EB122 – Zooko Wilcox: Zcash - An Open Financial System With Privacy

Transcript

[Music] this episode of epicenter Bitcoin is brought to you by the Gtech blockchain contest if you have an idea for a blockchain related project make sure you apply for your chance to win awards for 50,000 go to epicenter bitcoin.com Gtech that's gtec to learn more about Gtech and how you can apply and by Ledger now accepting pre-orders for The allnew Ledger blue Developer Edition a Bluetooth and NFC touchscreen Hardware signing device learn more about Ledger blue at lger

wallet.com and use the discount code epicenter to get 10% off your first [Music] order hello and welcome to epicenter Bitcoin the show which talks about the Technologies projects and startups driving decentralization in glob global blockchain in cryptocurrency Revolution my name is Brian Fabian cran and I'm M Roy today uh today we are continuing with our series on ZK snag and on zero knowledge proof technology and we are going to talk to Zuko WILX oarn who is the founder and CEO of zero zcash zcash is trying to implement a fully private uh fully privacy aware open Financial

system using zero knowledge proof technology so so we going to talk about how that will be built and its consequences but before that we'd like to have an introduction from Zuko so Zuko can you tell us a bit about your background hi there um my background when I was 19 years old I discovered the cipher Punk's mailing list on this new thing I just discovered called the internet um and there I became exposed to all kinds of grandiose visions of how the combination of the internet plus cryptography plus those two things

becoming widely available to billions of people could have all kinds of fantastic consequences and I've been really fortunate in my life that I've gotten to spend almost my entire adult life working on those things that I love and um the the development of Bitcoin was a breakthrough that a lot of the cipher punks including me had dreamed of from the beginning where the beginning is like 1993 or so um and couldn't figure out how to make that dream real until Satoshi came up with it and so that that breakthrough about how what's technically possible combined

with the community of bitcoiners who were motivated um emotionally and politically and morally motivated to invest in it and make it important to their lives that is what um sort of revived the whole Cipher Punk Revolution and my experience so I was I was in LM recently and I was talking with Ian grick there and we talked oh no it was in Amsterdam but anyway we talked a little bit about the history as well of the cipher punks and and he sort of had this view that you know there was all this excitement in the '90s and then

a little bit it got lost for a while you know until Bitcoin came was that your experience as well oh absolutely there were many years when I thought I was the last lonely cyer Punk like um there was the the boom and bus cycles of uh of the internet industry uh during those years and there was a widespread uh um narrative that privacy is dead and no one cares um and that's what that's what was up from my perspective uh completely upended by the Bitcoin phenomena so so is Bitcoin something

that when it came about you were immediately like yes this is what we have been waiting for this is amazing or were you also because a lot of people we've talked with especially cyer PRS you know were were initially quite skeptical and was like oh this this doesn't make any sense it's not going to work what was your reaction I was I was somewhat skeptical um those people including me were skeptical because we tried and tried and tried I I struggled for maybe 12 or 14 years to come up with uh something like Bitcoin and I couldn't figure out any way to make it work and so um when I very first saw it I was skeptical because uh for for bad reasons I missed understood it I think that's common for

a lot of people um but I was also I also thought it was a good stab in the right direction right like I think progress is made by a lot of variety of small mistakes on different people's Parts um so I I liked it and um well I'm the author of one of the earliest blog posts to ever mention Bitcoin on the internet probably um and what I said about it in this tiny little like one paragraph blog post I talked about why an open Financial system would be important if it could exist and then I said uh and here's Bitcoin which is an actual attempt to implement and deploy it um so that's one thing that I think goes along way that is hard to

appreciate is that deploying a thing to users and having a feedback loop of users using it and then changing what it does and changing the way people use it that's um a completely better way to learn than than Theory and Analysis so zuku uh like you are very active on Twitter and you tweet a lot every day and you tweet very interesting stuff which is I think I think I think I think very important for the Bitcoin Community as well because you have such a such a big body of experience um in this field and there was one of the tweets that I would like

to read out and then ask you um what what does it mean can you state it differently what does it mean for one of those drunk tweets so uh hopefully not so so you TW you tweeted one of these days that um and this was your exact tweet like I recognized that mistake I've worked on so many things starting with digicash where we thought we were so special that we couldn't lose at all however it's never enough we can always lose It's never enough It's never enough and we have to try harder so um are you trying to send a message to the Bitcoin community and if so what what is it yeah I really feel that

um there's a thing that my community has has has made a mistake over and over that I've seen for two decades now which is a feeling of yeah inevitable success be based on some argument like you have a special feature uh that that nobody else has and and by you I could mean either like a a company that's making some product like digicash was a product it was a privacy preserving internet currency um in the 90s um and the narrative at digicash was that people would eventually need to um

