I'm pretty sure I understand how cryptographic accumulators work to anonymize a coin's history, for example as described here: https://anoncoin.net/Cryptographic_accumulator/ but I have read that ZCash anonymizes the value of a coin as well. Presumably this means that somehow the coin and its value are somehow deposited in the accumulator. How is this done? Is it just an extra hash of the coin serial and the value, or something more elaborate/better?

2 Answers 2


Suppose Alice has an output with 1 unit of value we'll call AO1 (Alice output 1). And suppose Bob has an output with 2 units of value we'll call BO1 (Bob output 1).

Alice sends AO1 to Charlie, forming CI1 (Charlie input 1), with one unit of value. Bob sends BO1 to Charlie, forming CO2, with two units of value.

Charlie now pulls CI1 (an input of Charlie's that claims CO1) and CI2 (an input of Charlie's that claims CO2) into a single output, CO3, with three unites of value.

Charlie now sends CI3 (an input that claims CO3) to Dave, forming DO1.

If this system provides privacy, nobody can map CI1 to CO1, nor can they map CI2 to CO2, nor can they tell that CO3 belongs to the same person that CI1 and CI2 belong to.

So while everyone can see that CI1+CI2=CO3, this really doesn't do them any good. Even if they can tell that CI1 has 1 unit, CI2 has 2 units, and CO3 has 3 units, this does them no good. They can't map CO3 to CI3, so they can't tell how much was sent to Dave. They can't map AO1 to AI2, so they can't tell how much Alice sent to Bob. And so on.

Once you can't tell which output an input claims, the rest is pretty easy.


If by "anonymizes the value of a coin" you mean "anonymizes the amounts in a transaction", then this answer about RingCT on the monero stack exchange might be helpful: https://monero.stackexchange.com/questions/880/eli5-how-does-ringct-work

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.