No? It seems kind of imbalanced to have an analysis which emphasizes the security compromises caused by older monero (pre-CT, pre minimum mixin count) while ignoring the ongoing privacy flaw in Zcash usage in practice.
Agreed, this should updated to specify that only transactions between shielded addresses are protected. The point they are trying to make is that the anonymity set between shielded addresses is that of all transactions in the anonymous set. (FWIW, this is a pre-publication draft.)
> No? It seems kind of imbalanced to have an analysis which emphasizes the security compromises caused by older monero (pre-CT, pre minimum mixin count)
ZCash is pretty explicit about the difference between shielded and transparent addresses....
However, the news here isn't about ZCash. Monero's main claim to fame is that it has an "opaque" blockchain, but this isn't cryptographically ensured. Instead, it relies on each client to create dummy transactions that mirror real ones. That leaves Monero wide open to side channel attacks now and in the future.
One would expect careful analysis and much more cautious language. Instead, it looks like clients weren't even doing basic checks:
> We find that among Monero transaction inputs with one or more mixins, 62% of these are deducible, i.e. they can be incontrovertibly linked to the prior TXO they spend.
It's a solid piece of research and even if Monero fixes everything in this upcoming release, that doesn't make this analysis any less worrying.
This is an important point. Having two very distinct addresses (different lengths, different prefixes, different RPC APIs) makes it very obvious to users when they have the benefits of shielded transactions, and when they don't. Thus users make an explicit choice to forgo privacy when they use transparent addresses.
The problem of only 28% of transactions currently being shielded (https://explorer.zcha.in/statistics/network https://explorer.zcha.in/statistics/timeseries?hashrate=fals...) is a separate ecosystem problem, where usage of shielded addresses with third parties (like wallets and exchanges) requires them to use new APIs, instead of just interacting with the new block chain via the Bitcoin API. IIUC Monero has also encountered these issues, and it is something we are both working on improving.
Is the chart wrong?
For value I get: 42588 / (891015+222753) = 3.8% Shielded Value / (Cumulative Miner's Reward + Cumulative Founder's Reward)
Perhaps it is 28% of transactions are shielded worth only 4% of zec value?
-- Daira Hopwood (Zcash developer)
Underneath that pie chart, there is a caption: "Transparent value (stored in t-addresses) vs shielded value (stored in z-addresses), in ZEC." In other words, that pie chart shows the number of ZEC that are currently residing in transparent vs shielded addresses at the specific point in time that you load that page.
The Advanced Network Stats page - https://explorer.zcha.in/statistics/network - has a box labelled "Shielded Transaction Percentage", which indicates what percentage of transactions involve a shielded value. You can see more details for different amounts of time on https://explorer.zcha.in/statistics/usage
This way of stating is somewhat questionable in light of the claims in the second half of the paper.
What is shown in the second half of the paper is that all possible sources are not equally likely and this most probably applies to Zcash (and every other coin) as well. In the Figure 1 illustration of Zcash, it is most likely that the rightmost (most recent) arc is the correct one. Of course this can't be stated with certainty in either coin.
Another way of interpreting the trend shown in Figure 8 is that Zcash gains little (though of course it still gains something) from including all transactions in the anonymity set (arbitrarily far to the right) because once one departs from focusing predominantly on the more recent transactions, the effective anonymity set does not grow much.
> Instead, it looks like clients weren't even doing basic checks:
>> We find that among Monero transaction inputs with one or more mixins, 62% of these are deducible, i.e. they can be incontrovertibly linked to the prior TXO they spend.
There are no basic checks that can solve that issue. It was fixed in a different way.
> even if Monero fixes everything in this upcoming release,
Most of the issues in the paper were already addressed in the past, and the paper says this. The remaining issue is the time bias which the paper states has already been improved, but can be improved further.
Another way of saying this is that in Zcash, the content of a fully shielded transaction does not give an adversary any more information about the possible input distribution than they could guess without seeing the content (i.e. only based on the timestamp and the number of JoinSplits in that transaction). In Monero, the adversary can refine their guess of the distribution based on the inputs that are actually mixed in, and that is what creates the privacy weakness.
