<p><a href="http://spar.isi.jhu.edu/~mgreen/ZerocoinOakland.pdf" rel="nofollow noreferrer">This is the zerocoin paper</a>, but as far as I can tell, they haven't released source code yet, so all we can really do is speculate.</p>

<p>The single largest problem it has is that a zerocoin spend requires about 100x more disk space/bandwidth/cpu than a normal bitcoin transaction. However, the intended use case is that you use normal bitcoin transactions most of the time, then run through zerocoin when you want more anonymity.</p>

<p>Second, because all zerocoins are indistinguishable, they must either </p>

<ol>
<li>all be the same denomination, which sucks for people making very large transactions and for people making very small transactions, or</li>
<li>Have a handful of predefined denominations, like 1-zerocoins, 10-zerocoins, etc. The problem with this is that it reduces your anonymity set.</li>
</ol>

<p>As far as security/anonymity goes, I believe that they have a workable system unless there's some problem with their zero-knowledge proof, which I've repeated below.</p>

<p><img src="https://i.sstatic.net/vN0R9.png" alt="zerocoin proof"></p>

CC BY-SA 3.0
2013-04-13T19:12:05.837Z
2013-04-13T19:12:05.837Z
Nick ODell
<p>I hope so. I'm going to look pretty stupid if it isn't actually anonymous. The paper contains a sketch of a proof that the system is in fact anonymous. That is verifiable. Indeed to get published, other academics had to look at it. Now that the paper is public, even more will. If there is a problem with the proof, someone will point it out.</p>

<p>As others have said, the main question is efficiency and that is probably fixable with further research and engineering. </p>

CC BY-SA 3.0
2013-04-14T16:42:22.860Z
You're one of the paper's authors, correct? Am I correct that there isn't a public release of source code?
Nick ODell
CC BY-SA 3.0
2013-04-14T17:17:23.613Z
Yes I am. No there is not yet. We have to clean up the prototype code we wrote before we release it.
imichaelmiers
CC BY-SA 3.0
2013-04-14T23:24:06.067Z
If this is true, and the implementation is "scalable enough", then this is great news for Bitcoin. Looking forward to seeing it adopted, and using it myself.
ripper234
CC BY-SA 3.0
2013-04-14T15:52:55.090Z
2013-04-14T17:16:48.000Z
2013-04-14T17:16:48.000Z
imichaelmiers
<p><a href="https://en.bitcoin.it/wiki/Zerocoin">Zerocoin</a> is a new cryptographic extension to Bitcoin that (if adopted) would bring true cryptographic anonymity to Bitcoin.</p>

<p>Has anyone seriously analyzed the protocol and verified it works as advertised?</p>

<privacy><zerocoin>
Does the ZeroCoin protocol fulfill its promise of anonymity?
ripper234
# Does the ZeroCoin protocol fulfill its promise of anonymity?

(Asked by: username_0 on 2013-04-13)

[Zerocoin](https://en.bitcoin.it/wiki/Zerocoin) is a new cryptographic extension to Bitcoin that (if adopted) would bring true cryptographic anonymity to Bitcoin.

Has anyone seriously analyzed the protocol and verified it works as advertised?

**Tags:** privacy, zerocoin


---

## 2 answers

### Answer by username_2 on 2013-04-14. Score: 6 | Accepted answer

I hope so. I'm going to look pretty stupid if it isn't actually anonymous. The paper contains a sketch of a proof that the system is in fact anonymous. That is verifiable. Indeed to get published, other academics had to look at it. Now that the paper is public, even more will. If there is a problem with the proof, someone will point it out.

As others have said, the main question is efficiency and that is probably fixable with further research and engineering.

> **Comments:**
> **username_1**: You're one of the paper's authors, correct? Am I correct that there isn't a public release of source code?  
> **username_2**: Yes I am. No there is not yet. We have to clean up the prototype code we wrote before we release it.  
> **username_0**: If this is true, and the implementation is "scalable enough", then this is great news for Bitcoin. Looking forward to seeing it adopted, and using it myself.  

---

### Answer by username_1 on 2013-04-13. Score: 6

[This is the zerocoin paper](http://spar.isi.jhu.edu/~mgreen/ZerocoinOakland.pdf), but as far as I can tell, they haven't released source code yet, so all we can really do is speculate.

The single largest problem it has is that a zerocoin spend requires about 100x more disk space/bandwidth/cpu than a normal bitcoin transaction. However, the intended use case is that you use normal bitcoin transactions most of the time, then run through zerocoin when you want more anonymity.

Second, because all zerocoins are indistinguishable, they must either

1. all be the same denomination, which sucks for people making very large transactions and for people making very small transactions, or
2. Have a handful of predefined denominations, like 1-zerocoins, 10-zerocoins, etc. The problem with this is that it reduces your anonymity set.

As far as security/anonymity goes, I believe that they have a workable system unless there's some problem with their zero-knowledge proof, which I've repeated below.

![zerocoin proof](https://i.sstatic.net/vN0R9.png)


---

