Zerocash Decentralized Anonymous Payments from Bitcoin

1. ZerocashDecentralized Anonymous Payments from Bitcoin Eli Ben-Sasson (Technion) Alessandro Chiesa (MIT) Christina Garman (JHU) Matthew Green (JHU) Ian Miers (JHU)Eran Tromer (Tel Aviv University) MadarsVirza (MIT) zerocash-project.org IEEE Symposium on Security and Privacy 2014 20 May 2014

2. Bitcoin’s privacy problem 0110010010 1010101100 Bitcoin: decentralized digital currency. What’s to prevent double-spending? 0110010010 1010101100 0110010010 1010101100 0110010010 1010101100

3. Bitcoin’s privacy problem 0110010010 1010101100 Bitcoin: decentralized digital currency. What’s to prevent double-spending? Solution: broadcast every transactioninto a public ledger (blockchain): 0110010010 1010101100 • From:To:Value: 17 • From:To:Value: 11 • From:To:Value: 11 • From:To:Value: 5 0110010010 1010101100 00010111000010001100 0100011100 1011101100 0111010010 1010001100 The cost: privacy. • Consumer purchases (timing, amounts, merchant)seen by friends, neighbors, and co-workers. • Account balance revealed in every transaction. • Merchant’s cash flow exposed to competitors.

4. Bitcoin’s privacy problem (cont.) • From:To:Value: 17 • From:To:Value: 11 • From:To:Value: 11 • From:To:Value: 5 • Pseudonymous, but: • Most users use a single or few addresses • Transaction graph can beanalyzed.[Reid Martin 11] [Barber Boyen Shi Uzun 12] [Ron Shamir 12] [MeiklejohnPJLMVS 13] 0110010010 1010101100 00010111000010001100 0100011100 1011101100 0111010010 1010001100 • Also: threat to the currency’s fungibility. • Centralized: reveal to the bank. • Decentralized: reveal to everyone?!

5. Past attempts at Bitcoin anonymity • Trusted mix (but: operator can trace/steal) • Zerocoin: decentralized mix service for Bitcoin[Miers Garman Green Rubin 13] Limitations: • Performance: 45 kB/spend (to be broadcast, verified, and stored in blockchain), take ~0.5 s to verify. (for 128-bit security) • Single denomination(undivisible) reveals amount • Reveal payment destinations; no direct transfer • Requires explicit “laundry” process. • Pinocchio Coin: variant using “Pinocchio” ZK proofs:344 B/spend [DanezisFournetKohlweissParno 13] • Scalability problem: spend time grows linearly with #coins • Still single denomination, reveals amount, reveals destination, explicit. • CoinJoin and various other mixing/pooling solutions • Goal: fully preserves privacy, efficient, transparent, always on.

6. Zerocash: divisible anonymous payments • Zerocashis a new privacy-preserving protocol for digital currency designed to sit on top of Bitcoin(or similar ledger-based currencies). • Zerocashenables users topay one another directlyvia payment transactions of variable denomination thatreveal neither the origin, destination, or amount. • ? • ? • ? • ? • ? • ? • From:To:Value: 17 • From:To:Value: 17 • From:To:Value: 17 • From:To:Value: 11 • From:To:Value: 11 • From:To:Value: 5

7. Zerocash: in proofs we trust I got the money from last night, and I haven’t spent it in any of myprior transactions. “17 ” accountant’ssignature ZK proof Intuition: “virtual accountant” using cryptographic proofs.

