How can anyone be sure that there are no "phantom tokens"? Who is going to control the creation of these tokens? Is it all based on trust, are you serious? wtf
EDIT: zero knowledge proofs require a trusted setup. This allows the person who set up the system to create tokens at will if they didn't destroy the setup parameters.
this is why zero cash can't work.
It's the same problem with zero vert.
https://eprint.iacr.org/2006/389.pdfYou answered my question by citing Fujisaki.
http://puu.sh/dxuPD/d19af67743.pngThe Fujisaki paper is basis for traceability in cryptonote ring signatures. The shadow token paper clearly describes a trusted ("special") setup to create an oracle as two hash functions. It is a deal breaker for true anonymity because it requires you to trust the person who set it up.
http://puu.sh/dxdR4/9bb07c34c9.pngThis is the exact same problem with all "zero coins". They require a trusted setup.
Section 3.1.1 of the Shadow whitepaper debunks your claim.
You don't have zero knowledge implemented yet.
What do you have then? You have a ring signature token system that uses the same signature system as cryptonote. It's true that it is a new implementation. However, there is this cumbersome condition: "The ring signature consists of the public key of the token being spent, plus the public keys from 3 to 200 other tokens of the same value as the token being spent."
So to spend a given amount of shadow coin as shadow token, you have to find in the blockchain 3 - 200 tokens of the same size that you want to spend.
I can think of a way to tokenize shadow where you can spend in any denomination:
1. Send shadowcoin to an exchange
2. Trade it for XMR or BBR (latter is better)
3. Spend the BBR in any denomination
In this method, you use the exact same ring signature technology without worrying about whether tokens are available in the denomination you want to spend. You also don't have to worry about not getting your change back.
It's a step backwards. At best it's interesting, but practically, it's worse.
The zero-knowledge aspect is not implemented and will take a trusted setup. The "trustless" aspect you refer to is the ring signature system that operates just like cryptonote.
Cryptonote uses a different curve, different libraries, and a whole different underlying core.
We used ring signatures to spend Shadow, which is created by sending SDC as an anonymous output.
Our scheme is quite a bit different, in that we borrow concepts from zerocoin, with the minting and spending, and use ring signatures to make the inputs untraceable from the outputs.. We're also using PoS instead of PoW.
Its a completely unique scheme and implementation

Not to mention, Shadow's anonymity is much more lightweight and flexible than XMR / cryptonote solutions. And SDC is not restricted to any type of signatures... SDC can swap it out with any better zero knowledge systems should they ever come along, and SDC will always be able to improve on it.
Bugger off, troll.