Zcash Devs Want to Make Quantum Sleuths Lose the Receipt 🕵️

A developer of the Zcash full node software Zakura has outlined a method to prevent future quantum computers from linking users' shielded payments, in an engineering post by Zakura developer Adam Tucker announced on Sunday. The proposal requires no network upgrade, the project said in a post introducing what it called "post-quantum unlinkable swaps for Zcash."

Zcash's shielded transactions hide the sender, recipient and amount, but each shielded account relies on a single incoming viewing key across all of its addresses. A classical computer cannot recover that key from an address, though a sufficiently powerful quantum computer running Shor's algorithm could, according to the post, and would then be able to view the value and memo of every payment the account has received and tie them together. "Until Tachyon ships, there is a glaring hole: a single published shielded address lets a quantum attacker link every payment that address's key has ever received," Tucker wrote, referring to the proposed scalability upgrade for Zcash that its developers say would also deliver full post-quantum privacy.

The post identifies swaps through NEAR Intents as the most exposed use case, since every swap out of ZEC writes one of the user's shielded addresses to NEAR's public chain as a refund address, regardless of whether a refund ever occurs. Around $600 million to $700 million had flowed through Zcash's NEAR Intents route by May, Zcash Open Development Lab CEO Josh Swihart said at the time. Zakura's proposed fix derives a separate incoming viewing key for each address that has to be published, while leaving the account's spending key untouched, so that breaking one posted address would expose only the payments sent to that specific address. "If a quantum computer ever breaks a posted swap address, it will not be able to link this to any other transaction," Tucker wrote in a Twitter thread.

To keep the extra keys from slowing seed-phrase restores, the wallet would look up NEAR's payouts using private information retrieval, a technique that lets it query a server without revealing which addresses it is asking about. The proposal follows Zakura's plan for quantum-safe transparent addresses earlier this month, which also used private information retrieval and said post-quantum signature opcodes were expected in Zcash in January. Swihart said in May that Zcash was aiming for full post-quantum status within 12 to 18 months.