Selective transparency in Monero vs Zcash

Question

How does the view key functionalist in Monero compare to the view key functionality in Zcash?

Does one system review more or less transaction details than the other? What are the differences?

Answer 1

This question boils to down which selective transparency options both coins offer. I'll start with Monero. In Monero there are three tools for selective transparency, namely the viewkey (called the tracking key in the CryptoNote whitepaper (a,B)), key images (I = xHp(P)), and the private tx key (r). Note that the letters between parentheses correspond to the letters presented in the CryptoNote whitepaper.

1. The viewkey allows you to see all incoming transactions for a certain account, but not outgoing transactions. More background information as to why can be found here.

2. The key images allow you to see all outgoing transaction for a certain account. Thus, with a combination of the viewkey and the key images, you will be able to infer a balance of a certain account.

3. The private tx key can be used as prove of payment on a case by case basis. That is, in case of a dispute, you can prove that you paid the receiver by publishing the private tx key (which you can obtain from the wallet), the transaction ID, and the receiver's address. An auditor can subsequently verify that you paid the receiver.

Basically 1 & 2 are important for auditing certain accounts (e.g. businesses and charities), whereas 3 is important in case of disputes.

There are, however, also a few things to note:

1. You cannot fake a balance by giving the view key to an auditor but omitting some transactions and key images. For more information, see here.

2. Instructions on how to prove a balance of a certain account can be found here.

3. The viewkey and key images won't show an auditor which address the account received the funds from or paid the funds to, respectively.

4. For this bulletpoint I will quote Luigi:

   Oh, and a quibble. Revealing r (the private tx key) doesn't prove that you paid someone, only that that someone has received money. In practice, in an actual dispute, you'd be referencing a particular destination and TXID to a 3rd party, which would come much closer to proving to said 3rd party that you paid the recipient in question.

---

Now back to Zcash. As far as I know, in Zcash the only option for selective transparency currently is a key that is similar to Monero's private tx key. This makes auditing a certain account virtually impossible.

Answer 2

In fact Zcash does have viewing keys that allow to see all incoming transactions for a certain address. There is also a straightforward way to do proof-of-payment without changing the protocol, although we haven't implemented any RPC interface for that yet: https://github.com/zcash/zcash/issues/737 . Note that a proof of payment necessarily must be interactive, since otherwise it would be replayable and therefore would only be a proof of receipt, as you say. (Zcash can do proof of receipt as well, although with a limitation described in https://github.com/zcash/zips/issues/93 .)

An earlier version of the Zcash protocol spec described how to support decryption of outgoing transactions; see the orange text in https://github.com/zcash/zips/blob/406.derive-skenc-from-avk.0/protocol/protocol.pdf . This functionality was stripped out mainly because we didn't have time to implement it before launch (and also some disagreement with Matthew Green about the resulting security properties): https://github.com/zcash/zcash/issues/406#issuecomment-193561016 I have a pretty good idea how to add it back, and it's high on our priority list for future features.

Update, January 2018:

• Incoming viewing keys have been in the protocol since launch, but RPC support was added in Zcash v1.0.14.
• Payment disclosures were added as an experimental feature in v1.0.13, likely to be finalized in v1.0.15.
• Support for full viewing keys (capable of also viewing outgoing payments for an address) will be in the Sapling upgrade, scheduled for activation in September 2018.