Dev Ojha：Zcash 擴容之路，打造真正的隱私數位現金
The Path to Scaling Zcash
- Dev Ojha Valar Group 創辦人
場次摘要
Dev Ojha 介紹 Zcash 的隱私、可替代性與擴容路線，包括 Tachyon、遞迴零知識證明與私密資訊檢索。演講區分每秒 5 萬筆交易的目標、量子攻擊後的資產復原能力，以及區塊時間和頻寬的升級規劃。
值得記下的 5 件事
逐字稿
Zcash 的初衷與數位現金的承諾
大家好，我是 Dev Ojha。今天我們要談的是如何擴展加密貨幣，也就是 Zcash。這一切的起點，其實要回到 2008 年的 Bitcoin，當時的目標就是建立一個點對點的電子現金系統。Zcash 的使命，就是要實現這個數位現金的夢想，兌現這個承諾。Hello everyone, I'm Dev Ojha. Today we're talking about scaling encrypted money, aka Zcash. So, where does it start though? And the goal begins with the very beginning of the industry, Bitcoin 2008, you know, a peer-to-peer electronic cash system. So we're promised making digital cash, and the goal of Zcash is basically delivering that dream.
Zcash 一直努力實踐這個承諾，而要成為真正的現金，需要具備幾個重要特性。這點其實跟 Bitcoin 有點互補。Bitcoin 一開始就是以數位現金為出發點，但現在已經沒有人會用 Bitcoin 來做日常交易了，大家都把它當作價值儲存、數位黃金。敘事已經完全改變。Zcash is trying to keep this promise, and being cash needs a few properties. But this is somewhat complementary. So with Bitcoin, it started with digital cash, literally in the white paper. Now today, you'll find zero people talking about transacting with Bitcoin. It's now just a store of value, digital gold, etc. You know, that's how the narrative changed.
Zcash 則是反過來，先追求成為完美的價值儲存工具，再透過擴容，逐步實現數位現金的目標。那麼，數位現金除了可擴展性之外，還需要什麼？首先，你必須是主權的價值儲存，這是第一條規則。然後還要有可替代性、耐久性，也就是說你可以把資產放著十年、二十年都沒問題。最後，作為現金，還要夠快、能夠大規模使用。With Zcash, it started in the opposite direction. What do you need to be a perfect store of value, and then transition by adding scale to get to digital cash. So, what does digital cash need aside from scale? Well, first you got to be sovereign. You know, if you're a sovereign store of value, that's rule one. Take that as a premise. Then you need to be fungible. Well, you need to be durable, meaning that you can just walk away and hold your funds for a decade, or many decades. And then you need to be in cash. It's got to be fast and scale.
可替代性與隱私的關鍵
我們先來談談可替代性。這聽起來很簡單，就是一個 ZEC 等於另一個 ZEC，沒有任何歷史痕跡，沒有人能從幣的紀錄看出它過去的流向。沒有每個幣的序號。為什麼這很重要？如果 Satoshi 今天回來，他可能連自己的幣都不能動，因為交易所會凍結這些幣。這樣就無法成為真正的價值儲存或長期現金。So let's walk through the other two parts first. So, fungible, this sounds kind of easy. Means one ZEC equals one ZEC. There's no history to a coin, and you can't just look at something and tell where it was in the past. No serial numbers per coin, etc. And why is this a problem? Well, if Satoshi came back today, he wouldn't be allowed to sell his coins or just even move them. You know, CZ had a tweet, what, a couple months ago about freezing, you know, freeze-tosious coins, as does every exchange. That's not okay. That's not how you become either a store of value or long-term cash.
所以，要有可替代性，就必須在每一層都保障隱私，讓持有者自己決定要揭露什麼資訊，帳本上什麼都看不到。第一步，就是用零知識證明上鏈。Zcash 很早就開創了這個領域，讓發送者、接收者、金額等所有資料都能完全加密，只有你自己能掌控資訊流動，這就是 ZK proofs。So, fungibility requires privacy at every layer, where you as the holder get to choose what you disclose. Nothing's on the ledger. So. Step one is being on-chain using zero-knowledge proofs. So Zcash very conveniently pioneered how you fully hide all the data for, like, the sender, receiver, and amount that's on-chain. It's encrypted, so just you controls information flow. That's ZK proofs.
