I read the zcash paper recently. But I have been puzzled by a question. How did the authors prove that the coin commitment appears as a leaf of a Merkle tree with root rt? Apparently, the authors provided authentication paths for a commitment. But how to provide them in a private way?
$\begingroup$
$\endgroup$
