Bitcoin Markets Blog

Last week, I mentioned that CoinJoin was just one of the major approaches being taken toward anonymity in cryptocurrencies; zero-knowledge proofs and ring signatures being the two other major approaches.  I'd like to take some time to compare and contrast these three approaches but, before that, why does anonymity even matter? When we think of anonymous transactions there is this connotation/undertone of illegal or bad behavior.  Yet, where anonymity would enable illegal activity, it would still be no different than cash.  But moreover, there are also perfectly legal reasons for why a person might want to disassociate from his or her transactions.  For example, in a country where drugs, gambling, or prostitution is legal but carries a negative social stigma, a person could use anonymous transactions to make payments without associating themselves to the activity.  In military operations, undercover agents in hostile and watchful environments could be paid and funded through anonymous value transfers.  On the other hand, there are times when not using anonymous transactions is preferable.  if you were paying your taxes and would like a very clear paper-trail for the auditors to examine if they come knocking.  My point is that different transaction types are useful for different things and we should allow people to choose what they want to use and we should allow the market to decide on the relative values of competing currencies with different transaction types.  Also, from a different perspective, illegal activity (e.g. drugs, subverting capital controls) can serve as a strong bedrock of support for the price and market cap of a cryptocoin even if you are personally against those activities.  Suppose you were an investor in 2001 before Apple released their first Ipod.  You believe that huge swaths of people will buy the Ipod to store their illegally downloaded music and thus sales will outperform expectations.  As an investor, it would be smart to buy AAPL even if you were personally opposed to illegal file sharing.  My point is that you should consider entire market demand for an asset and not just "legitimate" demand when estimating valuation.  

Many altcoins are just bitcoin clones with a few different settings for block generation time, number of total coins, etc. and occasionally a small innovation on how hashing or difficulty adjustment is done.  Most of these altcoins are not sufficiently differentiable or innovative to win against the network effects of bitcoin which already has such a large first-mover advantage.  However, sufficiently novel and innovative altcoins could become serious contenders for bitcoin in a few years.  Another signal of an altcoin's potential value is the quality of its development team.  Bitcoin has many powerhouses on its core development team while many of these clonecoins have the "get-rich-quick-type" of folks.  As technical issues and scalability problems arise over time, whether a cryptocoin can survive may depend on the abilities of its core team (often it will depend only on their foresight).  Given that the anonymity question is a difficult technical challenge, those working on it will likely be very capable (this belief is supported by how technically advanced the whitepapers for cryptonote and zerocash are).  Arguably, one of the reasons bitcoin was so extremely undervalued for such a long time was because it was hard to understand how bitcoin works (and it it were easy, it would have already been done).  For those reasons, keeping an eye on these anonymous cryptocoins seems worthwhile.

So now lets talk about Zerocash/Zerocoin/sk-SNARK.  Here's the whitepaper (but don't bother reading it; it's indecipherable): http://bit.ly/1qZQQU7.  As background, Zerocoin was originally supposed to be an extension of bitcoin before the Zerocoin team decided to build a new crypto altogether.  On May 18, they released the whitepaper on Zerocash.  To understand Zerocash, we should take a moment to understand zero-knowledge proofs.  A zero-knowledge proof is a proof of a statement which reveals no information about anything apart from the fact that the statement is true.  Let's take an example.  Suppose Peggy wants to prove to Victor that she owns 10 BTC.  She could point to 10 BTC in the blockchain and then move them all to a predetermined address and have Victor verify that it happened.  This is not a zero-knowledge proof because Peggy revealed to Victor which coins were her coins instead of the general fact that she owns 10 unspecified BTC.  A zero-knowledge proof would entail Peggy proving to Victor that she owns 10 BTC without revealing which 10 BTC.  The Zerocash construction relies on constructing these types of zero-knowledge proofs.  Here is a high level metaphor with a some hand-waving for how this works: Alice has 10 coins.  She sends 10 coins into the void getting back a receipt that shows she sent 10 coins into the void.  At some later date, she can redeem the receipt for any 10 coins which have been sent to the void (not her own coins).  The receipt is a zero-knowledge proof of Alice having sent 10 coins to the void.  There is some hand-waving here because apparently the amount itself can also be obscured.  Of the three main approaches to anonymity, Zerocash is the most anonymous.  There are a few drawbacks to the Zerocash approach.  Whatever party (e.g. Zerocoin Team) holds the private key used to initialize the accumulator must be trusted to destroy it.  Also, since the entire economy is obscured, if anything does go wrong, no one will know that the protocol has been compromised.  This would be as if in bitcoin, whoever holds the private key of the genesis block can just print bitcoins on discretion and no one notices what's happening because the blockchain is invisible.  This is a serious issue.  That's why many people think ring signatures are the most promising approach to anonymity.