Zcash is a decentralized and open-source cryptocurrency that offers privacy and selective transparency of transactions. Zcash payments are published on a public blockchain, but the sender, recipient, and amount of a transaction remain private.

Zcash

whitepaper

protocol-specifcation

1.1 Caution

1.2 High-level Overview

1 Introduction

2 Notation

3.1 Payment Addresses and Keys

3.2.1 Note Plaintexts and Memo Fields

3.2 Notes

3.3 The Block Chain

3.4 Transactions and Treestates

3.5 JoinSplit Transfers and Descriptions

3.6 Spend Transfers, Output Transfers, and their Descriptions

3.7 Note Commitment Trees

3.8 Nullifier Sets

3.9 Block Subsidy, Funding Streams, and Founders' Reward

3.10 Coinbase Transactions

3.11 Mainnet and Testnet

3 Concepts

4.1.1 Hash Functions

4.1.2 Pseudo Random Functions

4.1.3 Symmetric Encryption

4.1.4 Key Agreement

4.1.5 Key Derivation

4.1.6 Signature

4.1.7 Commitment

4.1.8 Represented Group

4.1.9 Hash Extractor

4.1.10 Group Hash

4.1.11 Represented Pairing

4.1.12 Zero-Knowledge Proving System

4.1 Abstract Cryptographic Schemes

4.2.1 Sprout Key Components

4.2.2 Sapling Key Components

4.2 Key Components

4.3 JoinSplit Descriptions

4.4 Spend Descriptions

4.5 Output Descriptions

4.6.1 Sending Notes (Sprout)

4.6.2 Sending Notes (Sapling)

4.6 Sending Notes

4.7.1 Dummy Notes (Sprout)

4.7.2 Dummy Notes (Sapling)

4.7 Dummy Notes

4.8 Merkle Path Validity

4.9 SIGHASH Transaction Hashing

4.10 Non-malleability (Sprout)

4.11 Balance (Sprout)

4.12 Balance and Binding Signature (Sapling)

4.13 Spend Authorization Signature

4.14 Note Commitments and Nullifiers

4.15.1 JoinSplit Statement (Sprout)

4.15.2 Spend Statement (Sapling)

4.15.3 Output Statement (Sapling)

4.15 Zk-SNARK Statements

4.16.1 Encryption (Sprout)

4.16.2 Decryption (Sprout)

4.16 In-band secret distribution (Sprout)

4.17.1 Encryption (Sapling)

4.17.2 Decryption using an Incoming Viewing Key (Sapling)

4.17.3 Decryption using a Full Viewing Key (Sapling)

4.17 In-band secret distribution (Sapling)

4.18 Block Chain Scanning (Sprout)

4.19 Block Chain Scanning (Sapling)

4 Abstract Protocol

5.1 Caution

5.2 Integers, Bit Sequences, and Endianness

5.3 Constants

5.4.1 Hash Functions

5.4.2 Pseudo Random Functions

5.4.3 Symmetric Encryption

5.4.4 Key Agreement And Derivation

5.4.5 Ed25519

5.4.6 RedDSA and RedJubjub

5.4.7 Commitment schemes

5.4.8 Represented Groups and Pairings

5.4.9 Zero-Knowledge Proving Systems

5.4 Concrete Cryptographic Schemes

5.5 Encodings of Note Plaintexts and Memo Fields

5.6.1 Transparent Addresses

5.6.2 Transparent Private Keys

5.6.3 Sprout Payment Addresses

5.6.4 Sapling Payment Addresses

5.6.5 Sprout Incoming Viewing Keys

5.6.6 Sapling Incoming Viewing Keys

5.6.7 Sapling Full Viewing Keys

5.6.8 Sprout Spending Keys

5.6.9 Sapling Spending Keys

5.6 Encodings of Addresses and Keys

5.7 BCTV14 zk-SNARK Parameters

5.8 Groth16 zk-SNARK Parameters

5.9 Randomness Beacon

5 Concrete Protocol

6 Network Upgrades

7.1 Transaction Encoding and Consensus

7.2 JoinSplit Description Encoding and Consensus

7.3 Spend Description Encoding and Consensus

7.4 Output Description Encoding and Consensus

7.5 Block Header Encoding and Consensus

7.6.1 Equihash

7.6.2 Difficulty filter

7.6.3 Difficulty adjustment

7.6.4 nBits conversion

7.6.5 Definition of Work

7.6 Proof of Work

7.7 Calculation of Block Subsidy, Funding Streams, and Founders' Reward

7.8 Payment of Founders' Reward

7.9.1 ZIP 214 Funding Streams

7.9 Payment of Funding Streams

7.10 Changes to the Script System

7.11 Bitcoin Improvement Proposals

7 Consensus Changes from Bitcoin

8.1 Transaction Structure

8.2 Memo Fields

8.3 Unification of Mints and Pours

8.4 Faerie Gold attack and fix

8.5 Internal hash collision attack and fix

8.6 Changes to PRF inputs and truncation

8.7 In-band secret distribution

8.8 Omission in Zerocash security proof

8.9 Miscellaneous

8 Differences from the Zerocash paper

9 Acknowledgements

10 Change History

11 References

Appendices

A.1 Quadratic Constraint Programs

A.2 Elliptic curve background

A.3.1 Operations on individual bits

A.3.2 Operations on multiple bits

A.3.3 Elliptic curve operations

A.3.4 Merkle path check

A.3.5 Windowed Pedersen Commitment

A.3.6 Homomorphic Pedersen Commitment

A.3.7 BLAKE2s hashes

A.3 Circuit Components

A.4 The Sapling Spend circuit

A.5 The Sapling Output circuit

A Circuit Design

B.1 RedDSA batch validation

B.2 Groth16 batch verification

B.3 Ed25519 batch validation

B Batching Optimizations

List of Theorems and Lemmata

Index

Zcash Protocol Specification, Version 2021.1.16 [Overwinter+Sapling+Blossom+Heartwood+Canopy]

Zcash ZEC