Hacker News Reader

Comment by jhasse | Hacker News Reader

For anyone interested in how Zcash (formely Zerocoin) works and who understands German, I've written my Bachelor thesis about it in 2013: http://www.math.uni-bremen.de/~jhasse/Kryptografische%20Grun... (Part IV)

View on HN

Hey!

Can you help me understand something about Zcash? Do buckets need to be decrypted for the network on spend? Or is there a way to append a zk-proof that the bucket contains enough to fund follow-on buckets?

I'm probably wasting your time a little by asking, but I don't want to rely on my own reading to get a solid understanding.

"Buckets" contain cryptographic trapdoors which are necessary to witness spendable value. The sender constructs them and encrypts them with an IND-CCA2-secure key and places it inside the transaction. Only the recipient should be able to decrypt it to obtain the trapdoors which it needs in order to spend it.

I understand that. Well, I don't know what IND-CCA2 is. And presumably, therefore, my question. Does the 'spend' reveal the equivalent of a Bitcoin address? Or does the 'spend' merely provide a zero knowledge proof that the funding was legitimate?

> Or does the 'spend' merely provide a zero knowledge proof that the funding was legitimate?

This. :) (Alongside a demonstration that it wasn't spent before.)

What exactly are buckets? I think they used some other terminology back in the Zerocoin days.

The github explains that you create a transaction as follows:

1) You have 50 coins in a 'bucket' or address? 2) You send 18 to a friend 3) You send 32 t yourself.

So you create two encrypted buckets, 18 in one, and 32 in the other. They seem to be the equivalent of UTXOs. I'm not clear if they need to be 'revealed' to be spent though.

IIRC: No, they aren't "revealed". The 32 newly created coins in your bucket will be made public with a "commitment". I think this was called forging a Zerocoin. When you use them later you're using a zero-knowledge proof, which means others can't link the coins you spend with the forged coins from earlier.

Buckets are basically Coins from the original paper. It was changed because a `Coin` implies things that it actually isn't, but bucket is an even worse name, so it'll probably either be called Coin again or perhaps "pour output" or something.

Reply on news.ycombinator.com