# zerocash notes, and highlights

## zerocoin drawbacks
zerocoin isn't used in daily transaction due to performance limitations, but rather for anonymization, or laundrying coins through decentralized mix. performance bottleneck is that redeeming zerocoins requires double-discrete-logarithm proofs of knowledge which have size that exceeds 45kb, and 450ms to verify(at the 128-bit security level), it uses fixed denominations, can't pay in zerocoin directly, provides anonymity for the original address only.

# minting
minting coin $c := ((a_{pk}, PK_{enc}), v, \rho, r, s, cm)$ is:
$$tx_{mint}:=(v,k,s,cm)$$
$$cm :=COMM_{s}(v||k)$$
$$a_{pk} :=PRF_{a_{sk}}^{addr}(0)$$
$$k:=COMM_{r}(a_{pk}||\rho)$$

# spending
Spending the coin c:
$$tx_{spend}:=(cm,sn,\pi)$$
$$sn:=PRF_{a_{sk}}^{sn}(\rho)$$

### pouring
pouring $coin^{old}$ into $coin_1^{new}$, $coin_2^{new}$. with $v^{old}=v_{pub}+v_1^{new}+v_2^{new}$ as follows:
$$tx_{pour}:=(rt,sn^{old},cm_1^{new},cm_2^{new},\pi_{pour}, enc_{pk_{enc,1}^{new}}(C_1),enc_{pk_{enc,2}^{new}}(C_2)$$
$$C_i=(v_i^{new},\rho_i^{new},r_i^{new}, s_i^{new})$$
$\pi_{pour}$ is the pouring sk-snark proof of the spending/pouring process.
address for each participant is the pair $(addr_{pk}, addr_{sk})$, $addr_{pk}=(a_{enc},pk_{enc})$, $addr_{sk}=(a_{sk}, sk_{enc})$