Zerocash: Decentralized Anonymous Payments from Bitcoin

The five-minute read

One action, walked through

1. A holder of old coins runs a pour: new coins are committed, and the secrets of the old coins stay off the chain.
2. The pour computes a nullifier for each input coin and a commitment for each output coin.
3. A proof attests that the input coins existed in the commitment tree, the values balance, and the spender was allowed to spend.
4. The chain appends the output commitments, stores the nullifiers, and rejects the transaction if a nullifier is already present or the proof fails.
5. The recipient scans for notes they can open. The public ledger shows that a valid pour happened, not who paid whom.

The argument, unpacked

What has to be true

• The common reference string was generated so that no one retained a trapdoor. A ceremony is a social procedure, not a theorem.
• Users actually move value inside the shielded pool. A transparent note next to a shielded proof is a different system.
• The note commitment tree is available to wallets that must prove membership.
• Proof generation is cheap enough for the user who is supposed to pay, and verification is cheap enough for every node.

What happened after the paper

Zcash is an implementation of this line of work, not a co-author of the 2014 paper. Circuits, the move toward the Halo proving system, and the network's upgrade history are later facts. Performance numbers in the paper are for the construction as evaluated then. They are not a promise about current provers.

What to check before you use the idea

• Who ran the setup, and what is destroyed at the end of it?
• Is the pool the user pays from actually shielded, or only advertised as private?
• Where does a viewing key sit if a business must show one payment to an auditor?
• What does a node store forever: commitments, nullifiers, or the notes themselves?

Terms

Pour

The operation that consumes old private coins and creates new ones, with a proof that value was conserved.

Nullifier

A unique marker revealed when a coin is spent, so it cannot be spent again, without identifying the coin.

Succinct proof

A short proof that a large statement is true. Nodes check the short proof rather than replaying the private data.

Structured setup

Parameters the proof system needs. Knowledge of the secret behind those parameters can break soundness.

The problem the paper names

Zerocoin hid the link between mint and spend but left amounts and the surrounding Bitcoin transaction largely in the clear, and the proofs were heavy. Zerocash asks for a ledger where the payment itself is the private object.

What the design proposes

• Coins are commitments. Spending reveals a nullifier, not the coin.
• A succinct zero-knowledge proof shows that the inputs exist, the amounts balance, and the nullifiers are new.
• The public chain checks the proof and the nullifier set. It does not learn the values.

How the mechanism is specified

• Pouring transforms old coins into new coins. The proof attests to conservation of value.
• Nullifiers give double-spend detection without identifying which coin moved.
• The construction depends on a structured setup. Who ran that setup is a separate trust question the paper states rather than dissolves.

What this page does not treat as proven

• The paper is not a description of today's Zcash network, its circuits, or its upgrade history.
• It does not argue that shielded payments are appropriate for every regulated flow.
• Performance figures in the paper are for the construction as evaluated then, not a promise about later provers.

Why a venture studio still reads it

When a studio venture wants private settlement between known businesses, Zerocash is the reference for what 'the chain checks conservation without seeing the amount' actually requires: a nullifier set, a proof, and an honest account of the setup.