$ZEC ZCash is Satoshi Nakamoto's early 2010 vision 🧑💻
BitcoinTalk #8
From: satoshi Nakamoto
Subject: Re: Not advice
Date: 2010-08-11 24:14:22 UTC
This is a very interesting topic. If a solution can be found, it may be possible to implement a better, simpler, and more convenient Bitcoin implementation.
Initially, a coin could just be a chain of signatures. With a timestamp service, old signatures could eventually be discarded before the backtrace fan-out becomes too large, or the coin could be stored separately or by denomination. It is precisely the need to check for double-spends that requires global knowledge of all transactions.
The challenge is: how do you prove the absence of other payments? It seems the nodes must know all transactions in order to verify. If it only knows the hashes of in/outpoints, it cannot check the signatures to determine whether a given output has already been spent. Do you have any thoughts on this?
It is hard to think of how zero-knowledge-proofs could be applied in this situation.
We are trying to prove the absence of something, and that seems to require knowing everything and checking that the thing has not been included.
The content in the image comes from a post by Bitcoin founder Satoshi Nakamoto on the Bitcointalk forum, discussing the technical challenges in Bitcoin's underlying design regarding double-spending and zero-knowledge proofs.
BitcoinTalk #8
From: satoshi Nakamoto
Subject: Re: Not advice
Date: 2010-08-11 24:14:22 UTC
This is a very interesting topic. If a solution can be found, it may be possible to implement a better, simpler, and more convenient Bitcoin implementation.
Initially, a coin could just be a chain of signatures. With a timestamp service, old signatures could eventually be discarded before the backtrace fan-out becomes too large, or the coin could be stored separately or by denomination. It is precisely the need to check for double-spends that requires global knowledge of all transactions.
The challenge is: how do you prove the absence of other payments? It seems the nodes must know all transactions in order to verify. If it only knows the hashes of in/outpoints, it cannot check the signatures to determine whether a given output has already been spent. Do you have any thoughts on this?
It is hard to think of how zero-knowledge-proofs could be applied in this situation.
We are trying to prove the absence of something, and that seems to require knowing everything and checking that the thing has not been included.
The content in the image comes from a post by Bitcoin founder Satoshi Nakamoto on the Bitcointalk forum, discussing the technical challenges in Bitcoin's underlying design regarding double-spending and zero-knowledge proofs.