但 Zcash 特別注重的是錢包端的隱私。你的錢包要怎麼在不洩漏身分的情況下查詢餘額？這裡會用到像 Private Information Retrieval（PIR）這類技術，讓你可以私密地查詢自己的資產。另外還要保護你的 IP，不然大家都知道你現在人在新加坡。這時就會用到 Tor、Apple Private Relay、DC Nets 等工具來保護網路隱私。But then what's kind of unique to the stuff Zcash really is paranoid about is the wallet side. Of how do you have software that, like, preserves your anonymity? So there, your wallet has to figure out how did you get paid. And so it uses techniques like private information retrieval to, you know, discover your balances privately. And then you got to protect your IP. Like, you know, it's no good if everyone, your RPCs can see, hey, you're in Singapore right now. So that's where, you know, IP protection comes in, like. Tor, Apple Private Relay, DC Nets, etc. So, cool, let's go on fungibility.
耐久性與安全升級
接下來談耐久性。你能不能把資產放在冷錢包，過個二十年再回來？答案是可以。現在只要用 Shielded ZEC，就已經具備量子安全的恢復能力。如果今天能改投影片，我會加上這個技術也能防 AI 攻擊。最近大家很擔心橢圓曲線會不會有什麼秘密攻擊，但我們不用怕，因為 Zcash 是量子可恢復的。如果真的發生什麼事，可以直接凍結資金池，讓大家安全遷移資產。Then durability. Can you walk away for a couple decades and, you know, put it in cold storage, come back in 2040? Well, the answer is pretty much yes. And you just go shielded ZEC today, and it's fully quantum recoverable. If I could edit these slides this morning, I would have added in this exact technique that's being done protects you for AI as well. You know, there's a new panic today about, oh, is there some secret attack elliptic curves? We don't have to worry about it. We're quantum recoverable, which means that if something happens, we can just freeze the pool and you can migrate your funds without extra risk.
要做到耐久性，就要極致安全。所有密碼學、零知識證明都要形式驗證，還要做 fuzz 測試。最近有文章討論怎麼做這些測試。供應鏈也要極簡，善用各種 AI 工具，比如 Frontier models、Mythos、Daybreak 等等，不斷審計所有程式碼。還有一點很重要，就是要能快速升級。Zcash 過去六個月內已經做了三次升級，包括硬分叉 Ironwood，現在又要推 NU7，明年一月還有 Tachyon 升級。這樣才能快速因應各種新問題。So, you know, in order to be durable, you got to security max. So what goes on, you know, formally verify all your cryptography, all your zero-knowledge proofs, etc. Then you go fuzz test your cryptography. So there's a recent post about how you do this. Go minimize all your supply chains, use all the AI tools in the world, like, you know, the frontier models with their security access, Mythoses, Daybreak, etc. Just keep auditing all the code. So, perfect. And another thing you add here is being able to upgrade quickly. So Zcash has upgraded three upgrades in the last six months: the hard fork, Ironwood, and now this next one, NU7. And then we'll upgrade again in, like, Jan for Tachyon stuff. So it can adapt quickly to, you know, concerns. So.
Zcash 擴容的核心挑戰
現在進入今天的重點：擴容。要讓 Zcash 成為真正的現金，就要無所不在，隨處可用。不能說我買杯咖啡就擋住別人付款，現金本來就是完全平行的，區塊鏈也應該如此。那我們該怎麼做？其實我們已經有現成的參考，就是 Visa 和 Mastercard。它們的高峰 TPS 大約是 5 萬，平均利用率約 1.5 萬。所以我們的目標也設定在 5 萬 TPS。Now to the core topic of the talk: scale. So the goal is, if you want to use Bcash, it's got to be ubiquitous, it's got to be everywhere. I can't just pay for $10 for coffee and then that blocks you from paying Bob down the street. That doesn't make any sense. It doesn't exist with cash. Cash is perfectly parallelizable. So should your blockchain. So. What do you need here? Well, thankfully we already have one reference for digital cash, Visa and Mastercard. Their capacities are published. So if you look it up, they support around 50K peak TPS capacity. They average around 15K utilization. So great, let's go make the goal 50K.
怎麼達到這個目標？去年在這個舞台上，Zcash 共同創辦人 Sean Bowe 就介紹過一個密碼學突破：Tachyon。Tachyon 的想法是，利用遞迴零知識證明和一些巧妙設計，把區塊鏈擴容的難題簡化。原本要讓節點處理 TB 級資料，現在只要擴展共識和 mempool，因為鏈上只需驗證一個遞迴 ZK 證明。歷史和隱私的負擔都推到使用者端，但對手機來說負擔不大，因為可以連到 archive nodes。這其實就是無狀態區塊鏈的 Zcash 版本。How do we get there? Well, conveniently, on this stage last year, actually, co-founder of Zcash, Sean Bowe, talked about one of the cryptographic breakthroughs that gets you there, Tachyon. And what the idea of Tachyon is, you take this hard problem of how do you scale a blockchain, and then you use recursive zero-knowledge proofs and several clever tactics to reduce the scaling problem. From, you know, how do you scale a node to have terabytes of data, et cetera, to instead, you just have to scale consensus and the mempool, like the P2P side, because we only need the chain, we'll just have to check one recursive zero-knowledge proof. And then all the overhead for, like, history and privacy gets pushed client-side, but it's not intense for the phones. Because they can talk to, like, archive nodes. If people are familiar with, like, stateless blockchain proposals, this is doing that for Zcash.
