Comment by segfaultbuserr | Hacker News Reader

Comment by segfaultbuserr | Hacker News Reader

Parent Full thread

Zcash knew the problem of backdoor-able initial setup, they understood that it can raise serious doubts on the trustworthiness of their system, they even named the initial key material for setup as "cryptographic toxic waste". As an attempt to bring confidence to the setup ceremony, Zcash used a multiparty setup of 6 people, and invited prominent developers of the cryptocurrency community to participate. The setup was performed at each person's own undisclosed geolocation, and coordinated online. The rough idea was, if at least one participant during the setup was honest, properly destructed the secret, and wasn't hacked, the setup will be secure.

The prominent Bitcoin developer, Peter Todd was invited to participate, too. You can read his entertaining blogpost about the setup procedure at here.

https://web.archive.org/web/20161114214233/https://petertodd...

The funny and alarming story is, after he finished the setup, he became increasingly suspicious about the security of the procedures, especially casted doubts on some technical problems that prevented reproducible build (!!!) of the setup programs. And he later had withdrawn his blogpost and all the claims of security altogether. To me, it's alarming, in the end, we'll never get solid security guarantees.

> Zcash used a multiparty setup of 6 people

That's true of the original (Sprout) SNARK, but the newer (Sapling) SNARK used a much more scalable MPC ceremony, which they called Powers of Tau: https://z.cash.foundation/blog/powers-of-tau/

There was a public call for participation at the time, so if you wanted to be sure that the ceremony was not corrupted, you could just participate yourself.

For backwards compatibility, the Sprout SNARK can still be used, so if the original ceremony was compromised, an attacker could still create coins "out of thin air". But converting a Sprout account to a Sapling account requires making the amount public, so if the number of coins converted exceeded the intended currency supply, that would be detected. Worst case scenario, a hard fork could be arranged to disable the Sprout SNARK.

The original Sprout SNARK has been disabled and replaced with a new implementation based on the powers of tao ceremony. You can still spend Sprout coins, but not with the old parameters.

Note that the technical problems made it more complicated and messy to reproduce the build, but didn't outright prevent it. Mainly the executable binaries were reproducible, but other metadata in the disk image changed each time. https://github.com/zcash/mpc/issues/2

As you know, my complaints with regard to the reproducible build were not that the scripts themselves didn't work - indeed I fixed an issue related to that - but that the direct dependencies of the build were both high entropy (e.g. very specific nightly builds of a niche Linux distribution) and themselves not at all reproducible.

Your reply here is highly misleading, even lying by omission.

Check out this podcast about the Zcash ceremony: https://www.wnycstudios.org/story/ceremony

Reply on news.ycombinator.com