10 years ago, we launched Zcash, making a private version of Bitcoin. But the origins go back to the 80s, when, in the wake of the Watergate scandal, cryptographers first dreamed of private electronic cash, and the story runs through Satoshi’s invention of Bitcoin. Zerocoin came three years before Zcash launched in 2016. We’d written it as a zk-mix for Bitcoin, and then a year later, Zerocash, which introduced SNARKs to cryptocurrency and is now the de facto approach to private payments on chain. More than 30 years before that, in the early 80s, cryptographers first dreamed of private electronic payments. This was right after the invention of public key cryptography, the Watergate scandal, the Church Committee’s revelations of intelligence agency wrongdoing, and an ongoing fight between the nascent academic crypto community and the government over regulations and alleged backdoors. It was also right as it became clear that the growth of the internet and electronic payments would pose a major surveillance risk. Today, there are a number of cryptographers who think crypto is simply math, devoid of purpose, and a number of folks in cryptocurrency who do not care about privacy (or perhaps even cryptography). That was not the case in the 1980s. Starting with David Chaum, cryptographers first designed e-cash, a centralized private payment scheme that required a trusted bank to blindly sign special tokens. These went nowhere: existing trusted institutions, like banks, didn’t adopt the protocols, and no one wanted to trust magic internet money run by a strange company. Then Satoshi invented Bitcoin, overcoming the trust issue by inventing a blockchain. Bitcoin’s key innovation was the blockchain, which replaced a trusted bank with a public database anyone could participate in running. Because anyone could participate, it got off the ground without convincing a bank to run it. But because anyone could participate, there was no privacy: everyone could download the database of payments. And we couldn’t just use an e-cash scheme, as that required someone to keep a secret signing key, and the entire point of Bitcoin was that no one had to be trusted. This is where Zerocoin, Zerocash, and Zcash come in. They replaced the e-cash system with a zero-knowledge proof and, this fact is not well understood by many, strengthened the privacy of e-cash schemes by giving the recipient full privacy even if the bank was malicious.

Fun fact: Groth16 is less at risk from AI than STARKs. Now that I have your attention: We can’t, of course, assess the risk of AI breaking crypto, but we can assess everything else. And the landscape doesn’t look like what the hot takes imply. There are different kinds of cryptographic primitives. Hashes, public-key encryption/signatures, PRFs, etc. Short of P=NP type results, if AI breaks any/all of these, it won’t be all at once. Hashes are the black magic of cryptography. They take an arbitrary file/string and produce a collision-resistant fingerprint. We’ve had human-powered breaks of deployed hashes. MD2, MD5, SHA-1 have all been broken and protocols upgraded as we became less confident in those hashes. A break of SHA-256, SHA-3, or (for cryptocurrency) especially Poseidon wouldn’t be insanely out there. In contrast, RSA and elliptic curves, which underpin public-key encryption and digital signatures, have survived for decades. For symmetric key ciphers and PRFs built from them, it’s even better. DES was designed in the 1970s, and the practical attacks there are from brute forcing the keys. Ok, back to my admittedly clickbait assertion. STARKs, of course, are a type of “zero-knowledge” proof. In particular, a type of SNARK that uses hashes and error-correcting codes. Hashes show up both in the polynomial commitment, which is a Merkle tree, and in the Fiat-Shamir transform, which is used to generate random challenges for verification. Groth16, in contrast, depends on none of these. It’s elliptic curves, pairings, and some strong assumptions about how those work. And Groth16 proofs themselves are post-AI and post-quantum private, since Groth16 gives you at least statistical zero-knowledge, which does not rest on a computational assumption. In contrast, most deployed STARKs aren’t, in fact, zero-knowledge at all. They are only used for succinctness and do not give you privacy today, even without advances in AI or quantum. This is, allegedly, an easy fix (and the fix would give you PQ privacy too), but it hasn’t happened for the most part. Of course, this doesn’t matter much. In fact, if either elliptic curves or hashes were broken, most things you actually use, including applications using Groth16 or STARKs in cryptocurrency land, would have real problems. All most all applications in cryptocurrency and of zk proofs, depend on both assumptions, even if the proof itself does not. And if AI breaks part of crypto, we’d have even bigger problems for securing the internet, banking, and critical infrastructure using HTTPS/TLS and boring things like Active Directory and OAuth. So really, in a certain sense, this entire discussion is clickbait. But it’s interesting seeing people make just plain incorrect technical assertions about cryptography in the process of posting hot takes. As someone said, this entire topic of AI breaking crypto in cryptocurrency is a bit weird. It’s a bit like wanting a fallout bunker to survive global thermonuclear war. Everything is dead anyway.

Will be ironic if ai means blockchains become more secure than banks, since they have had to deal with attacks across the whole of their infrastructure for years, versus bank architectures that mostly trust the bank. More likely both are just broken, but it would be ironic.