Cypherpunk Desert Bus: My Role in the 2016 Zcash Trusted Setup Ceremony

> "Regurgitated" came across as snide so I apologize for that.

That's the thing, it didn't just come across as snide, it made it sound like I repeated the number uncritically, when in fact I made it clear to the reader where it came from and that there was disagreement.

> If there isn't actually any disagreement and the figure is unsubstantiated, why is it not baseless FUD?

The fact that competent experts could be unfamiliar with Zcash's crypto to the degree that they could disagree on basic facts like that is a sign of concern, precisely because it's yet another strong sign that the crypto is quite new. If this were "tried and tested" crypto, there wouldn't be any disagreement. Note that Zooko himself was unsure of the exact strength due to a recently found attack - tried and tested crypto wouldn't have recently found attacks.

> BTW I notified you of this error in your blog post some time ago but never heard back.

Where did you notify me? For that matter, who are you anyway? I probably know you by name from elsewhere; I don't by handle.

> I also don't believe some kind of one-and-done audit of the software/deterministic builds would satisfy either of us.

Well, I was just discussing the trusted setup with Matthew Green, and I think there's some fundamental disagreement on what kinds of vulnerabilities exist and what the risks of them are. So I really need to write a blog post on it.

I'm Sean from Zcash, I coordinated the MPC and wrote the software. I messaged you on twitter or emailed you or something about this last year.

> it made it sound like I repeated the number uncritically

I didn't say you regurgitated it. I said the person you talked to did, presumably after looking at libsnark or an unrelated paper.

> The fact that competent experts could be unfamiliar with Zcash's crypto to the degree that they could disagree on basic facts like that is a sign of concern, precisely because it's yet another strong sign that the crypto is quite new.

I claim the person you talked to was looking at the wrong curve construction. 2^80 is quite a torch to carry into an argument and no experts that we know have ever suggested a security level less than 2^96. The only "disagreements" about security were far more subtle and reasonable than what your blog post suggested.

I enjoyed reading this. It felt like a single perspective in a pulp security thriller. It would be interesting for someone to write fiction from the perspective of a potential attacker.

The top comment on the Zcash post from yesterday (!) has a good theory on why Zcash is posted about so often:

"Is it just me or are more and more stories which look like fluff pieces for ZCash coming up on the HN frontpage? If they were a startup, I'd guess they were prepping for an IPO/acquisition. Most of them have titles with rhetorical questions, and come across as marketing pieces more than anything else.

Really weird."

- https://news.ycombinator.com/item?id=15430668

thats what all the drones at Zcash say. It is either that they like the math, or they find validation from stacking the team with renowned cryptographers.

there is almost no intersection of people interested in zcash and people that actually want to use cryptocurrency or keep zcash in their portfolio who have done any analysis of how this is not something to hold for long.