Dev Ojha：Zcash 要如何支援大規模隱私支付？

0:00開場

0:00大家好，我是 Dev，今天要講我們怎麼擴展 Zcash。先講我們在意什麼的源頭：Bitcoin 白皮書，點對點電子現金。Hello everyone, I'm Dev, and today I'm going to talk about how we scale Zcash. And first, what's the origin of, like, what we care about? Well, it starts with the Bitcoin white paper: peer-to-peer electronic cash.

0:17這是我們都被許下的承諾；Zcash 的目標是把它實現。怎麼回事？Bitcoin 一開始承諾是數位現金，Nic Carter 有篇好文：敘事會變。2019 年起你幾乎聽不到人叫它數位現金，開始叫數位黃金或價值儲存。It's kind of the promise we were all made, and with Zcash, the goal is to actually fulfill this. So, what's going on? Bitcoin started with the promise of being digital cash, and there's this great Nic Carter post. The narratives change over time. Starting in 2019, you'll never hear anyone call it digital cash. You'll start hearing it be called digital gold or store of value.

0:41Zcash 反過來。要當完美的價值儲存，一開始需要什麼？你得完全主權，和 Bitcoin 一樣，還要完全可替代、能持有很多年。With Zcash, instead, we start the opposite way. What do you need to be a perfect store of value initially? You know, you have to be fully sovereign. And same as Bitcoin, and then you need to be fully fungible and be able to hold this for many years.

0:56現在是時候往數位現金加規模。現金有三個不可退讓的性質（再加上主權當底）：可替代；要耐久、長期持有；還有規模，例如我用現金買咖啡，不該擋住 Alice 在別處付給 Bob。And now it's time to start adding scale towards digital cash. Cool. So cash has three non-negotiable properties. Well, I guess add being sovereign as a base point. Then fungible; it should be durable, should hold it for the long term; and scale, as in, like, if I'm paying with cash for coffee, it should not block Alice from paying Bob somewhere else.

1:21可替代（fungible）聽起來 fancy，就是 1 ZEC 等於 1 ZEC。這段不花太多時間，快轉到規模。長話短說，問題是 Satoshi 花不了他的幣。要可替代，堆疊每一層都要隱私。Zcash 在鏈上零知識證明是開先河。Cool. So fungible, fancy word, just means one ZEC equals one ZEC. I'm not going to spend too much time on this, so fast-forward to scale. But TL;DR, the problem is Satoshi could not spend his coins. So, you know. To get fungible, you have to do privacy at every layer of the stack. So Zcash pioneered on-chain zero-knowledge proofs.

1:46堆疊各層的隱私

1:46Zcash 獨特之處是我們在意 RPC 層和錢包軟體的隱私，因此有 private information retrieval（PIR）等工作，也用 Tor 或 DC-nets 藏 IP。And what's unique to Zcash is that we care about privacy at the RPC level and in your wallet software. So this leads to work like private information retrieval and, like, using Tor or DC-nets to hide your IPs.

2:01好，這段跳過。耐久、怎麼把安全拉到最高：長話短說，你只要 shield ZEC，已能扛量子電腦，真來了也沒事。Okay, so I'm gonna skip this. For durability, for just basically how do you security-max: TL;DR. You can already hold ZEC in—if you just shield your ZEC, it's safe from, like, quantum computers, in that if one comes, that's fine.

2:17你可以證明餘額然後繼續。好，最後是規模。需要多少 TPS？看 Visa 和 Mastercard 兩張卡網，容量約 5 萬 TPS，平均約用 1 萬。You can prove your balance and get going. Okay, so scale is the last part. So... How much TPS do we need? Well, let's just look at Visa and Mastercard, two credit card networks. They have about 50K TPS of capacity and use about 10K TPS on average.

2:38今天 Zcash 低於 10。怎麼到那裡？第一步 Tachyon。Zcash 共同創辦人 Sean Bowe 剛講過原理。Tachyon 把鏈上擴展問題，從狀態成長等難題，變成：擴展共識頻寬和 mempool。So today Zcash is like sub-10. So how do we get there? Well, step one, Tachyon. Sean Bowe, co-founder of Zcash, just told you about how it works. So Tachyon converts the scaling problem, at least at the chain level, from being this hard thing with how do you do state growth, etc., to now just being: scale consensus bandwidth and your mempools. So.

