[Cryptography] Zcash's privacy by default with DAG architecture

[adelyngutierrez9b1987 at tuta.io]

Thanks for the notes. Both points are real.

On the GHOSTDAG reordering: ZKas already solves it exactly like that. Spends never anchor to the tip. The anchor has to be matured, age at least shielded_anchor_depth (about 10 min, 600 BPS) and no older than max_shielded_anchor_age (around 7.5 hours). Confirmation stays 1 second, the spend lands at the tip. The delay is only on re-spending a fresh note, same as coinbase maturity. It is shorter than full finality on purpose. Resolution comes from all producer blocks of that root, not last-write-wins, and it fails closed. Bad or expired anchors just drop the spend, never inflate.

On quantum and HNDL: you are right. ZKas inherits Orchard ECDH note encryption (the HNDL risk), RedPallas, and Halo2 IPA. No PQ mitigation yet, same as Zcash and every other Sapling/Orchard chain. STARKs only fix the proof binding. They do nothing for harvest-now-decrypt-later of the notes themselves. That needs a PQ KEM. Spend-auth theft needs PQ signatures. Full PQ for a privacy coin is three separate swaps. Your proof system is a good start on one of them, not the whole thing.

The trusted-setup vs quantum framing is different kinds of risk. One is present, the other is future and shared by the whole field.

Appreciate the right questions.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://www.metzdowd.com/pipermail/cryptography/attachments/20260915/bcfd9baa/attachment.htm>