[Cryptography] Zcash's privacy by default with DAG architecture

[adelyngutierrez9b1987 at tuta.io]

ZKas is a one month old cryptocurrency that combines Kaspa's GHOSTDAG BlockDAG - fast, parallel, proof-of-work block production with Zcash's Orchard shielded protocol, so that every amount, sender, and recipient is hidden by construction.

Zcash's privacy is considered to be the most advanced but it's not enabled by default, so receives criticism from people (e.g. Edward Snowden).
Kaspa's DAG achievements enable it to produce 100 blocks per second but it's a transparent ledger. 

ZKas combines Kaspa's and Zcash's work and creates the fastest privacy network with 1 second block time and mandatory hardest encryption.

ZKas combines Orchard's confidentiality with a GHOSTDAG BlockDAG. This is workable because an Orchard transaction is self-contained: it balances its own value through homomorphic Pedersen commitments of the form cv = [v]G + [rcv]H (G, H generators on Pallas) and proves its own validity in zero knowledge, independent of the order of other transactions. Only two structures are globally order-sensitive: the set of spent-note nullifiers N and the Merkle tree of note commitments T. A BlockDAG already linearizes its accepted transactions, and ZKas advances N and T along that existing order. Confidentiality therefore adds little latency, and the problem that usually makes a private chain hard — keeping global state consistent under parallel block production — reduces to reusing an ordering the engine already computes.


The privacy layer is Orchard, Zcash's third-generation shielded protocol, reused through the audited orchard crate rather than re-implemented. Orchard's Action (a merged spend-and-output) uses Pedersen value commitments (homomorphic, so the circuit simply enforces sum vin = sum vout), Sinsemilla note commitments cm = SinsemillaCommit_rcm(g_d || pk_d || v || ρ || ψ) where g_d is the diversified base, forming a depth-32 Merkle tree, and nullifiers nf = Extract_P([PRF^{nf}_{nk}(ρ) + ψ] · G + cm). These are adopted as-is. Critically, Orchard has no interstitial treestates: transactions within a block do not chain tree state to one another, which is what makes the three-tier construction of §6 possible.


Statements are proven in Halo 2 over the Pallas/Vesta (Pasta) curve cycle. Halo 2 needs no trusted setup — a decisive property for a coin with no trusted-setup ceremony and no privileged parties — because its polynomial commitments are inner-product arguments (transparent, discrete-log based). The IPA also supports efficient batch verification of many proofs at once and recursive composition, the two levers ZKas uses to make shielded verification scale.


Only two structures must be globally consistent. The nullifier set N holds every nullifier ever spent; it is append-only and checkable forever, so a repeat is a double-spend. The note-commitment tree T is a fixed depth-32 Sinsemilla Merkle tree of all note commitments (2^{32} leaves), and its root is the anchor. Everything else in a shielded transaction is self-contained: each transaction balances its own value locally via the Pedersen homomorphism, and Orchard's absence of interstitial treestates means transactions in a block do not chain tree state to each other. Hence the only ordering that matters is at the level of these two structures.


Shielded state on a DAG — the core construction


This is the one component of ZKas that is genuinely new.


The note-commitment tree is built in three layers so that the only serialized step is as small as possible. The bundle subtree is built entirely by the wallet from a single transaction's new commitments (a small Sinsemilla Merkle tree over the Action outputs), with no consensus involvement and complete order-independence. The chain-block subtree is accumulated when a block is processed from the bundle contributions it carries (another Sinsemilla Merkle of those bundle roots); parallel blocks build their own subtrees with zero contention. The global tree is advanced only inside the virtual processor by appending finalized chain-block subtree roots in GHOSTDAG accepted order, yielding the single global root rt = MerkleSinsemilla(rtblock1, rtblock2, …). This is the single serialized operation, and the engine already produces that exact order.


Zcash's early pools (Sprout, Sapling) needed a trusted setup ceremony in which a group generated secret randomness to build the proving parameters and then destroyed it, because anyone who kept that toxic waste could counterfeit coins undetectably. ZKAS has no ceremony and no trusted setup at all. It uses Orchard/Halo 2 (Zcash's own post-2022 system), whose parameters are derived from public, reproducible formulas (Pasta curve constants and the IPA generators). There is no secret that ever exists, so there is nothing to leak and nothing to trust. It shares the same privacy lineage as Zcash but is built entirely on the setup-free generation, so the counterfeiting risk that the ceremony existed to mitigate simply does not apply.


Enthusiasts and developers are welcomed.

https://zkas.info/whitepaper.html
https://zkas.info/https://github.com/firecash/zkas-rusty
https://discord.com/invite/jysMS4XNFT
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://www.metzdowd.com/pipermail/cryptography/attachments/20260910/55a67550/attachment.htm>