transact on this new internet thing that people were starting to use more and more uh which at the at the time was pretty much a non-commercial World um and that they would never be able to use credit cards and bank accounts and things like that for that purpose for for various reasons especially privacy because no one would ever be willing to risk their credit card number by typing it in to a web browser uh therefore digicash was the only game in Town um and that turned out absolutely wrong in practice right um and therefore all of the science and uh product

development and work that we did at digicash didn't reach people directly it may have had indirect Effects by other people learning from it and so forth but that as a product and as a company was a failure and I've seen the same kind of thinking uh over the years in many different um fields of this sort of Cipher Punk privacy preserving um individual empowering technology um and it's based on a good reason that the that empowering individuals really is valuable and important and um there are often not very many competitors that are also trying to empower individuals uh but it's not sufficient that doesn't

make you win right um and I think the bit at least whenever I wrote that tweet I wasn't drunk by the way but whenever I wrote that tweet uh I was perceiving the Bitcoin Community or some specific people I suppose I don't remember who uh is having that that same overconfidence that Bitcoin is so special uh and does something that nothing else does uh and therefore we can like take our time to do it right or um whatever other we don't have to worry too much about some aspects um and I think that's really wrong what I meant by that we have to try harder is mostly that we have to connect to more and more users um and by

connect we have to give them whatever it is that they really want that they can't get from from anywhere else I completely agree and it's interesting you know having gotten into Bitcoin in 2013 it's just sort of before it was all taking off uh at that time I I had I made made that same mistake in a way that you know you I I would see that a lot of you know the flaws of the existing system and then you see this vision of a different world where everybody uses Bitcoin and everything works so much better in many ways and and it's it's really obvious to see that but sort of like how you get there isn't isn't obvious at all but you know just somehow a lot of people including myself at that time you know make the

assumption that because the end destination is a you know consistent Vision that's compelling therefore we must also get there and be on the way which is completely wrong that's really well put yeah it's such an inspiring vision and it's good to have an inspiring vision but it's not sufficient we have to we have to try hard to get there and we might fail but hopefully we won't okay so so now let's let's dive into zash um first question is why are you building zcash and who are you building it with yeah yeah starting from I was literally 19 years old so more than half of my life ago uh I discovered the science

papers of David cham the great cryptographer who's the father of most of the crypto ideas that protect privacy on the internet uh and I just specifically his papers about uh privacy preserving money and um starting from then my great inspiring vision that I thought was so wonderful uh was an entire world of humans that were freed to collaborate and cooperate with one another by an information system namely the the internet and a money system um that allowed them to find and organize with whoever wanted to work

with them um I thought that was so important because I think almost everything that um we all value in life like having good relationships with our families and having education and peace and safety and um the opportunity to learn and accomplish new things and grow as people all of that depends on the economy depends on having opportunities provided by collaborating with other humans productively so starting way back then I thought that was the like best most important thing I could

imagine and um and that thing is an open Financial system with privacy and fungibility and then but it wasn't possible it was a vision that there was no path to until uh Satoshi solved the open Financial system part of it for the first time with Bitcoin and then um the the scientists who came up with zero coin and then zero cash added in privacy and fungibility on top of an open Financial system um which is easy to say in one sentence an open Financial system with privacy and fungibility U but it requires some real technological and cryptographic breakthroughs to actually

make that real so that's why I'm working on zcash that answer the question uh yeah it definitely does I mean I mean like with with with zcash it's like we have an open Financial system and we have privacy it's like we have two things that are really that seem contradictory in a way you know like you need an open ledger so that we can validate it but we also want privacy and it seems like mutually contradictory and it might have seemed so to Satoshi as well whoever he or she may be but it's it's it's like beautiful and interesting that this is actually possible and that we going to build it as a as a community and we're

going to popularize these kinds of systems that's that's an amazing thing now there was but though a second part to the question is like who are you building this system with what's the team oh um well it's not just me I the the thing that I'm proudest of so far is in my um my experience as being CEO is recruiting the best people and keeping them on my team um we have five engineers you can go to our z.c is our website z.c is a pretty cool domain name and uh the team page on there shows all of the people currently contributing we have five Engineers who are super great um security hackers and crypto hackers

um they're really rare breed and um we have all those scientists who invented those uh protocols including Ellie that you previously had on the program um and uh I have to say that when we announced the existence of zcash um a little while back uh my second favorite uh coverage of it in the Press was the fact that it was in the print edition of wired because uh because I started reading wired when I was like 18 years old you know when the first addition of wired came out and I could I was able to go down to my local um supermarket and take a photograph of the physical dead tree Edition wired with zcash in it on the shelves there but my first favorite uh press coverage was a

