News for hackers. Stuff that matters.
Re:Zerocoin: making Bitcoin anonymous by Flenser on Friday April 12, 2013 @05:40AM (#5537457)
I don't understand how once the zero coin's serial number is revealed in the spend transaction it can remain anonymous. Can't you then go back and test previous mint transaction to see if it was for that serial number? If you're doing it continuously, so you keep a record of which mint transactions you know have been spent it would reduce the workload.
Re:Zerocoin: making Bitcoin anonymous by anologwintermut on Friday April 12, 2013 @11:35AM (#5539052)
The coin is a commitment to the serial number. Specifically the coin is g^s * h ^ r where g and h are generators of a group where the discrete log problem is hard, s is the serial number and r is some random number known only to the minter. If you only reveal the serial number and not the randomness, there is no way to know which coin it came from. In fact for any coin c there exists an r' such that c=g^s h^r'. As such, if you only know the serial number and not random r, it is equally likely to be any coin.

The zero knowledge proof ensures no one learns r.

Re:Zerocoin: making Bitcoin anonymous by gizmo686 on Friday April 12, 2013 @07:53AM (#5537901)
The serial number is never revealed. You provide a zero knowledge proof that you know a serial, and that that serial has never been spent. This proof is currently a major issue in zerocoin, because it is prohibitivly large.