I am interested in creating a cryptocurrency which keeps the sender, the receiver and the amount private and does not require a trusted setup.
- I have already read the Zerocash protocol but It uses zk-SNARKs which require trusted setup.
- I have also read the Bulletproofs protocol which creates short proofs and without a trusted setup so it would be great to use it.
The problem is that Zerocash creates commitments and calculates the address public key using hash function. I would like not to have to prove that a hash function was computed correctly because the proof would be long ans slow.
The second problem is that in Zerocash the sender proves that he owns that address private key and some random numbers such that they combined create a commitment that exists in the Merkle-tree of previous created coin commitments. I cannot find any protocol for proving set membership of a commitment C ϵ S that I know it’s opening; I can only find the opposite (i.e. to prove that one item x ϵ S is the opening of a commitment C).
- Is it possible to prove that I know an opening x of a commitment C ϵ S without revealing neither the x nor the C and without a trusted setup?
- Is it possible to create/link the address public and the address private without a hash function such that the sender can create that commitment with the address public and the receiver can prove the above with the address private key? What type of commitment would be possible?
- How Is possible to fit the coin’s value and the nullifiers to all this? Does a cryptocurrency like that exist?
Links to technical papers are welcome.
If this questing best fits in bitcoin.stackexchange.com please let me know.