably slow down transaction times and/or confirmations due to the heavier computational power required, as compared to Monero's ring signatures.
In the zerocoin paper they claim a block with 800 zerocoin transactions would take five minutes (they really said minutes, that is not a typo) to verify. That is 2.6 seconds per transaction. In a decentralized network every node must verify blocks before forwarding them. Monero gets criticized for a proof of work that takes about 20ms per block, although it remains to be seen whether that turns out to be a problem.
This orders of magnitude away from being practical for a decentralized network.
I agree that is pretty slow, but if I was a criminal doing something I could go to jail for a long time for doing, I wouldn't mind waiting longer for a transaction to confirm. For real life transactions it may make it unusable, but for things like deep web marketplaces or anything where 5-10 minutes (even hours) isn't a huge deal, then something like Zerocoin may be desirable over Monero.
I think canth explained it better than I could, and honestly it is something I haven't thought of before, but Monero would still have its uses if something like Zerocoin came to exist. He made a lot of valid points in his post. I don't believe in the "one coin to rule them all" dogma, but the dynamics for anonymous centric coins are a bit different and it will be interesting to see how it plays out. I can see how some might be more desirable than others in certain situations and vice versa.
There are private transactions, anonymous transactions and plausibly deniable transactions - each coming with tradeoffs. I could see situations where legit and illegit companies/persons would want to conduct private transactions but not necessarily anonymous nor impossible to prove transactions.
Organized criminal enterprises, high net worth individuals, intelligence assets (spies), etc all have reasons to want to prevent transactions from being discernible to outsiders but might want to be able to prove they made or received payments to certain 3rd parties. Even mobsters have accountants.
It's reasonable the feature set Monero offers could be superior to the one proposed by Zerocoin, under a broader set of circumstances.
Ask yourself this. Would someone looking to replace a swiss numbered bank account chosen for tax avoidance likely use a tool that will only be perceived useful to criminals or one that has broader purposes? I posit that Monero would be more palatable.
) but I *think* the key advantage to subsuming BBR/XMR within James's convoluted ambitious trendy Blockchain 2.0 scheme is that we may be able to achieve the Holy Grail of distributed exchanges.
