Zcash address encoding
We need to encode Zcash addresses so they aren't as large and unweildy. We're using Base58Check just like upstream does, and to ensure the first character is "z" in our addresses we must use two bytes for the version string. Two bytes gives us an extra character for free, so this PR targets the beginning of addresses to have "zc".
```
$ ./src/zcash-cli zcrawkeygen
{
"zcaddress" : "tnvaj4ZbZG83tj4RwZcFeLgJoSt8nw1ZvSCG8EMyowAsXTQgJPat77Y43BVdVCrwrbLy7GG9msJDYdn5hmreHmkXAkX17hb",
"zcsecretkey" : "SKzkxCRWvscKnroSFyhCqhY332KcDMH4LLNdK2TsSvbmr3CGAB8B",
"zcviewingkey" : "10aa74046f31cbe5eaa8965d1e104853234c3d6c6e45f9c497ca3a025d159755"
}
```
This PR also encodes the spending keys with a prefix that targets "SK". The spec needs to be updated with these changes.
Testnet addresses will start with "tn".
Closes#572
Final changes to the circuit
* Remove [redundant](https://github.com/scipr-lab/libsnark/issues/37) bitness constraints that I pointed out in #908.
* The depth is increased from 20 to 29. I chose 29 because the QAP degree ends up being a power of two, which is probably going to be useful for the FFT in our MPC. (Closes#16)
If we're happy with depth 29 (over 268 million possible joinsplits), this will probably be the final change to the constraint system before 1.0.
Enforce that coinbases must be protected
This PR forces miners to place their funds in the private value transfer system, making "transparent coins" opt-in for users, and increasing privacy for all participants on a systemic level.
Closes#101.
Use depth-first scan for eliminating partial solutions instead of breadth-first
This reduces the peak number of lists in-memory from 2^k to k, and enables the
solver to eliminate most duplicates before it has instantiated the full set of
leaves.
Part of #857.
Fix issue #717 t
Fix issue #717 where if addrman is starved of addresses (e.g. on testnet)
the Select_() function will loop endlessly trying to find an address,
and therefore eat up 100% cpu time on the 'opencon' thread.
Solution is to (1) add a delay to the loop and (2) restrict the number
of attempts to find an address. On exiting the loop, we return
to an outer loop in net.cpp which will sleep, add seed nodes and
calculate new addresses.
Signing pours with ed25519
This is an alternative to #964 which uses ed25519 instead of secp256k1, and avoids the separate hash for fitting the public key into the `h_sig` block. It's based on @defuse's work in that branch.
Closes#808.
Remove Bitcoin mainnet and testnet seeds.
Simple patch for issue #651 to remove hard-coded mainnet and testnet seeds
- they currently point to bitcoin nodes
- some are .onion addresses but Tor support has not yet been added
- gets rid of error messages in debug.log which might confuse people testing the alpha builds
CPourTx structural changes
* Enable binary serialization of proofs and the proving key (closes#799) and make the proofs fixed-size.
* Reorder fields of CPourTx to match the spec (closes#927)
Enforce first four bits are zero for all spending keys and phi.
This introduces a `uint252` to ensure these fields are 252-bits for the PRFs.
Closes#899
libzcash and new zkSNARK circuit implementation
This PR completes [`libzcash`](https://github.com/zcash/zcash/tree/zc.v0.11.2.latest/src/zcash), the implementation of the [Zcash protocol specification](https://github.com/zcash/zips/blob/9bb4410e45394c8b7e43e35622f54dd4041a4ddd/protocol/protocol.pdf) and replacement of [`libzerocash`](https://github.com/Zerocash/libzerocash), our old Zerocash protocol implementation. The new spec comes with some improvements to security and terminology, with minimal differences from the original academic design.
This implementation includes:
* A rewrite of the zkSNARK circuit for `JoinSplit` operations. This rewrite is cleaner, broken up into separate gadgets, easier to audit and review, and fixes some security bugs. (Closes#822, Closes#809, Closes#500, Closes#854)
* A minimal API for interacting with `JoinSplit`s and surrounding primitives. This PR removes almost twice as much code as it introduces. (Closes#877, Closes#315, Closes#824, Closes#798, Closes#707, Closes#512, Closes#247, Closes#128, Closes#514)
Initialize libsodium in the gtest suite.
We left behind this initialization routine when we switched to gtest. I would rather we had moved those tests over in a separate PR instead of changing existing PRs at the last second -- we would have paid more attention to the consequences.
Run `zcash-gtest` in `make check` and fix performance tests.
* gtest tests weren't being run by make check
* performance tests were broken
* We need to automatically upload graphs of performance, [see this PR](https://github.com/Electric-Coin-Company/bbotzc/pull/15).
* Moves zerocash tests into `zcash`'s full test suite, we're removing them anyway later and it'd be nice to remove them in the PR instead of from buildbot
Implement and integrate new Incremental Merkle Tree
This supersedes #823.
----
This is an implementation of a new incremental merkle tree with
* no memory safety issues
* a more sensible internal design
* better space efficiency (tree representation, witnessing)
* simpler API
It is intended that this tracks the behavior of the previous tree, which it does, as verified by tests. I even wrote a little circuit for testing that all the paths work.
This PR also integrates the tree into the codebase and deprecates the old tree in almost all of our code. (I left it alone in `zerocashTest` but everything else has been changed.)
This change is compatible with the testnet but you will need to clear your *local* blockchain data out since the serialized representation of the merkle tree is now different.
Closes#517, Closes#519, Closes#591, Closes#460, Closes#473
Automated performance measurement
Supersedes #843 because that one would have merged into the wrong branch. (Oh yeah and I rebased).
**REBASED AND FORCE PUSHED**
Implement Founders' Reward
More info: https://z.cash/blog/funding.html
The consensus rule is as follows:
```
All blocks before the first subsidy halving block, with the exception of
the genesis block, must contain an output which sends 20% of the block
subsidy value to a scriptPubKey `FOUNDERS_REWARD_SCRIPT`.
```
Right now, `FOUNDERS_REWARD_SCRIPT` is a 2-of-3 multisig P2SH.
Closes#125
zkbot