How does Zerocoin work? I got the idea that it is used to add anonymity in bitcoin. It converts bitcoin to Zerocoin and back to bitcoin. But how does this process work? I tried reading the research paper on Zerocoin, but the example provided is difficult to understand (for me).
Imagine that all users share access to a physical bulletin board. To mint a zerocoin of fixed denomination $1, a user Alice first generates a random coin serial number S, then commits to S using a secure digital commitment scheme. The resulting commitment is a coin, denoted C, which can only be opened by a random number r to reveal the serial number S. Alice pins C to the public bulletin board, along with $1 of physical currency. All users will accept C provided it is correctly structured and carries the correct sum of currency. To redeem her coin C, Alice first scans the bulletin board to obtain the set of valid commitments (C 1 , . . . , C N ) that have thus far been posted by all users in the system. She next produces a non-interactive zero-knowledge proof π for the following two statements: (1) she knows a C ∈ (C 1 , . . . , C N ) and (2) she knows a hidden value r such that the commitment C opens to S. In full view of the others, Alice, using a disguise to hide her identity, 1 posts a “spend” transaction containing (S, π). The remaining users verify the proof π and check that S has not previously appeared in any other spend transaction. If these conditions are met, the users allow Alice to collect $1 from any location on the bulletin board; otherwise they reject her transaction and prevent her from collecting the currency.