3:07最後會得到一個直觀等式：每筆交易約 2KB；要 5 萬 TPS，共識得處理約每秒 100MB。We get a straightforward equation at the end of this. Every transaction is going to be two kilobytes big. We need 50K TPS, so we need to be able to do consensus on 100 megabytes per second.

3:20共識頻寬與錢包瓶頸

3:20這和 Solana 需要的量級相同，而且我們要在純工作量證明下做到，很好。我們會做更快的區塊傳播；mempool 裡 ZKP 遞迴聚合還有 Evan 稍後的演講。This is the same level of what Solana needs, and we have to do this in pure proof-of-work, which is great. We'll do things like faster block propagation. In the recursive aggregation of ZKPs in the mempool, there's another talk by Evan later here that goes through it.

3:39我們用新節點軟體 Zakura 來做。隱私還有另一個真正瓶頸：錢包怎麼知道你收到錢？這些付款是匿名的，沒人知道來自誰、給誰、多少。對，你怎麼知道某筆是給你的？But we do this with the new node software, Zakura. So there's one other really hard part about privacy, which is actually the real bottleneck. How does your wallet figure out you got paid? These payments are anonymous, which means no one knows who it's from. who it's to, or how much is in it. So, yeah, how do you find out a transaction is to you?

4:02一般區塊鏈，錢包把地址給伺服器問餘額，伺服器就知道是誰的 IP、哪個地址、多少餘額。Zcash 只要 UX 和隱私二選一，永遠選隱私最大化。Well, normally in every other blockchain, your wallet just gives a server your address and says, "Hey, what's my balance?" The server learns exactly whose IP it is and whose address it is and what its balance is. In Zcash, at any point, if there's a trade-off that sacrifices UX or privacy, they always take the privacy-maxing thing.

4:24所以今天你要下載史上每一筆交易，這顯然無法擴展。算一下：只要 100 TPS，手機每天要下載 2.5GB；5 萬 TPS 是超過 1TB；若要後量子，一天約 8TB，顯然不行。So today, you download every single transaction in history. This kind of obviously doesn't scale. Now let's work through the numbers of it. Today, if you just want 100 TPS, your phone would have to download 2.5 gigs a day. 50K TPS is over a terabyte. And if you wanted to go post-quantum, you'd be downloading eight terabytes a day. Obviously doesn't work.

4:49PIR 與上鏈升級

4:49所以我們用叫 PIR 的新密碼技術，把 8TB/日 壓到 10MB 以下。長話短說，PIR 是私密的 key-value 查詢；伺服器做很大的矩陣乘法（AI 本來就需要），你就能私密取回餘額。So we use this new cryptographic technique called PIR that converts this eight terabytes to less than 10 megs. TL;DR, PIR is a private key-value lookup. And you basically, a server does a really big matmul, which is just what AI already needs, and then you can privately fetch your balance.

5:12酷的是，我們講的都在發生。Zashi 是頂尖錢包之一，已讓 ZK 證明快 20 倍，並用 PIR 保護隱私，很快也會為規模服務。And what's cool is everything that we talked about is already happening. So, Zashi is one of the premier wallets. It's already gotten ZK proving 20x faster. And it's using PIR to protect your privacy, and soon it'll be doing it for scale.

5:29鏈這邊，大約 27 天後有升級，鏈上速度 3 倍，因為若要花幾十分鐘，就不算數位現金。好，簡短總結我們怎麼真正走向點對點電子現金。So on the chain side, there's an upgrade in like 27 days that 3x speeds up using the chain, because, look, it's not digital cash if it takes like tens of minutes. So yeah, a brief summary of how we get towards peer-to-peer electronic cash, actually this time.

5:47謝謝各位時間，請試試私有錢包。Thanks everyone for your time, and just try out private wallets.