ZeroCoin
ZeroCoin [8] is one of the first cryptographic extensions of Bitcoin that aims at enhancing its privacy. It was introduced by Miers et al. in [8] to remedy the fact that Bitcoin enables the public tracing of coin expenditure in the network.
ZeroCoin leverages ZKPoP protocols and cryptographic accumulators to implement a cryptographic mixer. More specifically, ZeroCoin resets the history of a BTC by transforming it into a ZeroCoin coin referred to in the sequel by ZC. During this conversion, ZCs are added to a cryptographic coin mixer (essentially an accumulator) that is publicly available.
The resulting ZCs can be proven in zero-knowledge to have originated from valid and unspent BTCs (i.e., that they are part of the unspent subset of coins in the mixer). In this way, an entity is prevented from linking a transaction with the BTC (and the corresponding address) that generated the zc used therein. In other words, ZeroCoin ensures that the origin of a zc is hidden among all BTCs that were converted to eZCs. In addition, ZeroCoin preserves the payment security guarantees of Bitcoin (e.g., double-spending resistance). That is, no party can spend more BTCs or ZCs than the ones he or she possesses.
Protocol specification: ZeroCoin consists of the following procedures: Setup, where the system parameters are set, the Mint operation, where a Bitcoin (BTC) is converted to a ZeroCoin (ZC), the Spend operation, where a ZC is spent/deposited to Bitcoin address, and automatically converted to a fraction of a BTC, and the Verify operation, through which Bitcoin peers can verify the validity of the ZC transaction and include it in a block. More specifically,
- • params — ZC.Setup(1k), where k is the security parameter. params include a group G of RSA modulus and of order o and its generators g, h : (g) = (h) = G.
- • {pkzc, skzc} — ZC.Mint(params, btc), through which a BTC btc is converted to a fixed ZeroCoin value zc with secret information skzc and public information pkzc. On can see this operation as a conventional Bitcoin transaction, where the converted btc is the input and the output is pkzc, that uniquely defines the generated zc. Thus, the miners check again whether btc is valid (i.e., whether it is owned by the address that has signed the transaction and it has not been spent before by that address). If btc is valid, then the pkzc included in the transaction is included in the next block. All the zc-public information that are included in blocks are added in an accumulator Acc.2 Public pkzc included in the transaction is a Pedersen commitment to a serial number s of the form
where r ——R G. The secret information related to zc is set to skzc = (s, r) and is partially revealed in the ZC.Spend operation.
- • {n, s} — ZC.Spend(params, skzc, pkzc, Acc), which is performed by the user who wishes to spend a zc with public information pkzc. To do so, the user reveals s and computes a ZKPoK n that s corresponds to a zc that has been confirmed in a block (i.e., is part of the accumulator). As such, ZeroCoin can be integrated in existing Bitcoin transactions without modifications: (s, n) constitute the inputs to a standard Bitcoin transaction, which takes as output a regular Bitcoin address. This special transaction contains a signature of knowledge
- 2 Note that the accumulator value is computed by the peers locally. Given the public parameters of the accumulator, and the confirmed ZC, each peer can locally compute the accumulator value at any point in the blockchain.
produced by n, and is released in the network to be confirmed in a block.
• {n, s} ^ ZC.Verify(params, s, n, Acc), which can be executed by every peer in the Bitcoin network to verify whether the signature of knowledge deriving from ZKPoK n is valid and that the serial number s has not been used before (and thus that the corresponding zc has not been spent before). Verified pairs of n, s are included by the Bitcoin miners in the next generated block, to establish their validity to all Bitcoin peers.
Limitations: In ZeroCoin, each ZC corresponds to exactly one (or a predefined number of) BTC; transactions whose values are larger than one BTC would therefore result in several back-to-back ZeroCoin transactions. This results in considerable overhead in propagating the corresponding transactions in the network and including them in valid blocks.
Furthermore, while ZeroCoin prevents the traceability of constant value coins, it does not conceal the transaction amounts; multiple ZC spendings for the same payment are likely to be linked in time and the total amount per payment can be retrieved (since each ZC corresponds to a single BTC).
Furthermore, ZeroCoin does not hide the total number of BTCs redeemed by Bitcoin addresses when the owners of these addresses transform their ZCs back to BTCs. As mentioned earlier, recent studies [3] have shown that tracing coin expenditure is not the only source of information leakage in Bitcoin. More specifically, Androulaki et al. have shown in [3] that behavior-based clustering algorithms can be used to acquire considerable information about the user profiles in Bitcoin. These algorithms mainly leverage user spending patterns, such as transaction amounts, transaction times, and so on in order to profile users. Clearly, ZeroCoin does not prevent such analysis, since the transaction times, transaction amounts, and address balances can still be derived from the blockchain.
