Explaining the Security of Zcash
summary
Deep dive into Zcash security claims: protocol proves balance and spendability via note commitments, nullifiers, and a binding signature layered over homomorphic value commitments, with a game-based adversary model that captures rollbacks and front‑running. Orchard-specific derivations (commit_ivk, dk/ovk, ZIP32) aim for knowledge soundness and post‑quantum view consistency; a discovered risk class is the fairy‑gold attack (duplicate openings that spoil spendability). Explicit leakage list (anchor, expiry, fee, number of actions) and warning that complex zk circuits can still harbor implementation bugs.
AI-written summary · about
chapters (20)
- 0:00Start
- 1:01Goals of this Talk
- 4:12Why Do We Need Strong Frivolity Properties
- 10:14Auditable Anonymous Electronic Cash
- 13:07Shielded Orchard Transaction
- 13:44Homomorphic Value Commitments
- 14:33Binding Signature
- 14:59Furry Gold Attack
- 17:01Note Commitment Tree
- 20:03Non-Reliability
- 25:14Diversified Addresses
- 26:16How To Define the Effects of a Transaction
- 31:24Annotated Ledger
- 36:02Issuance of a Coinbase Transaction
- 39:48Security Argument for Balance
- 45:14Spendability
- 51:19View Consistency
- 51:37Key Separations
- 56:12Zip32
- 1:01:06Dusting Attack
related talks
48mSoK: Programmable Privacy
54mHalo2 circuit changes for Zcash Shielded Asset and Atomic Swaps
17mZconnaissance - Sketching a Shielded Assets Future
28mZcash Sustainability and Resilience
39mZSAs and Swaps--A Status Report
01h 01mEcosystem Updates
56mCollaborative zk-SNARKs: Proving as One over Distributed Secrets
41mThe Future Is Trustless: How ZkVMS And ZkTLS Transform Bug