Bitcoin blogger who wrote a blog post saying there's this new announcement of this thing called zcash but there's something fishy about it I think it might be a hoax announcement because the team is too good to be true I love that I feel the same way yeah that is amazing so how do you how do you explain zcat um the first simple explanation is to say well you know about Bitcoin right and the person you're explaining it to says oh yeah I know all about Bitcoin it's an open Ledger and uh the simplest explanation of zcash is to say it's an encrypted open ledger so all of that data is there

in a canonical replicated Global Ledger but all the data is encrypted and can only be viewed by the right people that's the simple version and also let's also have the complex version because uh we did we did ZK snack so so for for viewers that are viewing this episode first you should maybe maybe for this section you should go back and check out our episode with Ellie um Ellie Ben sason who is a professor at techon and he explains the fundamental primitive that the fundamental cryptographic primitive that zcash uses and that's called a ZK snark it's something like in the' 70s you had

the invention of public cryptography that didn't exist before that right and public cryptography created new kinds of systems that like Pioneers in the 60s couldn't have imagined and our our like the the thing that is coming in our lives which is like public crypto is this thing called a ZK snar so you should go back and see what what it is and it's needed for this podcast but assuming that that section is there and people our viewers understand what ZK snar are like describe how the ledger works using that terminology one layer deep okay yeah so so for the purpose of this discussion

Z snarks are also known as zero knowledge proofs um are a way to prove some sort of computational fact about some data without revealing the data and so the way we're going to use it is that there's a fundamental like you said earlier sort of fundamental contradiction between an open system and a privacy and fungibility preserving system um and the simplistic description of zcash is an encrypted open Ledger uh if you're if you're familiar with Bitcoin and cryptography you your eyes start narrowing and you say wait a second you

can't have an encrypt did open Ledger because the minors and full nodes won't have any way to validate transactions so they won't be able to reject invalid transactions from The Ledger so that's the fundamental problem that that snarks are a solution to so a snark since it can prove some facts about some encrypted data without revealing the encrypted data we can use it so um the simple model that I use when talking to people is that Bitcoin is a open Ledger of sender address recipient address and amount transferred so it's like a database with three

columns spreadsheet three columns and um zcash is the same except all three of those columns are encrypted and then it has a fourth column which is the proof or the snark um the proof is a proof that the other the the the data uh inside the encryption in this row uh correctly satisfies some validity constraints and the constraints are the obvious thing that the sender did did have that money and hasn't um double spent it to someone else already so

that's one layer deeper and it gets a lot more complicated the the closer you go into the protocol but that explains that's like accurate enough description of the zerach protocol and it explains why snarks are a necessary component of it let's take a short break to talk about the Gtech blockchain contest Gtech the German Tech entrepreneurship Center is a new center in Berlin for entrepreneurship and they want to support exciting projects happening in this space so that's why they're running a blockchain contest together with we which is one of the largest energy companies in Europe and glomus a foundation supporting

entrepreneurship you can participate by submitting your idea for your project and win up to $50,000 in free grant money that's Equity free you just take the money and do what you want with it uh anybody can apply whether you're an early stage startup and perhaps you just have an idea blossoming idea and uh or you can apply if you've already raised funding and are well on your way to becoming the next uh multi-billion dollar company and anybody can app whether you're in Berlin and Siberia in Shanghai or in San Francisco there's no geographical descriptions and anybody who applies can win up to 12 months of free office space in Berlin uh free mentoring legal support Etc of course that's totally optional if you want to stay in Siberia and work on your blockchain startup you can also do that

the application deadline is March 31st so make sure you submit your idea as soon as possible you can learn more about the contest and apply by going to epicenter bitcoin.com Gtech that's gtec and we hope you'll win we hope you'll make it to Berlin to collect your money and that we'll get to hang out and person now we would like to thank uh GTE rwe and Globus for their support of EP Center Bitcoin so perhaps we could like walk through um walk through different perspectives right like like in Bitcoin we have um like in order to describe Bitcoin what the way I would do it is like I would put the put the person I'm trying to explain it to in the shoes of

a user a shoes of a recipient then the shoes of a minor and then the shoes of a full node owner and then once he understands all the four perspectives it's like okay okay this is how the whole system connects right so um perhaps you could do the same for for zero cash right so well it's mostly the same as Bitcoin right um the miners and full nodes zcash are uh ideally they're validating all the transactions um the miners are also adding proof of work on top of the transactions and getting a reward from the um monetary based distribution schedule this is all the same in Bitcoin

and CC um one so the difference from the point of view of a minor uh well for one thing we're going to change the proof of work we can get to that later if you want uh but the other thing is the main thing is that the miners are also as part of the validity checks are checking the zero knowledge proofs uh that are attached to each private transaction so that's the only difference from the point of view of a minor does that make sense yeah and so what about a full Noe it's the same except if you have uh the private keys that give you access to transactions um then you can detect that some of these

encrypted transactions are money for you so that means you have to check every single transaction right if there's some money in there for you and also for example you know if you have a you know it's it's easy for you know you have let's say you have some web wallet and the web wallet of course knows you know what are the private Keys what the addresses that you own and you know you can just let me interrup does a web wallet mean you're a dumb like web browser and you're relying on some third party service to hold your private Keys it could be either I guess so it could be something like you know blockchain or info where it's like uh

