Zerocash: Decentralized Anonymous Payments from Bitcoin

Reviewer: Subhankar Ray

Bitcoin and its underlying blockchain technology have solved the Byzantine generals problem [1]. However, blockchain associated with the Bitcoin currency is a public ledger, and it does not provide the basic privacy offered by financial transactions that the world is accustomed to. Several researchers have shown that the parties involved in a Bitcoin transaction can be identified even after significant efforts by the transacting parties to keep themselves anonymous [2]. To keep the transacting parties anonymous, Miers et al. proposed Zerocoin with significant performance issues, restrictive fixed denomination, and lack of anonymity for the metadata related to the transaction. However, Zerocoin is a process to add anonymity to Bitcoin [2]. Hence, it can take advantage of the critical mass and infrastructure of a Bitcoin ecosystem. Zerocash, described in this paper, has solved the limitations of Zerocoin, and it is a serious invention using zero-knowledge succinct non-interactive arguments of knowledge (zk-SNARKs). There have been a few other zero-knowledge-related algorithms like zero-knowledge interactive/non-interactive (for example, Feige-Fiat-Shamir identification scheme), statistical zero-knowledge, computational zero-knowledge, and others. It would be nice to know if those could have been used, or what their shortcomings are. There are several challenges that Zerocash must overcome for practical use, such as full integration with Bitcoin, the need to use a public trusted party, and the abandonment of blockchain-based double spending prevention [3]. In section 6, sub-section C, the author proposes Tor (or mixnets) for Internet protocol (IP) level anonymity. It was not clear if this is only needed to integrate with existing ledger-based currency, or if it is a requirement for the anonymity for any Zerocash system. Zero-knowledge protocols must have a property of knowledge and soundness, which means that "if the statement is false, no cheating prover can convince the honest verifier that it is true, except with some small probability" [4]. One may wonder if even a "small probability" is too much for financial transactions. This is a complex field at the intersection of theoretical computer science and mathematics (a limited number of researchers mostly in academia understand it very well, and skill sets in this area will be hard to find). The abstract states, "We construct a full-fledged ledger-based digital currency"; however, the experiments in section 7 use a Bitcoin network. It is not clear why the authors have not performed a simulation using only a Zerocash network. This paper is a significant research work. Online Computing Reviews Service