Privacy by Design

Monero, Zerocoin, Zerocash

Prevent Double Spending

linkable ring signatures
one-time ring signature
unique key image

Protocol

Mint Transaction

generate random serial number $S$
generate random number $r$
mint coin: $C = H(S, r)$
commit to blockchain (Pedersen Commit)
consumes 1 Basecoin (input of TX)

Protocol

Spend Transaction

reveal $S$ (proof that not spend before)
publish zero-knowledge proof:

I know a $r$ such that $H(S, r)$ is one of the Zerocoins in blockchain
use any Zerocoin as TX input
consumes one Zerocoin and produces new one

Zero-Knowledge Proofs

Peggy proofs Victor that statement $S$ is true without conveying any information

used for authentication mechanisms without password transfer
usually: interactive challenge response
stronger validity by repetition

zk-SNARK

Zero-Knowledge Succinct Non-interactive ARgument of Knowledge

zero-knowledge proof
succinct: short and easy to verify
non-interactive:
- common reference string initial setup
argument $\neq$ proof
of knowledge: that coin exists

1.1

Privacy by Design Monero, Zerocoin, Zerocash

Sebastian Endres - Privacy-by-Design (e.g. Monero, Zerocoin, Zerocash) - Seminar Blockchain