* the fact that 20% of the block reward is given to the founders as a "fee". i.e. 6 people will end up with 20% of a "global currency".
* the fact that it's a "privacy focused" crypto-currency and the CEO said "we can make it private, but not for criminals" i.e. backdoored. (https://twitter.com/zooko/status/863202798883577856?s=20)
* the fact it's a crypto-currency with a CEO.
* the fact that the ZK-SNARKs they use (however mathematically beautiful), requires a trusted setup, i.e. prover key(non I/O), verify key(target polynomial, secret point, I/O), from random elements. Trusted setup generates a point where the polynomial is evaluated on, and should it not be disposed of properly the consequences are devastating. (You shouldn't need to trust people to use crypto).
* the fact the SNARKS are computationally expensive and no-one uses them. Thus opt in privacy and reduced anonymity set.
People just associate “zk-snark” with "big-ass anonymity sets for free" when really it’s “complex circuit enforcement enabled by verifier-efficient trusted proving system"
I totally agree BTC + Privacy is the holy-grail of crypto, and Monero is the project that's the furthest towards that goal with an actually competent team.
Take it from someone that does this for a living, use Monero instead.
The holy grail doesn't exist. It's all about trade-offs.
Bitcoin has a transparently auditable supply. Privacy coins based on Confidential Transactions have a choice between perfect soundness and perfect privacy. So far they all choose the latter (Pedersen commitments), as it also happens to be more efficient than the former (El-Gamal commitments). But it means that knowledge of a single discrete log allows undetectable inflation.
Then there's the scalability trade-off. Bitcoin allows a full client to prune all spent outputs after verification, to minimize disk-space. Privacy coins need to keep some information about past transactions. Worse still, the Initial Block Download is way bigger due to the sizeable range proofs. Except for the Mimblewimble based coins, in which spent outputs can be completely forgotten. But those are still mostly traceable...
Then there are trade-offs in emission. A fixed supply sounds great for scarcity/speculation, but also risks mining instability / security risks down the road as the block subsidy dwindles.
Then there are trade-offs in transaction throughput. You can easily increase it with bigger and more frequent blocks, but then resources needed to fully verify all transaction history will make it less decentralized.
A quickly falling block reward is good for early adopters but also leads to wealth concentration.
Smart contracts increase functionality but as they say complexity is the enemy of verification, and the attack surface gets much bigger.
Etcetera, etcetera.
2)The decoy based approaches Monero uses are subject to all kinds of passive and active attacks. Both in practice ( https://arxiv.org/pdf/1704.04299/) and just fundamentally: https://www.youtube.com/watch?v=9s3EbSKDA3o. There are ways to mitigate some of these problems to a degree. This is why you hear Monero people talk about coin control and churning (both of which can make you stand out in other ways). But the fact that they have to mention that should tell you its far from a perfect solution cryptographically.
There's a reason projects go with the large anonymity set approach. And if you're a cryptographer at ConsenSys, you should know that: it's what Ethereum is doing with Aztec. You also should know several projects, including Zcash, are working on trustless setup zk proofs.
(Disclosure: I am involved in Zcash.)
Disclaimer: I wouldn't trust zcash for anything.
What do you think about Aztec (zkRollup L2 for Ethereum)? I tend to get really excited about it as it looks like a private by default system that supports smart contracts (including calling L1 in some cases), inherits Ethereum's security, and is interoperable with DeFi and Ethereum's ecosystem. It sounds fairly perfect for us cypherpunks but I just know there's some blemish that I'm missing. If there's not then it makes me very hopeful for our future.
This applied to the first 4 years of issuance, so it's actually only 10% of the total supply, and it went to not just founders but also advisors, investors, etc, and some was donated to the Zcash foundation, so the portion that was personal profit for 6 people was much smaller! The bulk went into... paying salaries for quite a lot of developers. Since then another dev reward was agreed on (for the next 4 years), but this is going directly to the company+foundation directly building Zcash with no "founder share".
TLDR: the share of the Zcash supply of which "6 people" are receiving through in-protocol issuance is much smaller than 20%.