key private keys are in your browser encrypted right but it it knows what public Keys you have it can ping an API and know okay here's a balance so this isn't possible Right with so this is what they call a light CL right yeah yeah or an SPV client they might call it or it can even be S I mean if you're blockchain or info it's not even a like client right it's it's just um because it doesn't do SPV proofs so it even even you can just ask U ask an API yeah there are different sort of levels of uh delegation of vulnerability to a to a third party the different kind of more or less like clients could use um I don't know for sure um all of the consequences of zcash is privacy for

like clients uh maybe some of the other members of my team have I I know some of the other members of my team have uh thought more carefully about like clients than I have at this point so for example um let's say so for for convenience let's like imagine like you said a a spreadsheet right so a spreadsheet has three rows um the first row is the is the is the public key or address so you know it would be like Zuko's address Brian's address me's address and so on the second row has uh uh has the value generally in Bitcoin you would imagine it as having value right you mean column right yeah see it's a spreadsheet in

that layout yeah fine so column so the second column has value and and with Bitcoin the way uh so if I want to send money to Brian what needs to happen is in this spreadsheet let's say I'm sending five Bitcoins to Brian then from from the row corresponding to my address five should be subtracted and then it needs to be added like plus five to the row in which uh like which corresponds to Brian's address right and and uh so to do this I create a transaction which is essentially a way of me saying to the Bitcoin Network hey subtract five from mine and add five to Bran's row and then I sign it with my private key now now when I when I do this

signature uh some node can actually check my signature and because it has this spreadsheet open spreadsheet uh it can go and say okay Mah has enough balance like enough money to make this transaction so let's subtract from him and add from Brian right now um now in zeroc cach what you're saying is um this spreadsheet looks a bit different so there there is the account number and there's the amount but it's encrypted so like there's one row corresponding to Mah's account and amount but that's encrypted so the minor doesn't the node or the minor doesn't know how much is the actual value corre and and similarly the one for the the row for Brian is like that so how so I need to create a

transaction and the minor needs a way of knowing that I have enough money and is this the part that ZK SN is solving yeah that's what the the snarks are for is to make it so the minor can uh reject a transaction from someone if that person doesn't if their private key doesn't actually control enough money to make this transaction um so it would be I think I think it would be too much detail to go down another level of detail and talk about the actual like layout of the values in the crypto protocol um but the

effect of it is um the fourth column in that ledger is a proof which uh because of the amazing properties of zero knowledge proofs the we know that so we don't know the sender address the recipient address or the value transferred but we do know that nobody could have created this here proof in the fourth column I'm holding my hand out over here nobody could have created the the proof that um comes with the other encrypted values unless they have a secret key which controls sufficient

value to cover the amount that's getting decremented so so basically like a zerach transaction like if I if I look at a zerach transaction action this could be anybody in the world sending money to anyone else in the world and it could be a billion dollars or a 50 cents and it all looks the same to me or it looks similar to me it looks garbled right and that's that's a good example of the difference between zash and the other privacy technologies that are for adding privacy to open ledgers um there's a lot of them with different kind of tradeoffs but zcash is the only one that is sort of universal like all of the

information has been hidden through encryption uh well almost all like as much as much as you could do with cryptography is done by this in terms of omitting information from leaking into the public blockchain uh and just as you say that means that the the sort of bundle of transactions or key key holders that that your uh actions are are mixed in in the crowd with is is everyone it's like the biggest possible crowd it's all users of the system now there is still some information that can leak in terms of timing um and in terms of

blockchain like how up to date you are on the blockchain okay uh but that's sort of inevitable because of the fact that time passes and blockchain synchronization takes time um so um by which I mean to say if you make a transaction and then someone else joins the network later and buys some zcash and then they make a transaction uh someone can tell the difference between those because they happened at different times right so there is information that just about the times that transactions happen so if if you're like chain analysis and you're looking at um the zcash

blockchain I don't think it's a very interesting visualism it's just a sequence of stamps of when aaction occur so just briefly so with with blockchains and with Bitcoin there's a whole range of things that people are excited about it but one of one of them has also been actually the aspect of transparency so you know many many people have been excited about for example the idea of let's say a nonprofit that is purely Bitcoin can you know run their accounting fully public everybody can inspect it or one can also Imagine a lot of other scenarios where you know I make a payment and I want to approve to some other party that I made that payment does ckash remove all of

these possibilities or can I selectively approve to other parties certain things about transactions I've sent or received yeah absolutely um it wouldn't even be possible really with cryptography to I don't think it would be possible to make a system where you couldn't prove things to other parties because um you have secrets controlled by your client software and if you reveal those Secrets or some cryptographic derivative of those secrets to another party that can serve as a proof to the other party so um this is a part of the zcash design which is not finished at least not as well sketched out as I would like it to

