安全与密码学2014zerocash-project.org编辑精选
Zerocash：基于 Bitcoin 的去中心化匿名支付
Zerocash: Decentralized Anonymous Payments from Bitcoin
专业 · 约 90 分钟读完前置知识：比特币交易与 UTXO、zk-SNARK 基础、密码学承诺与数字签名
导读
Zerocash 提出一种基于比特币账本、但隐藏付款人、收款人和金额的去中心化匿名支付方案，核心是用 zk-SNARK 证明交易有效而不泄露交易细节。评论指出它依赖较新的密码学假设和可信初始化，且计算/存储开销大，并与已可用的 Bytecoin 环签名方案形成对比。
HN 关注点：加密货币的匿名性与可替代性，讨论焦点是 Zerocash 的 zk-SNARK/可信初始化风险，以及它相比已可用方案是否只是炒作。
后来怎么样
Zerocash 直接催生了 Zcash，并推动 zk-SNARK 成为区块链隐私保护与后续可验证计算的重要技术路线。
HN 评论精选
这几条评论里：支持 1 质疑 1
质疑批评 Zerocash 仍属未落地且依赖新假设/可信初始化，认为已可用的 Bytecoin 环签名方案实际更实用。
看到 Zerocash 被如此炒作而 Bytecoin 被冷落，有点失望：前者仍是画饼，后者现在就能用。Zerocash 用的 CRS ZK-SNARK 很令人兴奋，但密码学假设很新且有点可疑；可信初始化尤其不幸，因为初始化被攻破会导致无上限且不可检测的增发（也许等某个利他者持有的币超过应有数量才能发现！）……影响远超交易匿名性。Bytecoin 基于简单得多的密码学——curve25519 群上的 Schnorr 环签名。它提供的匿名性理论上更有限——有点像 CoinJoin，甚至离线的人或已花掉的币也能和你混在一起——但不需要 GB 级签名密钥或数十秒签名计算，所以实际使用中可能更匿名，因为更易用。（哦，它已经投入使用，所以目前隐私性强无限倍！）目前这些匿名系统都有共同限制：都不支持剪枝，验证节点状态无限增长——相比之下比特币如果只验证新区块……
nullc查看英文原文
It's a little disappointing to see how much ZeroCash is hyped compared to Bytecoin (https://bytecoin.org/), since the former is still vaporware while the latter is something real that you can go use right now. While the CRS ZK-SNARK stuff used for ZeroCash is very exciting technology, the cryptographic assumptions are very new and kinda sketchy. The fact that there is a trusted initialization is unfortunate, especially since compromise of the initialization results in unbounded and undetectable inflation (well I suppose you can detect it once a single altruist ends up with more coins than ought to exist!). ... though it has implications which go far beyond transaction anonymity. The Bytecoin approach is based on much simpler cryptography— a schnorr ring signature in the curve25519 group. The anonymity it provides is theoretically more limited— sort of like a CoinJoin where even ofline people or even already spent coins can be joined with you—, but because it doesn't required gigabytes of signing keys or tens of seconds of computation to sign it might be more anonymous in practice just due to being easier to use. (Oh yea, and did I mention, it's already in use so at the moment it's infinitely more private! :) ) So far all of these anonymous systems have a number of interesting limitations in common. For example, none of them support any kind of pruning so a verifying node has state that grows forever— as compared to Bitcoin where if you're just verifying new blocks (as opposed to helping initialize new peers) you can forget the old state... e.g. right now a Bitcoin full verifier technically only needs about 300MBytes of storage. So this privacy stuff comes at a rather extreme cost. I've suggested some ways to improve this (basically expiring old coins), but they reduce the anonymity set and have some usability tradeoffs. In any case, it's certantly better to see things like ZeroCash and Bytecoin being worked on... I'm really skeptical about the wisdom of splitting up the crypto-currency adoption network effect just to introduce some new transaction features. But certantly doing it with substantive new features is way better than just-another-worthless-clone. ... especially when there is running code and not merely a whitepaper. :)
支持强调交易不可关联和货币同质性，担忧比特币币验证导致审查，看好 Zerocash 与 Chaumian 代币并存。
对我来说，这是比特币/区块链世界最有趣的东西。我总体上喜欢加密货币理念（约 1992 年同时对计算机、密码学、安全和密码朋克感兴趣），但如果没有让每笔交易不可关联、从而保持货币同质性的东西，我觉得比特币之类相比 Chaumian 盲签名代币是退步。普通比特币存在币验证的潜力，一旦有技术可能性，就可能变成强制；一旦发生，即使起初是为了防止大额盗窃这种“好事”，也可能演变成审查。有了 zerocash，我可以想象基于区块链的匿名系统共存：低吞吐、高持久性的系统主要走区块链技术，高吞吐、非内在去中心化的系统则做自己的 Chaumian 盲签名货币。而且“货币”不只用于人类支付，还用于多种资源分配。
rdl查看英文原文
This is, for me, the single most interesting thing in the Bitcoin/Blockchain world. I love the idea of Cryptocurrencies in general (and got interested in computers, cryptography, security, and cypherpunks around the same time in ~1992), but without something which makes every transaction unlinkable, and thus preserves fungibility of the currency, I find things like Bitcoin a step back from Chaumian blinded tokens. There's the potential for coin validation in regular bitcoin, and once there's technical potential, it can become mandated. Once that happens, even if it starts for something "nice" like preventing large thefts, it can turn into censorship. With zerocash, I could see blockchain-based anonymous systems coexisting for low-throughput, high-persistence systems mainly going to blockchain tech, and high-throughput, non-inherent-decentralized systems doing their own Chaumian blinded token currencies. And "currencies" not just being used for human payments, but lots of forms of resource allocation.
历次讨论
- 2014Hacker News 讨论帖156 分 · 57 评
同领域还值得读
如何入侵一台已关机的电脑：在 Intel ME 中运行未签名代码
How to hack a turned-off computer, or running unsigned code in Intel ME
这篇 Black Hat 2017 白皮书讨论 Intel Management Engine（ME）的安全问题：如何在 ME 中运行未签名代码，以及攻破处于关机状态的电脑的相关…
安全与密码学2017 · 543 分 · 107 评专业 · 约 40 分钟编辑精选比特币：一种点对点的电子现金系统（2008）
Bitcoin: A Peer-to-Peer Electronic Cash System (2008)
中本聪 2008 年发表的比特币白皮书，提出了无需可信第三方的点对点电子现金系统。
安全与密码学2017 · 536 分 · 394 评入门 · 约 45 分钟编辑精选GPRS 加密算法 GEA-1 的密码分析表明存在故意弱点
Cryptanalysis of GPRS Encryption Algorithms GEA-1 suggest intentional weakness
首次公开了对 GPRS 加密算法 GEA-1 和 GEA-2 的密码分析攻击。
安全与密码学2021 · 487 分 · 107 评专业 · 约 90 分钟编辑精选Signal 消息协议的形式化安全分析
A Formal Security Analysis of the Signal Messaging Protocol
用形式化方法分析 Signal 消息协议（TextSecure）的安全性：作者在多阶段密钥交换模型下，借助自动化证明工具对协议的密钥协商与 Double Ratchet 密钥更新…
安全与密码学2016 · 353 分 · 230 评专业 · 约 120 分钟编辑精选A2：模拟恶意硬件
A2: Analog Malicious Hardware
论文研究如何在芯片设计阶段植入模拟电路形式的恶意硬件后门，使其难以被常规检测发现。
安全与密码学2016 · 315 分 · 94 评专业 · 约 75 分钟编辑精选