zkSummit - Lightning Talk: Aram Jivanyan (Zcoin/Lelantus)

Transcript

good afternoon everybody good to see you here I think everyone is a bit tired already but happy to see you and my name is Aram jibanyan I'm cryptography advisor of Z coy and we will discuss the daily Lantos a new private transaction protocols that I have been working on during the last few months and which will come to zico networks early 2020 the cone is a privacy coin most adopted in the Asian markets which is using the zero coin protocol invented by Yann Mears and make you clean in 2013 silicon uses RSA accumulators and enables users to mint

coins of fixed denomination and then spend those coins unanimously and provide some zero knowledge proof that the spent coin is valid without revealing its origin but from the performance point of view it has some drawbacks the proof sizes are quite large they take up to 25 kilobytes the proof verification can take 300 milliseconds and the size of the anonymity cells should be limited to 10,000 due to practical issues and it doesn't enable confidential transactions

of arbitrary amounts and still requires some type of trusted setup in order to generate their essay parameters under the coin found some smart work around around this indeed using the RSA challenge parameters generated in 1991 but with LaLanne dos we hope to fix all these functional constraints it's a new protocol enabling fully confidential and anonymous transactions without requiring a trusted setup relying solely on standard cryptographic assumptions and ensuring that the transaction proofs

are small they are less than two kilobytes and the verification is quite fast we will laughs we'll see the numbers in the diagram okay so just to give high-level insights how it works it supports two transaction again enables the users to mean and translate transactions maintain a bus to take as many inputs from the base corner as necessary to output new coins which can hide rb3 amounts and the transactions comes with the palace proof ensuring

that the transaction entries sum up and with the ranch proofs for each output ensuring that no output coin contains a negative value the joint speed transaction will enable to split merge or redeem previously minted coins without revealing their origins and in order to provide anonymity the main building block used here is that one out of many probes protocol which is invented by escrow and Marcos cadres and which is beautiful enough cryptography primitive and contains all necessary data to also provide a balanced proof for transactions this diagram

illustrates how the protocol compares with Manero zero cash and original zero coin you can see that we can support high enough anonymity sets of the size of two to the power 16 while keeping the proof sizes lower than two kilobytes and making sure that the verification that thousands of transactions can be processed in a single block yeah the motivation can't physically Lantos is simple we want to provide an alternative solution for private transactions which doesn't require

trusted setup and is solely based on standard cryptographic assumptions and which in my opinion is also very interesting is easy to implement and easy to audit and if you wonder what the Lantos does mean it is a name of Titan God from Greek mythology who could move on sin without being detected so find me out of us if you have any question regarding to the protocol today so questions right now thanks a lot I wanted to ask is there a paper peer reviewed at the conference like or where can I find a paper of the security proof and everything Thanks

not sure if it's peer reviewed that it's published already you can find it that they learn to study oh and we had the chance to discuss it with few cryptographers including key and scroll and Pinette it was very helpful also to come up with ideas with modified versions of bullet proof but it's not published in any peer-reviewed cryptography conference yet thanks hi hello sorry so the sides since you said you're using a sigma protocol the size of the proof is growing linearly with

the number of transactions know the proof size is not growing linearly with the number of transactions actually the proof time and verification times are growing linearly but the proof size our permit risible if you have a if you have n transactions and n is 2 to the power 16 then it grows linearly to the exponent value to 16 thanks all right I guess let's thank our um thank you