be um there are different levels or kinds of being able to selectively reveal information to other people um in the current zcash design as it's currently running on our Alpha test net you can reveal specific transactions and anybody that you reveal them to is able to look at them in the blockchain and verify the clear text contents right because every every Row in this encrypted Ledger is encrypted with a separate encryption key right um and so if you reveal the decryption key to one of those rows to someone else

that allows them to see that transaction in The Ledger make sense so that's sufficient I think for like the proof of payment use case and maybe a lot of use cases uh the overall um term for this kind of thing that we use is selective transparency like Bitcoin is mandatory transparency all the time and if you want to get privacy you can try to kind of claw some back with um various techniques but you're starting with everything being transparent all the time and it's a common misunderstanding for people to think that zcash is the opposite and it's everything confidential all the time instead zcash is selective transparency

where you can reveal the specific things to specific people and and revealing those things of course doesn't create any vulnerabilities that you know I can prove I got this money but then also it means that the other person can steal my money or there's nothing like that right so in the current version of zcash you can reveal specific transa the the history the past the current existence of a specific transaction in the blockchain without giving away any other of your um authority to control your own money or other information of your trans of your history um I'd be interested in in people's

feedback about a possible future extension to zcash um that we've sketched out a lot of the crypto cryptography of it but we're probably not going to put it into zcash 1.0 for mostly for engineering timeline reasons and that would be uh what we call a vew key which is a thing you can give to someone to reveal all of your all of the transactions associated with a specific payment address and what the thing that I'm wondering about is what are there use cases that are important like I imagine you said the nonprofit example earlier uh where you want to prove to the world that like you want to show the world uh an accounting of all of the donations

you've received or and or you might want to show the world an accounting of what you're spending it on um or maybe only one of those two um and similarly like a a a company or a Business Partnership or a nonprofit a nonprofit organization has a Treasurer and that's the only person who's authorized to spend the club's money right um but all of the members of like the board of directors or whatever of that club are authorized to view whatever the treasurer does do with the money right so that would be a use case for what I call a Vu key which is where the treasurer would have the spending

key uh and would give to all of the members of the board of directors a copy of the vew key and with the vew key they could tell all of the transactions that that spending key has done but that's not currently in the current protocol for zcash but I and I can't tell if the the thing that is current the kind of selective transparency that is currently in the zcash protocol is good enough for the use cases that the kind where you can selectively reveal specific transactions see the difference yeah yeah I can see the difference I mean this is something we've wanted to Circle back to briefly later it's the sort of application of you know zcash in other

areas but or or you know Technologies like that but I can especially see when you start getting into like more complex smart contract type things that you know the selective revealing of information is going to be really critical so having a lot of capabilities there will probably extremely be extremely valuable yeah that's what it feels like to me too it feels like it kind of feels like to me that with the right selective transparency functionality that zcash is a superet of bitcoin's functionality because the the canonical shared source of Truth property in Bitcoin I mean it's also an

ethereum but um Bitcoin is the Pioneer of it um having a can a shared source of Truth is a is a novel and potentially really valuable powerful tool and it feels like to me there's an even more general purpose and more powerful tool that could exist which is the shared source of truth blockchain but you can only see the subset of it that you're allowed to see given the view keys that you can can peer through to look at the blockchain so I'm I'm very interested in that use case and that's um that's probably like we're going to ship zcash 1.0 very soon and it's going to have uh

the aforementioned limited form of selective transparency I didn't I didn't want to get into too much detail but there's also a possibility in zcash 1.0 to uh share a key that reveal I think I could be wrong but I'm like 95% sure at this point that there's a way to uh share a view key a kind of view key that reveals uh all of your incoming transactions uh but not your outgoing ones um and also only the ones that yeah that's that's basically the fact so uh I think I'd be interested in

your and other people's feedback on this I think the notion of a a shared canonical Global source of Truth with uh overlapping controls over who can see which subsets of the truth is potentially really important and what we're about to ship in zcash 1.0 is sort of the the first step which it solves at least part of that but I'd be really interested in whether that's good enough for specific use cases yeah I mean so if you look at the Smart contract so I I you know I work for ARS so there there's a lot of you know thinking of smart contracts and you know how one can Implement complex processes there and there that's I think

really critical because the Privacy selective revealing thing is really complex and it's going to be really important uh so yeah I think this is because with when you add smart contracts it's really important because then you need to delegate to um it seems like to me that if you have if you're using smart contracts then you need to give computer programs the ability to view certain subsets of the blockchain's source of truth right and I I think it's really important when designing such systems that you're able to give computer programs the ability uh to view what they need to view without thereby giving

them the ability to view other stuff because if they if they get unnecessary excess uh authority to penetrate confidentiality then that can be exploited does that make sense yeah yeah that that definitely makes sense I mean yeah it looks like it it does look like a super set of uh of of of Bitcoin today's magic word is privacy that's p r i v a c why head over to let's stop bitcoin.com to sign in enter the magic board and claim your part of the listen

