Hacker News Reader

Comment by ewillbefull | Hacker News Reader

Zcash is planning to use a new multi-party trusted setup scheme that allows a group to securely compute the mathematical structures necessary to protect the zero-knowledge proof integrity.

(Secure Sampling of Public Parameters for Succinct Zero Knowledge Proofs, Ben-Sasson, E. ; Chiesa, A. ; Green, M. ; Tromer, E. et al.)

Only if every member of this group were compromised or dishonest will the setup fail. That is, only 1/N participants need to be honest.

View on HN

Would this new "multi-party trusted setup" happen to be based on a block chain of its own?

If so, then they've introduced a new sort of meta 51% attack potential in a system that gives no economic incentive to mine (i.e., 51% attack is much easier when its not "51% of everyone trying to earn coins", but instead is "51% of those donating computing to protect zero-knowledge proof"), right?

If not so, then how? (rewind to Jan 2, 2009...)

Most zk-SNARK constructions are in the "common reference string" model, which requires a one-time trusted setup of a random string accessible to all parties: https://en.wikipedia.org/wiki/Common_reference_string_model

I haven't read the paper, so correct me if I'm wrong: I think the "multi-party trusted setup" isn't about a blockchain or something complex. It's just an algorithm to set up some initial values.

Sounds cool, it would be good to make the paper free as well, if the code is open source. Actually it would be even better to update the Zerocash paper so that people can understand the current zcash implementation. The source code maybe open, but the documentation seems far behind the source code. I'm sure that the protocol is sound, and you put lots of effort in it, but it's hard to understand for me, unlike the original Bitcoin. I loved reading BitcoinJ source code, as it is well documented and it's an easy to understand way to see that at least the BitcoinJ based wallets really do the same thing than what was present in the Bitcoin Whitepaper. Still, I guess I'm the minority, and many people will just trust the developers and use the system as long as it works. Anyways good luck, and I hope we will have fungibility in Bitcoin itself in the next few years.

Reply on news.ycombinator.com