Bitcoin and Cryptocurrency Technologies

a single transaction that combines as many coins as necessary in order to pay the entire amount to a
single address. What if they could avoid the need to merge and consequently link all of their inputs?
The merge avoidance protocol enables this by allowing the receiver of a payment to provide multiple
output addresses — as many as necessary. The sender and receiver agree upon a set of
denominations to break up the payment into, and carry it out using multiple transactions, as shown in
Figure 6.10.
Assuming the store eventually combines these two payments with many other inputs from other
payments it has received, it will no longer be obvious that these two addresses were associated with
each other. The store should avoid re-combining these two inputs as soon as it receives them or else
it will still be clear they were made by the same entity. Also, Alice might want to avoid sending the
two payments at the exact same time, which might similarly reveal this information.
Generally though, merge avoidance can help mitigate the problem of high-level flows: an adversary
might not be able to discern a flow if it is broken up into many smaller flows that aren’t linked to each
other. It also defeats address clustering techniques that rely on coins being spent jointly in a single
transaction.
6.5 Zerocoin and Zerocash
No cryptocurrency anonymity solutions have caused as much excitement as Zerocoin and its
successor Zerocash. That’s both because of the ingenious cryptography that they employ and because
of the powerful anonymity that they promise. Whereas all of the anonymity-enhancing technologies
that we have seen so far add anonymity on top of the core protocol, ​Zerocoin​and ​Zerocash
incorporate anonymity at the protocol level. We’ll present a high-level view of the protocol here and
necessarily simplify some details, but you can find references to the original papers in the Further
Reading section.
Compatibility. ​As we’ll see, the strong anonymity guarantees of Zerocoin and Zerocash come at a
cost: unlike centralized mixing and Coinjoin, these protocols are not compatible with Bitcoin as it
stands today. It is technically possible to deploy Zerocoin with a soft fork to Bitcoin, but the practical
difficulties are serious enough to make this infeasible. With Zerocash, a fork is not even possible, and
an altcoin is the only option.
Cryptographic guarantees. ​Zerocoin and Zerocash incorporate protocol-level mixing, and the
anonymity properties come with cryptographic guarantees. These guarantees are qualitatively better
than those of the other mixing technologies that we have discussed. You don't need to trust anybody
— mixes, peers, or intermediaries of any kind, or even miners and the consensus protocol — to
ensure your privacy. The promise of anonymity relies only on the adversary’s computational limits, as
with most cryptographic guarantees.
185