reward what are kind of uh kind of the performance characteristics of this system so let's say I I want to spend uh some some zcash right and I I want to send you some zcash um how much time does it take for me to create a transaction and how much time does it take for the minor to verify that my transaction is correct the current Alpha code that we have running on a test net it takes like about a minute or two of CPU time to generate a new privacy preserving spend and only like a few milliseconds I think um to verify the latter part is really good performance and that's

really important because all the full nodes and miners have to be doing all those verifications all the time uh the former part is pretty pretty bad um because it takes a whole minute or two on like a laptop 64-bit High powerered super computer CPU uh it also takes a ton of ram like probably more than four gigabytes of RAM I think we haven't measured it yet precisely uh to to to generate a new spend um so that is totally prohibitive for certain use cases uh like generating a new spend on your smartphone for starters um and anything that's got a real low latency requirement where you get incoming money that you receive and

then like a millisecond later you need to spend that money to someone else right away so that's totally impossible with the current uh protocol but there might be ways around it because if um you can receive if you have a a a buffer of money um you can spend it using a private preserving payment so that so there's no linkage between where where it came to you um then you can privately spend it to like a new address right so there's no linkage in the blockchain between where you got it and that new

address that it's current that currently controls it and then you could do a um a non-private spend of it directly from that address this is a thing that we haven't talked about in this podcast but zcash contains um all of the Bitcoin protocol it's a clone of the Bitcoin codebase and it's a suet of the Bitcoin protocol it's it's the Bitcoin protocol plus the Privacy preserving spent so that's the only one the new the new transaction is the only one that has better privacy properties everything we talked about about the encrypted Ledger is only when

we're talking about the Privacy preserving spend transactions make sense so so you have the option of doing a privacy preserving transaction but you also have the option of not doing one and just doing a regular transaction that would be as fast and is easy to generate as a Bitcoin transaction exactly and you get exactly the same privacy properties as you got from Bitcoin uh with those kind uh but potentially better because the existence of the Privacy preserving transactions means that they break the links of the chain of transaction history makes sense so if you're looking at like one of those chain analysis views um if there's

a series of globally transparent transactions that don't use the Privacy feature you can see them so if you're looking at if you had some kind of visualizer like chain analysis and you pointed at the zcash blockchain you would be able to see chains of transactions of anybody who of any trans any series of transactions that use the globally transparent protocol uh but whenever that transaction termin that that chain terminates in a privacy preserving protocol then one of the zcash spends then you don't know uh like where else in the whole blockchain it went right so that it

really except modulo those uh those timing issues I brought up earlier um it really protects the privacy of the whole and the fungibility of the whole system even though there are short chains of globally visible transactions um one of the so the main reason there's several really good reasons why we're keeping the globally transparent protocol in there uh one is backward compatibility if you are running a product or service or hacking something on top of Bitcoin right now you can switch or add zcash as a backend and it's all the same everything continues to work the same as

it did before um and the other is that there's a bunch of functionality in the Bitcoin or the the globally transparent protocol uh that we can't do with the Privacy preserving spins like multi- signature transactions right those are really really important in Bitcoin there's a lot of really cool things being built uh with multi- signature transactions and so zcash can do multi signature transactions using the globally transparent subset of the protocol but when you want to do a privacy preserving spend you can't do multi signature you can just do a direct payment ah so okay that that seems like like a very very interesting point so

before we go on like U so just translating what you what you said right now uh in another language it's like if I suppose let's say I own 100 Bitcoin and every month I I realistically spend two or three most of the money I don't spend so what I could do is um keep most of my 100 Bitcoin in the Privacy part of The Ledger and at the beginning of the month bring out say the three I want to spend in the public part and I can spend these three like you know like like normal Bitcoin very fast transactions Etc and if there's some balance left over in after after the month like let's say you know that's 02 Bitcoin left over I could then put it back into the

Privacy SE private section of The Ledger as well so so somebody can't figure out that I actually own a 100 Bitcoin well that's correct that's what I said I do want to emphasize that we don't know for sure that kind of puts when you use zcash like that it kind of moves you a little closer to those uh lesser privacy Solutions out there where it seems like it should be pretty safe but exactly how safe it would be would depend on how smart your attacker was and how much they knew about you right um because if they if there's somebody who's like targeting

you like there's a criminal that's planning to extort you or Rob you or something um if they know stuff about you like if they can tell what times of day you connect to the Internet or what kinds of things you like to buy with your money or other other information they might be able to correlate that with the uh transaction information that's revealed by the hybrid um usage that you just described okay um so it's not that earlier I said that zcash offers sort of the maximal possible privacy that cryptography can provide and that is true if if the only thing you ever do with it is the Privacy