頻寬、Proof-of-Work 與新節點 Zokora
有了 Tachyon 之後，擴容就變成單純的頻寬問題。每筆完全量子安全的隱私交易大約 2KB，如果要 5 萬 TPS，等於共識層要有 100MB/s 的頻寬。這就是我們的目標，而且要在純 Proof-of-Work 下實現。Solana 在 POS 下已經有 100MB/s 的吞吐量，我們要在 PoW 下做到一樣。這需要更快的區塊傳播，比如用 Erasure Coding、Gossip 等技術，還有預先聚合交易、加速遞迴聚合，即使用 post-quantum STARKs 也要很快。So, cool. After Tachyon, then, scaling is a relatively simple bandwidth equation. When every transaction is fully post-quantum private, it costs about two kilobytes a transaction. You want 50k TPS? Great. Go make consensus have 100 megabytes per second of bandwidth. So, perfect target. Let's go do that under pure proof of work. Solana is actually already at 100 megabytes per second of throughput under POS. So, I need the same thing in proof of work. What's it going to take? Well, a lot of faster block propagation. You know, you erasure code your blocks, gossip them around. Whatever high-speed blockchain does, not going to spend too much time on that. Similarly, pre-Groth transactions mempool and get all of your recursive aggregation very fast, even when you go to post-quantum STARKs.
這些要怎麼落地？接下來一年會有一連串升級，每次都會把吞吐量再翻倍。前 100 倍其實還算簡單。為了達到這些目標，我們正在開發一個新節點 Zakura，這是和 Sean Bowe、Tachyon、Valar Group 的合作，專門解決高效區塊傳播、PoW 下的高吞吐等難題。PoW 的區塊時間有很大變異，有時 1% 的區塊只要 250 毫秒，有時又會拖到 100 秒以上，所以要把資料傳播和共識最終化解耦，甚至在 PoW 上加額外設計。How does this actually get delivered? Well, go to a bunch of upgrades over the next year. Each doubling sends us throughput. We need a lot of doublings, and turns out the first 100x is kind of easy mode. Cool. What are we using to get there? There's a new node being made called Zakura. This is like joint work with Sean Bowe, Tachyon, and Valar Group, which basically is tackling a bunch of the hard problems needed for this. How do you get high-speed block propagation? How do you get high throughput despite proof-of-work block times? Something people may not realize is that in proof of work, your 1% of blocks are super fast, so if you have an average of 25-second blocks, 1% will be 250 milliseconds, around the time it takes to talk around the world. And 2% will be 4x longer, so would be like 100 seconds or more. So you have to decouple gossiping data quickly, be independent of consensus finalizing. Or, you know, adding proof of work on top of this stuff.
現金體驗與錢包端的隱私瓶頸
還有一點很重要，現金必須夠快。你需要預先確認（pre-confirmation），讓小額交易能在區塊時間之前就確信會被打包。這樣你買咖啡就能秒付，不用等好幾分鐘。我們也在研究怎麼聚合交易、改善 mempool 等等。但其實隱私的真正瓶頸不在共識，而在錢包怎麼知道自己收到錢。因為私密交易在鏈上完全看不到任何資料，沒人知道誰收誰付、金額多少。Then we need to work on one other item, which is cash needs to be really fast. So you need to get pre-confirmations. Like, you need to be convinced your transaction will be included for small-value transactions faster than block time, because, you know, you want to go pay for a cup of coffee, be done in a sub-second, not hours. And then we're doing some other stuff on how you aggregate transactions, mempool, etc. So there's one other part of privacy that's actually the real bottleneck, not consensus. And this is how does your wallet learn it got paid? Because a private transaction has no data visible on the chain. No one knows who it's from, who it's to, or how much is in it. So.
