Quote from: Peter Todd on March 23, 2014, 12:30:27 AM

Quote from: porqupine on March 22, 2014, 11:42:13 PM

I was under the impression Zerocoin was supposed to merged on top of bitcoin originally - I haven't read their white paper in detail though.
Real-world utility is essential to the value and success of a crypto-currency, therefore most of the alt projects just seem like moot (especially at the stage where even bitcoin lacks wide-spread adoptation). On the other hand blanket opposition to any kind of innovation on the bitcoin blockchain seems just as counter-productive.

There's a lot of options for Zerocoin - most recently they've been talking about doing it as an alt-currency, however I was talking to their Ian Miers at the Financial Cryptography 2014 conference a few weeks ago about how Zerocoin could be implemented as an embedded consensus system within Bitcoin. The big advantage there is increasing security. Of course, there's the obvious resistance to 51% attacks that being embedded as opposed to independent provides. But a more subtle advantage is that Zerocoin does require a trusted setup phase. During that phase secret keys are generated, if the keys are not deleted they can be used in the future to produce fake proofs and thus create fake zerocoins. By making Zerocoin be an embedded consensus system, rather than an independent one, it becomes much easier for mutliple Zerocoin's to be setup, each initialized by different, independent, parties. The security of each version is the same - the security of the underlying Bitcoin blockchain - yet you get the advantage of being able to pick and choose who you trust to do the setup phase honestly. I guess we'll see what the team chooses to go with in the end, but in any case if they do not go with the embedded route I'd certainly consider forking the project and releasing a version under that model myself.

I think their team is looking for decentralized ways to generate the initial public parameters to prevent counterfitting of Zerocoins, like the RSA UFO method gnos1s of Anoncoin is trying to implement atm. Sources:
http://youtu.be/FXU65XsLiFk?t=21m52s until 27:00 a couple of times, especially in the last 30 seconds

Quote

Participant 10:   You mentioned [Inaudible 00:27:10] property for the Zerocash system? Do you need them to be honest all the time or just one person being honest at one time and destroy the hidden parameter he had?

Matt:     Thats a great question. One person being honest at one time take the computer they used, set it on fire, and youll never have to think about this again. Its not an online partner who has to trust to do this.

Participant 10: I hope that we live in a world where one person can be honest one time.

Matt:    I agree..

http://pastebin.com/raw.php?i=q3rgh5ZY

So assuming they go down the public approach and let everybody who wants to calculate one piece of the initial public parameters, what other major problems would you see with Zerocoin/cash? Im very interested in the project but unfortunately the devs are not very talkative about it. Sad