protecting spense right then then you're putting as little information as possible about your behavior into the blockchain um but because like you said uh like you asked about the performance um the current implementation and the protocol itself has these performance consequences which may preclude using privacy protective spins on um like all devices or in all use cases plus which everybody might need multi- signature transactions sometimes and so we can't do those with privacy protecting spins right now um so gets more complicated in terms of the safety analysis let's take a short break so we

can go to Paris I stopped into lame ojb coin situated in the heart of paris's startup scene and I met with Eric lar Ledger CEO to talk about The Ledger Nano The Ledger Nano is a Bitcoin Hardware wallet based on a secure element it is on a USB form factor that you plug directly inside your computer and it will manage all your private Keys the signature of transaction will be done inside the secure element this never revealing the private keys to the host computer it is compatible with our own Ledger wallet Chrome app which you can also use for multi signature with cop or coin kite and a large range of third party application such as melium

electrum green bits green address and so on the Nano also exists as a cool bracelet wearable so you can always wear proudly your Bitcoins on your wrist The Ledger Nano is an easy to use Hardware storage option which doesn't compromise on security if you want to get a secure setup for storing your Bitcoins go to Ledger wallet.com and use the offer code epicenter to get 10% off your order we'd like to thank Ledger for their support of epicenter Bitcoin so uh so let's let's move on to uh a couple of um couple of common kind of questions um like questions people have about zero cash and these are like kind of challenges to to the system so

one of the one of the questions is that um like for for viewers like for people who have been in the Bitcoin space for a long time they might remember that in 2010 very early days of Bitcoin there was an event where a guy figured out how he could create billions of new Bitcoin like he could easily cross a 21 million limit this was because he could create a transactions that the minor would accept as valid and that transactions would end up creating new Bitcoins and then uh Satoshi at that time and Gavin figured out that such a thing could exist like this person told them so and they changed the protocol to uh to not allow that kind of transaction to go through so um so this was an the

case of an implementation bug where somebody could create Bitcoins because the rules of the system were not let's say the as proper as they should be mhm now in something like zero cach if there's an implementation bug like that then the attacker could create coins and those coins would be completely private so he so nobody would be able to even know that new coins were created like if I were to like say Z zcash was released and I figured out an implementation bug like that and I created new coins and I could basically keep on creating them all my life and live uh live a good life just on that but the other people suffer inflation so this kind of seems to lead

to the expectation that like zeroc cach has to be very very well engineered and almost be like bulletproof against these kinds of things do you think there's some other uh Way by which you could address this doubt um that's a really really good question that's uh one of the things that I'm most concerned about um now for starters zcash is really really well engineered um we started with uh by cloning the most recent or a a recent version of Bitcoin core um and that and the reason we did that is because Bitcoin core has been uh running in

production for so many years right and um bugs like that um of which there have been more than one um security flaws various kinds have have been found and fixed and a lot of people have studied it and audited it and and uh we have higher confidence that there aren't a lot more such flaws in bitcoin's codebase um likewise with the um the code that we are adding to do the Privacy preserving transactions we're being extremely careful like I said at the beginning um my team is absolutely worldclass uh experts at this kind of work and that doesn't mean that we don't make mistakes um but we're we're doing

we're doing a really really good job of being careful about things that risk inserting bugs like that but that's not really very satisfying to me I don't like having sort of all of our eggs in the prevention basket and none in the detection and and uh like correction side um but doing it like that having no good detection of that kind of bug is it seems like kind of sort of an inevitable consequence of the strong privacy properties anything that had such good privacy might also have uh such problems

with um public validation of the correctness um that said we have some ideas actually I recently uh blogged about some of these ideas um we have some ideas of how we could extend zcash in the future possibly it might not work out it's one of those forefronts of science um that you can't know in advance uh what is going to turn out to be possible but it might be possible to do um some kind of privacy preserving auditing of the size of the monetary base that would probably reduce the privacy of and the well probably not the funil we would probably reduce the

privacy of the currency a little tiny bit but very little and in return we might be able to get uh better assurance that there hasn't been that kind of counterfeiting of currency it's definitely not planned for zcash 1.0 right Z our plan for zcash 1.0 is just the simplest thing that could get privacy preserving payments into the world in a in a real live blockchain as soon as possible um but uh but I I'm definitely concerned about that topic and so I might prioritize it if if zcash 1.0 is successful enough that people want to use it and that it's valuable um then I might prioritize trying to further strengthen it and add

that kind of um sort of belt and suspenders uh extra defenses well Zuko just before we we started the episode you mentioned you talked a little bit about the the sort of culture and the need to be open for change can you share a little bit about how you in CC looks at that now I'm not slagging the Bitcoin people uh want to emphasize as I've made clear all along Bitcoin is is wonderful both as a technology and as a community and uh the Bitcoin devs and Bitcoin companies are my close collaborators and uh Cipher Punk fellow travelers all

