59

How does Monero privacy compare to Zcash? What are the key security risks associated with each design?

Since important Monero improvements are in active development and Zcash has yet to launch, please compare a working RingCT Monero implementation with Kovri against the Zcash design in its whitepaper and more recently updated protocol specifications.

57

As described by Monero Research Lab academic Shen Noether with regard to the anonymity set:

Monero (although the zcash proponents note that a ring signature is a "smaller" anonymity set, they usually don't mention that the stealth address factor actually means that each transaction is masked, whereas the ring signatures provide additional plausible deniability, furthermore, since keys appear in different ring signatures in different blocks in time, the anonymity set for when a given key is spent grows infinitely, and could eventually grow larger than the zcash anonymity set at any fixed instant in time) vs Zcash (anonymity set is the entire blockchain)

The above quote demonstrates that while a Monero ring signature may be a "smaller" anonymity set, stealth addresses mask the receivers identity while the ring signature guarantees plausible deniability. When RingCT is activated in January, 2017 the amount of Monero spent in each RingCT transaction will also become protected.

Zcash uses much newer zero-knowledge proof cryptography called zk-SNARKs. Thanks to zk-SNARKs nodes do not need to store signatures or public keys forever on the blockchain. All transaction data is completely private, including metadata which is encrypted:

Instead of publicly demonstrating spend-authority and transaction values, the transaction metadata is encrypted

Ring signatures are much older than zk-SNARKs and have had many years of extensive peer review. With RingCT, which combine Monero ring signatures and Confidential Transaction As developed for Bitcoin by Greg Maxwell Monero transaction amounts will be hidden and Kovri (I2P C++ implementation) will hide IP addresses. MRL has spend a lot of time researching RingCT and Monero now has funded an experienced full time I2P developer to work Kovri.

Perhaps the biggest security risk with Zcash is the possibility of collusion among those participating in the trusted setup. If all parties involved in the "trusted setup collude (either willingly or under duress) then there would become a possibility for the creation of an unlimited number of coins without detection. Zcash is so private that even the coin supply cannot be verified if the trusted setup described above fails.

Monero did not require a "trusted setup" and total coin supply is easily verifiable on the blockchain in real time. Therefore any exploit altering the Monero coin supply (other than ordinary coinbase transactions) would immediately be noticed.

More details on trustless vs trusted systems and the risks associated with a trusted setup can be found here. In the case of Zcash, only six people participated in the trusted setup process:

The ceremony used a multi-party computation protocol with the property that the resulting parameters are secure unless all of the participants were dishonest or compromised during the ceremony.

This setup process has been received a lot of criticism, and even some critique from one of the best known Zcash advisors, Vitalik Buterin but with a subsequent edit to clarify that he still thinks the risk of compromise is quite low:

I actually recommended a different process for the trusted setup - my preference was to not bother with the airgaps, DVDs, offline laptops, etc and make up for it by having 20-30 participants instead of six and make sure they come from different countries, backgrounds, etc. I got this instinct from my experience managing the ethereum foundation wallet - our original setup was 3-of-4 but had lots of fancy secret sharing, encryption, offline signing and other machinery on each device but at one point it nearly broke, and since then we're using a 4-of-7 hot wallet between online laptops, and I feel much more comfortable with the security of the latter. But these are only my views, not shared by everyone, and others of course have different opinions how the risks and benefits should be balanced.

EDIT: just to be clear, I still personally think that the risks of the current setup having been compromised are quite low.

Peter Todd, one of the trusted setup participants was much more critical:

enter image description here

  • I do not understand the point you are making with "Zcash uses its entire blockchain as its anonymity set vs the number of previous outputs for Monero. ". The "blockchain" and "the number of previous outputs" seem to be the same, no ? – user36303 Jul 20 '16 at 8:55
  • @user36303 I was trying to refer to available mixins without actually using the term for the purposes of comparing the Monero anonymity set with ZCash. Is my wording better now? – opensourceprivacy Jul 20 '16 at 16:44
  • I think you want to say "the set of outputs included in a ring" or similar. Your other point about the anonymity set growing indicates you're talking about "when was this particular output spent ?" rather than "which output was spent in this tx", which is what I read with that first sentence. But maybe I'm trying to read too much about the specifics. – user36303 Jul 20 '16 at 17:02
  • @user36303 made another edit. I did want to clarify the difference between the set up outputs actually included in a ring and the growing set of available outputs that could be used when a given key is eventually spent at some point in the future. – opensourceprivacy Jul 20 '16 at 17:17
  • 1
    @user36303 "Instead of publicly demonstrating spend-authority and transaction values, the transaction metadata is encrypted..." bitcoinmagazine.com/articles/… Please make edits to improve my answer if you can or provide an additional answer to address what I missed. – opensourceprivacy Aug 20 '16 at 15:38
17

Adding this answer to make it simpler to those who can not understand the top response.