> * the fact that it's a "privacy focused" crypto-currency and the CEO said "we can make it private, but not for criminals" i.e. backdoored. (https://twitter.com/zooko/status/863202798883577856?s=20)
Zooko did NOT mean backdoors; he meant things like KYC at exchanges and giving people the ability to voluntarily give "viewing keys" to law enforcement that prove which transactions they actually send/received.
See some follow up tweets:
https://twitter.com/zooko/status/863516385426755585 https://twitter.com/zooko/status/864342017605750784
> * the fact it's a crypto-currency with a CEO.
Fair point! Zcash governance is definitely more centralized in that way (though there is a lot of community engagement, as we saw in the [dev fund extension](https://electriccoin.co/reaching-consensus/)). We'll see how it evolves.
> * the fact that the ZK-SNARKs they use (however mathematically beautiful), requires a trusted setup, i.e. prover key(non I/O)
Also a valid point, though this is a big part of why they have been working on Halo, a ZK scheme which does not require trusted setups and still has the benefits of succinct proofs etc.
> * the fact the SNARKS are computationally expensive and no-one uses them. Thus opt in privacy and reduced anonymity set.
These days you only need a few seconds to make a SNARK, even on a phone! But the "opt in privacy" thing is definitely a fair point; I hope that they can escape their bitcoin roots somewhat and get rid of transparent addresses and Script and that whole mess entirely at some point, but we'll see.
That's not a good thing.
The fifth amendment becomes weaker over time; and may not apply in locales outside the US.
LE can easily coerce you to reveal your viewing keys, and assume you are guilty if you don't. That would be a bug, not a feature. See recent discussion proposing that google make its expired DKIM keys publicly available.
Furthermore zk-SNARKs are the best constructions out there for confidentiality, not ring signatures, as was demonstrated many times on research on Monero
tl;dr monero does not provide that much confidentiality because the anonymity set is too small. In other words, you are only hiding your transaction among multiple ones, whereas Zcash hides your transactions among all the set of accounts.
That's literally not what Zooko said.
> I think we can successfully make Zcash too traceable for criminals like WannaCry, but still completely private & fungible.
At the very least it'd be interesting to see what exactly he meant by that. He's got enough crypto and pro-privacy cred to be worth a listen.
I paraphrased his babel in my comment for brevity.
> I think we can successfully make Zcash too traceable for criminals
a bit like:
"I think we can make this encryption algorithm too weak for criminals, but strong enough for everyone else"
> He's got enough crypto and pro-privacy cred to be worth a listen.
Not from what I understand.
What is your understanding?
It's also why I said it'd be genuinely interesting to him elaborate on that statement.
It's empirically better.
Monero uses zero-knowledge proofs for the range proof, cryptographically protects the sender, receiver and notional.
Monero uses known, audited cryptographic primitives, elliptic curve Diffie-Hellman over curve25519, EdDSA signature over the twisted Edwards variant of the same curve, libsodium.
Monero is much less likely to have a production exploit than zcash.
Are you saying if you needed to send money privately you'd actually choose Zcash over Monero?
The cryptographic primitives in zcash are also audited.
It's also the case that the cryptography underlying the next generation of zkSNARKs (which will be used by zcash) is the same as what Monero uses for range proofs; it's trustless (or low trust).
> Monero uses zero-knowledge proofs for the range proof, cryptographically protects the sender, receiver and notional.
Again, this is an over-simplification; the anonymity set is smaller, and moreover more difficult to analyze.
It sounds fairly perfect for us cypherpunks but I just know there's some blemish that I'm missing. If there's not then it makes me very hopeful for our future.
It’s not trying to provide an anonymous base for the platform though.
What do you do for a living?
Thanks in advance!
OC sounds legit but if you look at peoples credentials as proxy for trustworthiness you will get burned. Just look at the sketchy endeavors of David Chaum, for one.
Is it accurate to describe it as a fork?
In any case, I'm most concerned about the fact that there was some kind of mysterious collaborative operation [1] for the z-SNARK bootstrapping.
If Monero and ZCash have similar properties, Monero seems to be superior because it requires less trust.
[1] https://www.wnycstudios.org/podcasts/radiolab/articles/cerem...