along uh but there's a way in which uh the culture has differed from the Bitcoin culture and I really like the way ethereum is doing it and I want to emulate that which is that um the Bitcoin sort of Ideal um has sort of centered around getting everything right the first time and then never changing the rules again and there's a lot of good reason for that because uh changing the rules introduces uncertainty which can um distort people's uh economic decision- making and it if if the rules are mutable then there can be harmful politics in which people try to change the rules for bad reasons for for their own good selfish interest or whatever uh but ethereum has adopted a different

culture uh which I I totally approve of which is that uh these are early days and none of us know what we're doing the science is in its infancy and in five years we're going to know so much more about what's possible and what's impossible scientifically we're going to know so much more about what people Val how people use these things whether people use these things um and so uh the ethereum culture from my perspective and I'm I'm no expert I could be totally wrong but it seems to me that the ethereum people are um have sort of a informal social contract that we're going to be upgrading this year after year and the

new thing could turn out to be radically different from the old thing um and culturally we accept that within ethereum um now the risks of damaging economic consequences or uh political uh exploitation are um to those risks can be I I think uh those risks can be controlled because there's no coersion in the system you can't force anyone else to adopt your new thing and so you have so the only way you can get um an economically meaningful new thing deployed is to get

a mass it doesn't have to be everyone um but it has to be a lot of people for it to be economically valuable to to any anyone um and you have to get all those people on board they have to voluntarily consensually opt into using your new thing and so to me that's the most important defense against a upgrading evolving uh system being exploited for someone's illicit gain so in zcash what we're intending to do is communicate to our users that we're the the evolving kind of project and if you're the get it right and never change it kind of people

that's okay too you can just pick one of ours and keep it and you don't have to upgrade to the next one but I'm hoping to get a large mass of people who want to uh continually um upgrade their economic system to with better and better features because there's a lot a lot out there in the future that we want to add improve yeah I mean it it's strange that uh I I I myself U kind of had had the feeling that the whole crypto space kind of Bitcoin cryptocurrency people they they divided into like kind of like two two camps of people that that want like contradictory things and the problem is

that both of them till today are focused completely on bitcoin there's the one camp that just wants you know something like digital gold like something that exists and doesn't change and that's it and then there's and then there's people I can I identify with and I'm I'm part of that camp which is like this technology is going to need 20 years to come into society and uh and there's going to be like loads of iterations on the way and maybe maybe just the thing that comes into societ soety is will be built by somebody who hasn't even been born yet so yeah so so the idea that we have we should fear hard Forks is to me it's a strange idea I mean like we are all

Pioneers do like us not hard foking and like not hard foking because people like me who are running nodes won't do and you know pseudo app get upgrade it seems a bit a bit strange to me but you know like the community is part of like there there are these two pieces to it and uh I think ethereum really does it really well and I'm I'm really happy to hear that even zcash would would want to be in that direction let me interrupt I I mentioned early on that uh I think there's so much to learn from uh the experience of the empirical observations of real life deployment and that's why zcash is almost identical to

bitcoin um there are a hundred beautiful ideas some of which some of us are the authors of uh for experimental New cryptocurrency Concepts uh and we with great reluctance decided we're not going to do any of those in zcash we're just going to do Bitcoin plus privacy uh because um just because nothing else has the empirical evidence of having worked in the wild under attack for years and years uh but there's some new empirical evidence coming along which is the ethereum is working right and so that's really really valuable to me to be able to learn from to two projects which do various things differently from one

another and they're both working to varying degrees so that's what that that encourages me to follow um some of the ethereum development model and governance model well Zuko so we're at the end of our at the end of our episode we keep going I I know I know us two so we we have like a whole lot of other topics that we wanted to talk about but fortunately we'll have zuka back on when you know hopefully not too far future when uh zcash launches with that that that is one question we do have to ask before we wrap up what is the timeline here when do you expect uh

zcash 1.0 to launch okay I'm going to swallow and take a deep breath July July okay excellent so we'll have you on latest by July perhaps a little bit before that uh so we can talk about a whole lot of economic aspects around the currency uh some of the governance stuff you've talked about maybe how you can actually make sure that ckash keeps evolving how that's exactly going to work also proof of work how you're approaching that there's a lot of topics uh we want to talk about and perhaps you know there'll be also some some new things on on the technology level that we can dive into so I this was a

fantastic episode and I I really look forward to to coming back and and going even deeper into the topic I think this is so much yeah I think this is a this is a really exciting project and hopefully it's going to be one that we can we can keep coming back to great thank you very much I look forward to the next Edition okay perfect well um so thanks so much for listener for listening so we we put out these episodes every Monday if you want to listen to them you can get them in any podcast app you use or you can watch their videos on YouTube at youtube.com/ appcenter Bitcoin and we also part of the let Star Bitcoin Network so check out some of their other shows at let's sof bitcoin.com and uh if you want to

you can leave us a review on iTunes or somewhere else and just email us and show it at bitcoin.com and we'll send you one of those t-shirts plus stickers def we have some stickers now so that as well so thanks so much and we look forward to being back next week [Music] [Music]