那錢包怎麼查餘額？在其他鏈（Solana、Ethereum、Bitcoin）都是直接把所有地址丟給伺服器查詢，這樣伺服器就知道你所有身分。另一種做法是下載全鏈所有交易，這就是 Zcash 現在的做法，因為我們始終把使用者隱私和可替代性放在第一位。但這種方式要擴展到 5 萬 TPS 就不行了，因為 post-quantum 加密後，手機一天要下載 8TB 資料，根本不現實。How does an RPC help you find your balance? And it turns out it doesn't. Normally, in every other blockchain, like Solana, Ethereum, Bitcoin, your wallet just gives a server all of your addresses. So links, even if you have multiple seeds or multiple accounts, it'll leak all of them to a server that is all you. It'll and say, hey, what's the balance for each? So the server learns exactly who you are. The other alternative is you download every single transaction in history. So how do you solve that there's no indexer to help you? Don't index, download everything. And that's what Zcash does today and has, because at any given point, Zcash will always choose maintain user privacy, maintain fungibility at all costs. So, that doesn't work though if we want to get to 50 KTPS. So if you just work backwards, you know, there's a difference between pre-quantum and post-quantum because post-quantum encryption is a bit bigger. If your phone would have to be downloading 8 terabytes of data a day of 50 KTPS.
PIR 技術與 AI 助力的私密查詢
所以我們採用一個新招：Private Information Retrieval（PIR）。這可以把每天 8TB 的負擔，降到每次查詢只要 10MB 上下。你只要開錢包，跟伺服器做 10MB 的加密查詢和回應，就能拿到最新狀態，幾乎太美好了。這怎麼做到？其實就是做一個私密的 key-value 查詢。你把查詢用同態加密，丟給伺服器，伺服器做大規模矩陣運算，回傳加密結果，然後你自己解密得到餘額。So instead, we do another trick. We're pioneering deployment of a cryptographic technique called private information retrieval. So that transforms this 8 terabyte overhead per day to just being less than 10 megabytes of querying every time you open up the wallet. If you want to get your latest state, query servers with 10 megabytes of upload, download, and you're connected. It almost sounds too good to be true. So how does it happen? How do we build this, like, private indexer? And effectively, you're making a private key-to-value lookup. So imagine a key-value database, and now make it private. So how do you do this? You, as a client, homomorphically encrypt your query, and you send this encrypted query to a server. The server does a massive matrix vector multiplication, and then sends you back the encrypted response. And as a client, you decrypt your answer to find your balance.
這裡 AI 領域的進展幫了大忙，因為 AI 推論本來就大量用 GPU 做矩陣運算。我們只要把這套流程用在同態加密上，伺服器做大矩陣乘法，回傳加密結果，完全不知道你查了什麼。這一切都已經在 Zcash 上實現了。現在主流錢包的 ZK 證明速度已經快到 140 毫秒，子秒級延遲成為現實。所有 Zcash 錢包都用 PIR 做投票，Visor 錢包也用 PIR 來保護每次查詢的隱私，完全不用下載全鏈資料。So the server is basically doing a massive matrix vector multiplication where the matrix is the size of your database. Very conveniently, the AI folks have made this incredibly cheap for us. You know, all of your lovely AI model inference is just GPUs computing big matrix vector multiplies. So we do that, homomorphically encrypted, server matrix multiplies, and you get the answer back. So, and importantly, because it's all homomorphically encrypted, a server doesn't learn what you asked for. And spoiler, everything we talked about is already happening in Zcash right now. So. In one of the main wallets, ZK proving's, like, massively, massively faster. So at 140 milliseconds of proving, sub-second latencies are now a real thing. Every single wallet in Zcash is using PIR for voting, and now in Vizer, it's being used for extra privacy protection on every single query in the wallet. So instead of doing this whole, the whole blockchain, eight terabytes overhead, use PIR to bypass that entirely.
即將到來的升級與 Zcash 的未來
很快這些技術就會進入 Visor 錢包，實現大規模擴容。鏈端也即將在 11 月 5 日升級，區塊頻寬提升 3 倍，區塊時間從 75 秒縮短到 25 秒，整體使用體驗會快上三倍，區塊處理也更有效率。這就是我們如何實現點對點電子現金與主權價值儲存的夢想。謝謝大家的時間，歡迎大家試試看像 Visor 這樣的私密錢包！And very soon, this is coming into Visor for scale. So on the chain side, there's an upgrade scheduled for November 5th, so what, 28 days, where consensus bandwidth is getting 3x, block times go from 75 seconds to 25. Which means the UX of using Zcash, the snappiness of everything, should be getting 3x faster. So, huge news, and all this block processing gets much faster as well. So this is how we deliver on the dream: peer-to-peer electronic cash and a sovereign store of value. Thanks everyone for your time, and try out Private Wallets like Visor.
