Hacker News Reader

Comment by kobeya | Hacker News Reader

> There's gotta be a way to do consensus about zero-knowledge proofs that's a little more... you know ... decentralized.

Not really, no. There is no known scheme that has similar properties but non-trusted setup. There's not a proof that it's impossible either, so something might get invented. But at the moment, no.

That said I share the criticism. Even with trusted setup it could have been done much better.

View on HN

If I understand correctly a recent presentation by Eli Ben-Sasson, one of ZCash's scientists, there is now at least one ZK system with this 'transparent' property (needing no trusted setup), but it is not yet practical for a blockchain currency. See Ben-Sasson on "STARK": https://www.youtube.com/watch?v=HJ9K_o-RRSY

Maybe. The STARK paper hasn't been published yet as far as I know. All we have is claims.

Well, as I said, there's gotta be a way. It just has to be invented and tried :)

> There is no known scheme that has similar properties but non-trusted setup. There's not a proof that it's impossible either, so something might get invented. But at the moment, no.

Already invented. It's called MimbleWimble.

... that's a system with entirely different properties.

And? It provides privacy.

With a very different set of tradeoffs. MW does not provide anonymity. It provides, at best, pseudo-anonymity with coinjoin mixing by default, with N=2 in the implementations being considered. Careful repeated application with the right counter-parties can compound that into larger anonymity sets. That's a step forward from bitcoin, for sure. And if you're very careful, it could achieve whatever privacy requirement you might have.

The Zcash-like approach on the other hand is to provide a transaction mode where your anonymity set is everyone who has ever transacted with the system before. That's N=everybody; the source of funds is entirely obscured.

The two achieve totally different goals, with a different set of tradeoffs. Apples to oranges.

I’m a massive MW proponent but the privacy claims are very weak compared to ZCash and Monero. What MW does well is scalability.

Reply on news.ycombinator.com