Decentralized Anonymous Payments by Ian Miers A dissertation submitted to The Johns Hopkins University in conformity with the requirements for the degree of Doctor of Philosophy. Baltimore, Maryland August, 2017 © Ian Miers 2017 All rights reserved Abstract Decentralized payment systems such as Bitcoin record monetary transactions between pseudonyms in an append-only ledger known as a blockchain. Because the ledger is public, permanent, and readable by anyone, a user's privacy depends solely on the difficulty of linking pseudonymous transactions either to each other or to real identities. Both academic work and commercial services have shown that such linking is, in fact, very easy. Anyone at any point in the future can download a user's transaction history and analyze it. In this work, we propose and implement privacy preserving coins, payments, and payment channels that can be built atop a ledger. In particular we propose: Zerocoin A blockchain based protocol for breaking the link between a transaction that receives non-anonymous funds and the subsequent transaction that spends it. Zerocash The successor to Zerocoin, a blockchain based payment system supporting anonymous payments of arbitrary hidden value to other parties. While payments are recorded publicly in the blockchain, they reveal almost nothing else: the ii ABSTRACT recipient learns only the amount paid but not the source and anyone else learns only that a payment of some value to someone took place. Bolt A payment channel protocol that allows two parties to anonymously and se- curely make many unlinkable payments while only posting two messages to the blockchain. This protocol provides for instant payments while providing drastically improved scalability as every transaction is no longer recorded in the blockchain. Primary Reader: Matthew Green Secondary Readers: Abhishek Jain, Aviel Rubin iii Acknowledgments This work would not have been possible without the help of a number of people: friends, family, and collaborators. I would like to thank Avi Rubin for his support and mentorship especially when I started. I would also like to thank my fellow graduate students, Christina Garman, Michael Rushanan, and Gabriel Kaptchuk, both for their ideas and making the lab a home for the past 6 years. I would particularly like to thank my advisor Matthew Green, for getting me started in this, for his advice, his contributions, and above all never being too busy to take the time for us to throw things at a white board. Some of them actually stuck. iv Contents Abstract ii Acknowledgments iv List of Figures xii 1 Introduction 1 1.1 Background and Related Work . 4 1.1.1 Bitcoin, crypto-currencies, and blockchains . 4 1.1.2 E-cash . 5 1.2 Intuition: From public to unlinkable and then anonymous payments and channels . 6 1.2.1 Augmenting direct anonymous payments with anonymous channels . 12 2 Zerocoin 18 2.1 Overview of Bitcoin . 18 2.2 Decentralized E-Cash . 21 2.3 Decentralized E-Cash from Strong RSA . 24 2.3.1 Cryptographic Building Blocks . 24 2.3.2 Our Construction . 26 2.3.3 Security Analysis . 27 2.4 Real World Security and Parameter Choice . 28 v CONTENTS 2.4.1 Anonymity of Zerocoin . 28 2.4.2 Parameters . 28 2.5 Integrating with Bitcoin . 30 2.5.1 Suggestions for Optimizing Proof Verification . 33 2.5.2 Limited Anonymity and Forward Security . 34 2.5.3 Code Changes . 35 2.5.4 Incremental Deployment . 35 2.6 Performance . 37 2.6.1 Microbenchmarks . 37 2.6.2 Block Verification . 38 2.6.3 Discussion . 39 2.7 Previous Work . 40 2.7.1 E-Cash and Bitcoin . 40 2.7.2 Anonymity . 41 2.8 Conclusion and Future Work . 42 3 Zerocash 44 3.1 Introduction . 44 3.1.1 zk-SNARKs . 45 3.1.2 Centralized anonymous payment systems . 46 3.1.3 Decentralized anonymous payment schemes . 47 3.1.4 Zerocash . 53 3.1.5 Paper organization . 54 3.2 Background on zk-SNARKs . 55 3.2.1 Informal definition . 55 3.2.2 Comparison with NIZK . 57 vi CONTENTS 3.2.3 Known constructions and security . 58 3.2.4 zk-SNARK implementations . 59 3.3 Definition of a decentralized anonymous payment scheme . 59 3.3.1 Data structures . 60 3.3.2 Algorithms . 61 3.3.3 Completeness . 65 3.3.4 Security . 65 3.4 Construction of a decentralized anonymous payment scheme . 68 3.4.1 Cryptographic building blocks . 68 3.4.2 zk-SNARKs for pouring coins . 70 3.4.3 Algorithm constructions . 72 3.4.4 Completeness and security . 72 3.5 Zerocash . 74 3.5.1 Instantiation of building blocks . 74 3.5.2 Arithmetic circuit for pouring coins . 76 An arithmetic circuit for verifying SHA256's compression function . 77 Arithmetic circuit for POUR ............................ 79 3.6 Integration with existing ledger-based currencies . 81 3.6.1 Semantics of Bitcoin . 82 3.6.2 Integration by replacing the base currency . 82 3.6.3 Integration by hybrid currency . 83 3.6.4 Extending the Bitcoin protocol to support the combined semantics . 85 3.6.5 Additional anonymity considerations . 86 3.7 Experiments . 87 3.7.1 Performance of zk-SNARKs for pouring coins . 87 3.7.2 Performance of Zerocash algorithms . 88 vii CONTENTS 3.7.3 Large-scale network simulation . 89 3.8 Optimizations and extensions . 93 3.8.1 Everlasting anonymity . 94 3.8.2 Fast block propagation . 95 3.8.3 Improved storage requirements . 95 Supporting many coin commitments . 96 Supporting many spent serial numbers . 97 3.9 Related work . 98 3.10 Conclusion . 99 Acknowledgments . 100 4 Bolt 101 4.1 Introduction . 101 4.1.1 Background on Payment Channels . 101 4.1.2 Customers, Merchants, and the Limits of Anonymity for Payment Channels . 103 4.1.3 Overview of our constructions . 105 4.1.4 Comparison to related work . 109 4.1.5 Outline of this paper . 110 4.2 Definitions . 111 4.2.1 Anonymous Payment Channels . 111 4.2.2 Correctness and Security . 113 4.3 Technical Preliminaries . 115 4.4 Protocols . 116 4.4.1 Unidirectional payment channels . 117 Security Analysis . 120 4.4.2 Bidirectional payment channels . 122 viii CONTENTS Security Analysis . 125 4.4.3 Bidirectional Third Party Payments . 126 4.4.4 From Third Party Payments to Payment Networks . 130 4.4.5 Hiding Channel Balances . 130 4.5 Implementation of the Bidirectional scheme . 131 4.5.1 Integration with a Currency . 131 4.5.2 Implementation . 135 4.6 Related Work . ..