ZCash uses a new cryptography tool called zk-SNARK (don't worry about the name). This is different than the ring signatures that Monero uses. Without getting into too much detail, this is how they both work:

zk-SNARKs use the entire blockchain when making transactions, whereas ring signatures in Monero instead hide it in certain parts of the blockchain chosen randomly (4 parts by default). Ring signatures have been around for much longer and have undergone years of peer review, while zk-SNARKs are new and have little to no review in their current state.

After January 2017, RingCT hid the amounts of each transaction by default, which made Monero much more private. This helped Monero reach feature parity with ZCash, which was the only coin that could hide the amount of a transaction for a few months.

ZCash introduces a new risk where a group of users can collude (work together) to counterfeit an unlimited number of coins without detection. Since you cannot find out how many coins are in circulation at any given time, it would be very difficult or impossible to tell if this had happened. You can still check how many total coins are on the Monero blockchain.

In Monero, all transactions are private by default. For ZCash, transactions are transparent by default and optionally private. This is a problem for ZCash since less than 5% of the total ZCash coin supply is "hidden" at the time of writing. Thus, Monero benefits from all its users using privacy features, whereas for ZCash, an attacker can simply isolate the few users who are using the privacy features. In Bitcoin, transactions appear suspicious if mixing services are used. For ZCash, this is basically the same story. For Monero, few transactions appear suspicious because they all look similar.

In a much more general sense, ZCash may represent what private coins will look like in the future, but it is still trying to figure out how to deal with new vulnerabilities. Monero is not finished either, although everything that is a part of the current code works very well.

Attached are a few slides from a PowerPoint regarding anonymous cryptocurrency coins presented at the University of Minnesota. This was presented shortly before the ZCash launch. Monero now has RingCT implemented and a GUI wallet, and ZCash has obviously launched.

Monero slide

ZCash slide

  • 1
    Can you edit the second image to replace "takes a cut of all transactions" to "takes 10% of all ZEC mined as a founders reward" or "takes 20% of all ZEC mined in the first 4 years as a founders reward"? z.cash/blog/funding.html – 254123179 Oct 14 '16 at 3:17
  • can you please explain what does negative press of botnets mean? And how fast are zcash's transactions? – PowerFlower Oct 26 '16 at 21:11
  • "For ZCash, transactions are transparent by default and optionally private." There is no default defined by the protocol or the node software. That's purely a matter of what wallet UI software presents, and it would be perfectly feasible for a wallet UI to present shielded transactions as the default, although with some performance caveats at the moment. – Daira Hopwood Feb 19 '17 at 4:58
  • You can still check how many total coins are on the Monero blockchain: Somewhat disingenuous because you do not explain that if ECDLP is cracked, then undetectable quantities of tokens can be created out-of-thin-air on RingCT also. Ditto if Zcash’s trusted setup is cracked. There is still trust involved in both cases. Distinction is that in RingCT we trust math theoretic intractability (which Satoshi didn’t trust and used hashing to double-protect) and in Zcash we trust humans to not ALL collude (even one defector from collusion is safe). – Shelby Moore III Aug 1 '17 at 13:18
3

Concern has been expressed in the Zcash community that the NSA sponsored SHA-256 algorithm is being used for their coin. Here is an example:

https://github.com/zcash/zcash/issues/706

A strange choice for a coin that supposedly claims privacy. There is much circulating on the Internet about SHA-256 and other SHA algorithms having open back doors.

Monero uses the CryptoNight Proof of Work algorithm.

  • 1
    Most of that concern mentioned in the zcash github issue is not about an NSA backdoor, but actually the NSA recommending moving to something stronger than SHA256 due to concerns around quantum computing. – Ryan Oct 27 '16 at 18:33
  • 2
    That is not an accurate characterisation of the linked ticket. We don't have any significant concern about the security of SHA-256, except possibly in the long term (which would allow a transition to another algorithm). It's pretty difficult to put a backdoor in a hash algorithm, since it's used in so many different ways (the NSA tends to prefer keyed backdoors like the one in Dual_EC_DRGB which is not feasible for a symmetric hash). The ticket was more about performance and protocol design aesthetics than security. Monero uses Cryptonite for its proof of work, not other cryptographic uses. – Daira Hopwood Feb 19 '17 at 5:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.