darkfi/script/research/crypsinous/zerocash

zerocash notes, and highlights

zerocoin drawbacks

zerocoin isn't used in daily transaction due to performance limitations, but rather for anonymization, or laundrying coins through decentralized mix. performance bottleneck is that redeeming zerocoins requires double-discrete-logarithm proofs of knowledge which have size that exceeds 45kb, and 450ms to verify(at the 128-bit security level), it uses fixed denominations, can't pay in zerocoin directly, provides anonymity for the original address only.

minting

minting coin $c := ((a{pk}, PK{enc}), v, \rho, r, s, cm)$ is: $$tx{mint}:=(v,k,s,cm)$$ $$cm :=COMM{s}(v||k)$$ $$a{pk} :=PRF{a{sk}}^{addr}(0)$$ $$k:=COMM{r}(a_{pk}||\rho)$$

spending

Spending the coin c: $$tx{spend}:=(cm,sn,\pi)$$ $$sn:=PRF{a_{sk}}^{sn}(\rho)$$

pouring

pouring $coin^{old}$ into $coin_1^{new}$, $coin2^{new}$. with $v^{old}=v{pub}+v_1^{new}+v2^{new}$ as follows: $$tx{pour}:=(rt,sn^{old},cm_1^{new},cm2^{new},\pi{pour}, enc{pk{enc,1}^{new}}(C1),enc{pk_{enc,2}^{new}}(C_2)$$ $$C_i=(v_i^{new},\rho_i^{new},r_i^{new}, si^{new})$$ $\pi{pour}$ is the pouring sk-snark proof of the spending/pouring process. address for each participant is the pair $(addr{pk}, addr{sk})$, $addr{pk}=(a{enc},pk{enc})$, $addr{sk}=(a{sk}, sk{enc})$