Hacker News Reader

Comment by xiphias | Hacker News Reader

Zerocash had a possible backdoor, which was its' biggest drawback. I don't see it mentioned on the web page, which seems like they're hiding it (it's cruital to know who we need to trust with the setup part, and whether anybody has the right to take part in it).

,,Security of Π relies on a trusted party running Setup to generate the public parameters (once and for all). This trust is needed for the transaction non-malleability and balance properties but not for ledger indistinguishability'' - from the zerocash paper

View on HN

Zcash is planning to use a new multi-party trusted setup scheme that allows a group to securely compute the mathematical structures necessary to protect the zero-knowledge proof integrity.

(Secure Sampling of Public Parameters for Succinct Zero Knowledge Proofs, Ben-Sasson, E. ; Chiesa, A. ; Green, M. ; Tromer, E. et al.)

Only if every member of this group were compromised or dishonest will the setup fail. That is, only 1/N participants need to be honest.

Would this new "multi-party trusted setup" happen to be based on a block chain of its own?

If so, then they've introduced a new sort of meta 51% attack potential in a system that gives no economic incentive to mine (i.e., 51% attack is much easier when its not "51% of everyone trying to earn coins", but instead is "51% of those donating computing to protect zero-knowledge proof"), right?

If not so, then how? (rewind to Jan 2, 2009...)

I haven't read the paper, so correct me if I'm wrong: I think the "multi-party trusted setup" isn't about a blockchain or something complex. It's just an algorithm to set up some initial values.

Most zk-SNARK constructions are in the "common reference string" model, which requires a one-time trusted setup of a random string accessible to all parties: https://en.wikipedia.org/wiki/Common_reference_string_model

Sounds cool, it would be good to make the paper free as well, if the code is open source. Actually it would be even better to update the Zerocash paper so that people can understand the current zcash implementation. The source code maybe open, but the documentation seems far behind the source code. I'm sure that the protocol is sound, and you put lots of effort in it, but it's hard to understand for me, unlike the original Bitcoin. I loved reading BitcoinJ source code, as it is well documented and it's an easy to understand way to see that at least the BitcoinJ based wallets really do the same thing than what was present in the Bitcoin Whitepaper. Still, I guess I'm the minority, and many people will just trust the developers and use the system as long as it works. Anyways good luck, and I hope we will have fungibility in Bitcoin itself in the next few years.

> I don't see it mentioned on the web page, which seems like they're hiding it

https://github.com/Electric-Coin-Company/zcash

Not very well, if at all.

The actual setup of the parameters hasn't occured and will use a much more secure construction which isn't complete yet. The software is still in alpha.

This could be done by multiple people. The "trusted party" doesn't need to be one person, it could just be the bitcoin miners of a given time frame (without them agreeing, just use their hash values).

Shouldn't those parameters then be well known to everybody? And subject to investigation?

Can you give more detail as to why this is a backdoor?

Reply on news.ycombinator.com