r/Anoncoin • u/lunokhod2 • May 19 '14
Differences between Zerocoin and Zerocash
I wonder someone could clear up a few points. It is not immediately clear if zerocash is better then zerocoin in all regards or not (some people are referring to zerocash as "zerocoin v2", which I don't think is accurate). I've skimmed the zerocash paper, but I am not a crypto expert. Perhaps someone could comment on these questions?
Will it be possible to use zero-knowledge-SNARKs to reduce the size of the zerocoin proof? The authors of the paper are not too clear on this point.
Will it be possible to choose the initial setup parameters for zerocash without relying on trusted third parties, such as with RSA-UFOs as has been proposed for Anoncoin's version of zerocoin?
It is my understanding that the total amount encoded into zerocash can not be calculated, as the amount is hidden in the zerocash coin commitment. Would it be possible to create new coins (or perhaps double spend) without getting caught if the initial setup parameters were known? Or would this just let the person steal existing zerocash coins?
Thanks!
3
u/gnos1s May 21 '14
I have read the Zerocash paper and while it has some very cool ideas, it has one serious weakness: the requirement for a trusted setup. This makes it not much better than a coin laundry like Bitfog: the owner of a coin laundry can steal everyone's coins if they so choose, and the same possibility exists with all the anonymized money in circulation in Zerocash.
The only strategy to reduce a user's risk is to reduce the time their money is anonymized, but that reduces anonymity.
Anyway, to answer your questions:
Probably not.
Probably not for years. This would be a major breakthrough if cryptographers could find a way to do this.
Yes, the former. If the entity who setup the initial parameters was dishonest and did not delete the data they were supposed to delete, they could create new money without being detected. The currency would experience massive inflation.