8. More about Zerocash • Efficiency: • 288 proof bytes/spend at 128-bit security level, • <6 ms to verify a proof • <1 min to create for 264coins; asymptotically: log(#coins) • 896MB “system parameters”(fixed throughout system lifetime). • Trust in initial generation of system parameters (once). • Crypto assumptions: • Pairing-based elliptic-curve crypto • Less common: Knowledge of Exponent [BonehBoyen 04] [Gennaro 04] [Groth 10] • Properties of SHA256, encryption and signature schemes

9. The Zerocash scheme

10. Basic anonymous e-cash [Sander Ta-Shma 1999] • I hereby spend 1 BTC to create Minting: • I’m using up a coin with (unique) , andI know , and a in the tree with ,that match . • I’m using up a coin with (unique) ,and here are its and . Spending: CRH CRH CRH (coin commitment) CRH CRH CRH commit CRH (serial number) Legend: In private wallet In public ledger Proved to be known

11. Basic anonymous e-cash – requisite proofs • I’m using up a coin with (unique) ,and I know a in the tree, and ,that match . Spending: Requires: zero knowledge (coin commitment) succinct noninteractive commit argument proof of knowledge (serial number) zkSNARK

12. zkSNARK constructions for any NP statement Without trusted setup: • Theory [BFLS 91] [Kilian92] [Micali 94] […PCP…]]Ben-SassonChiesaGenkinTromer 13] With trusted setup: • Theory [Groth 10] [Lipmaa 12] [Gennaro Gentry ParnoRaykova13] [BitanskyChiesaIshaiOstrovskyPaneth 13] • Implementations[Parno Gentry Howell Raykova 13] [Ben-SassonChiesaGenkin Tromer Virza 13] [Ben-SassonChiesa Tromer Virza 14] zero knowledge succinct noninteractive argument of knowledge zkSNARK SCIPR Lab Underlying zkSNARK used in Zerocash

13. zkSNARKwith great power comes great functionality (coin commitment) commit (serial number)

14. Adding variable denomination • I hereby spend BTC to create,and here is to prove consistency. Minting: • I’m using up a coin with value (unique) , andI know that are consistent with . Spending: zkSNARK (coin commitment) commit (value) commit (serial number)

15. Adding direct anonymous payments CreateAddress: payee creates I’m using up a coin with value (unique) , andI know that are consistent with . Minting, spendinganalogous to above. Unknownto payer Sending? (coin commitment) (serial number) commit PRF (value) commit (serial numberrandomness)

16. Sending direct anonymous payments Create coin using of payee. Send coin secrets () to payeeout of band, or encrypted to payee’s public key. (coin commitment) (serial number) Known to payee commit PRF (value) commit (serial numberrandomness)

17. Pouring Zerocash coins Simplified Single transaction type capturing: Sending payments Making change Exchanging into bitcoins Transaction fees dest1 dest2 Pour old Zerocash coin new Zerocash coin value to dest1 new Zerocash coin old Zerocash coin value to dest2 public bitcoins of value proof the old coins were valid, and values of old coins = + +

18. Pouring Zerocash coins Simplified Single transaction type capturing: Sending payments Making change Exchanging into bitcoins Transaction fees dest1 dest2 Pour old Zerocash coin new Zerocash coin value to dest1 new Zerocash coin old Zerocash coin value to dest2 public bitcoins public bitcoins of value of value proof proof the old coins were valid, and values of old coins = + +

19. Example of a Zerocash Pour transaction • ~1KB total. Less without direct payments and public outputs.

20. Decentralized Anonymous Payment (DAP) system Algorithms: SetupCreateAddress MintPour VerifyTransactionReceive Security: • Ledger indistinguishabilityNothing revealed beside public information, even by chosen-transaction adversary. • Balance Can’t own more money than received or minted. • Transaction non-malleabilityCannot manipulate transactions en route to ledger.(Requires further changes to the construction.)

21. Implementation

22. Trusted setup • Setup generate fixed keys used by all provers and verifiers. • If Setupis compromised at the dawn of the currency, attacker could later forge coins. • Ran once. Once done and intermediate results erased, no further trust (beyond underlying cryptographic assumptions) • Anonymity is unaffected by corrupted setup. • Practical trustworthy protocol for running Setup?

23. Open research problems • zkSNARKs can enforce policies and regulation in a privacy-preserving, corruption-proof way. • What policies are desireable and feasible? I’m using up a coin with value (unique) , andI know that are consistent with and I paid 10% taxand put my name in escrow with an authorized notary. • Other Bitcoin applications • Blockchain compression • Turing-complete scripts/contracts • Proof of reserve • Eliminating trusted setup.