2
$\begingroup$

I am interested in creating a cryptocurrency which keeps the sender, the receiver and the amount private and does not require a trusted setup.

  • I have already read the Zerocash protocol but It uses zk-SNARKs which require trusted setup.
  • I have also read the Bulletproofs protocol which creates short proofs and without a trusted setup so it would be great to use it.

The problem is that Zerocash creates commitments and calculates the address public key using hash function. I would like not to have to prove that a hash function was computed correctly because the proof would be long ans slow.
The second problem is that in Zerocash the sender proves that he owns that address private key and some random numbers such that they combined create a commitment that exists in the Merkle-tree of previous created coin commitments. I cannot find any protocol for proving set membership of a commitment C ϵ S that I know it’s opening; I can only find the opposite (i.e. to prove that one item x ϵ S is the opening of a commitment C).

  1. Is it possible to prove that I know an opening x of a commitment C ϵ S without revealing neither the x nor the C and without a trusted setup?
  2. Is it possible to create/link the address public and the address private without a hash function such that the sender can create that commitment with the address public and the receiver can prove the above with the address private key? What type of commitment would be possible?
  3. How Is possible to fit the coin’s value and the nullifiers to all this? Does a cryptocurrency like that exist?

Thanks.

P.S.
Links to technical papers are welcome.
If this questing best fits in bitcoin.stackexchange.com please let me know.

Improve this question
$\endgroup$
1
  • 3
    $\begingroup$ It used to be welcome on BitCoin, but they've narrowed their scope. While we do accept generic cryptographic questions, the number of crypto currency experts is relatively low here, so we're struggling a bit with the problem. As this is about the cryptography within the cryptocurrency, we do view such questions as on topic though. $\endgroup$
    – Maarten Bodewes ♦
    Apr 1, 2020 at 14:11

1 Answer 1

Reset to default
1
$\begingroup$

The cryptocurrency you're describing does currently exist and implements, among other features, using unique Spend/View Keys in Monero (XMR). It capitalizes on a number of clever cryptographic techniques to implement a hardened total anonymization of source/destination (Ring Signatures/Stealth Addresses) and quantity (Ring Confidential Transactions/Bulletproofs).

It has also focused on maintaining a robust decentralized network via the (previously CryptoNote, GPU-optimized) RandomX PoW algorithm (CPU-optimized) that is highly ASIC-resistant, maintaining an optimal network dissemination by preventing any mining dominance by any centralized entity.

The original PoW and subsequent whitepapers can all be found at the webpage for the Monero Research Lab: https://web.getmonero.org/resources/research-lab/

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.