Lecture 20 · Tuesday 2 December 2025

Filecoin and Zerocash

The lecture finishes the survey of alternative currencies. Ouroboros and Algorand replace hash power with stake, proofs of space turn disk capacity into a resource, Filecoin pays for useful storage and Zerocash hides transaction details with commitments, nullifiers and zero-knowledge proofs.

Deck: 07_Alt_Curr.pdf Chapter 7 Sections 6 to 13

Where the Course WasRecap of Lecture 19

Lecture 19 opened Chapter 7 with programmable ledgers. Ethereum added the EVM (Ethereum Virtual Machine), gas and an explicit state, with its former uncle rewards softening stale blocks. Cardano's Ouroboros sampled slot leaders by stake, Algorand elected committees by secret sortition, and Litecoin made mining memory hard with scrypt. The ledger remained public in all of them.

Where It Goes NextWhat This Lecture Adds

This lecture states the provable side of proof of stake: Ouroboros with forkable strings, and Algorand's Byzantine agreement, including Dolev-Strong broadcast and Micali's simple BA. The resource then changes again. Proofs of space commit disk labels in Merkle trees, SpaceMint turns them into a currency, and Filecoin stores useful data behind proofs of space and replication. Permacoin and Primecoin keep proof of work and change what the work computes. Zerocash closes the chapter by hiding sender, receiver and amount: coins become commitments, spends publish nullifiers and a Succinct Non-Interactive Argument of Knowledge (SNARK) proves balance without revealing anything else.

Study PlanWhat to Read, in Lecture Order

  1. Proof of stake: the lottery with stake as tickets, and the honest-majority-of-money assumption.
  2. Ouroboros: slots, epochs, forkable strings and the backbone theorem.
  3. Algorand and secret sortition: the adversary model and unique signatures, followed by the leader and verifier tests.
  4. Byzantine agreement and Dolev-Strong: termination, agreement, consistency, the $n/3$ barrier without signatures and signed broadcast for any $t < n$.
  5. Byzantine agreement made simple: the shared coin from minimum signature hashes plus the adaptations for Algorand.
  6. Proofs of space, SpaceMint and Filecoin: Directed Acyclic Graph (DAG) labels, Merkle commitments, time-memory tradeoffs and the storage market.
  7. Permacoin and Primecoin: useful-file proof of work, non-outsourceable puzzles, and Cunningham chains (sequences of primes, each nearly twice the one before).
  8. Zerocash: the six attempts from serial numbers to direct payments and POUR transactions, which pour spent coins into fresh ones. Review the Succinct Non-Interactive Argument of Knowledge (SNARK) performance figures.

LabSigned Broadcast

The lab runs Dolev-Strong for small $n$. The sender may be honest or corrupt. A corrupt sender may sign both values. Honest parties decide 0 when they see both signatures.

Lab

Dolev-Strong Broadcast

Pick the number of parties, the number of corrupt helpers, and the sender's behavior. Signatures cannot be forged, so a value appears in $\mathrm{ACC}_i$ (the set of values that party has accepted) only when the sender signed it.

-rounds R = t + 1
-agreement
-common decision

AnimationProofs of Space

The stage shows the prover filling a table of labels before the verifier picks a challenge index. The prover answers with the label and a membership proof. The verifier checks one hash relation.

Animation and LabZerocash Shielded Pool

The stage follows a coin from secret tuple to commitment, then through a spend that reveals only a nullifier. The lab runs the mini ledger: Alice transfers part of a shielded coin to Bob, and the double-spend toggle repeats the nullifier.

Lab

Commitments, Nullifiers and Double Spends

Alice holds a shielded coin of value 100. She transfers part of it to Bob. The ledger sees commitments and one nullifier while the amounts stay hidden.

-commitments in tree
-nullifiers used
-verdict

PracticeExercises for This Lecture