Figure 8 does not apply to Zcash, it is specific to Monero, as the caption states.
-- Daira Hopwood (Zcash developer)
> In Monero, the adversary can refine their guess of the distribution based on the inputs that are actually mixed in, and that is what creates the privacy weakness.
That is not what is claimed in Section 4 of the paper. Section 4 merely indicates that of potential outputs, the time distribution introduces a bias toward the most recent (actually in Monero this might be inaccurate in some cases too: very, very recent might be less likely than merely very recent; the paper does not examine this). In Zerocash the same time distribution bias exists, though across a larger set of potential coins (or notes or whatever it is you call it).
However, very old members of that set are essentially irrelevant as their probability in the distribution is almost certainly extremely low (this is the same reason that more older outputs in Monero are essentially irrelevant).
It's the same claim as for semantically secure encryption, for example: no competent cryptographer would claim that encrypting a message implies that the adversary's knowledge of the plaintext distribution is uniform; only that the ciphertext gives the attacker no further information (apart from length, typically) about the distribution.
It is, in the same sense that the first order anonymity set of Monero transactions is all outputs included in the ring signature which can't be proven implausible (e.g. using the methods in Section 3 of the paper). However, Section 4 of the paper points out that a non-uniform distribution means this is reduced, in practice, to a smaller effective degree. The same method can be used with Zcash to estimate a smaller effective degree since many previous shielded transactions are probabilistically unlikely.
This is certainly not 'deanonymization' or 'tracing' or any such thing, but it isn't that in the Monero case either.
Perhaps you should familiarise yourself with the papers that Monero themselves published on this in September 2014, and the follow-up in January 2015? Here-
https://lab.getmonero.org/pubs/MRL-0001.pdf
https://lab.getmonero.org/pubs/MRL-0004.pdf
Now the recommendations made in that 2nd paper were only instituted in the v2 hard fork in March 2016, because hard forks are hard and it was their first one, but it doesn't change the fact that they published two papers on it to warn the community, made immediate changes so that updated clients used minimum ring sig sizes, and then hard forked to ban mixin 0. Publishing a paper on an already-discovered and already-solved issue two years later isn't particularly interesting or novel.
Last I checked virtually none of Zcash's transaction used the anonymous payment feature (presumably because the performance of it is very poor).
So it's plausible that monero transactions could practically end up with a larger anonymity set in absolute terms than zcash (especially for current monero, which has CT and a minimum mixin size).
I think it would be more accurate to say that Zcash, has, as a feature, a way to make anonymous payments, but it is rarely used.
>So it's plausible that monero transactions could practically end up with a larger anonymity set in absolute terms than zcash (especially for current monero, which has CT and a minimum mixin size).
No, it isn't. There will always be a transaction graph between accounts, which limits the total number of possible routes between two participants in a trade.
Much of the performance issue comes from a single design decision made in Zerocash: to use SHA-256 for the Merkle tree, PRF, and note commitment hashes. We'll be changing this for the Sapling update.
-- Daira Hopwood (Zcash developer)
I hope my portrayal of the performance issues was appropriate.
Yes, your portrayal of the performance issues was fine.
https://explorer.zcha.in/statistics/usage
And here historical stats about shielded and unshielded transactions in the most recent 100 blocks over the life of the blockchain so far (about 6 months):
https://explorer.zcha.in/statistics/timeseries?supply=false&...
Note that a big part of the shielded transactions is because coinbases are required by the consensus rules to be shielded when first spent. This was in order to provide a guaranteed privacy-set. If you make a shielded Zcash transaction today there is actually a very large privacy-set of possible previous transactions which could be inputs to your transaction.
In the long run we intend to improve the functionality of Zcash shielded addresses and to deprecate Zcash transparent addresses, so that all transactions are shielded and so that the user experience is simpler.