<p>Suppose Alice has an output with 1 unit of value we'll call AO1 (Alice output 1). And suppose Bob has an output with 2 units of value we'll call BO1 (Bob output 1).</p>

<p>Alice sends AO1 to Charlie, forming CI1 (Charlie input 1), with one unit of value. Bob sends BO1 to Charlie, forming CO2, with two units of value.</p>

<p>Charlie now pulls CI1 (an input of Charlie's that claims CO1) and CI2 (an input of Charlie's that claims CO2) into a single output, CO3, with three unites of value.</p>

<p>Charlie now sends CI3 (an input that claims CO3) to Dave, forming DO1.</p>

<p>If this system provides privacy, nobody can map CI1 to CO1, nor can they map CI2 to CO2, nor can they tell that CO3 belongs to the same person that CI1 and CI2 belong to.</p>

<p>So while everyone can see that CI1+CI2=CO3, this really doesn't do them any good. Even if they can tell that CI1 has 1 unit, CI2 has 2 units, and CO3 has 3 units, this does them no good. They can't map CO3 to CI3, so they can't tell how much was sent to Dave. They can't map AO1 to AI2, so they can't tell how much Alice sent to Bob. And so on.</p>

<p>Once you can't tell which output an input claims, the rest is pretty easy.</p>

CC BY-SA 4.0
2018-07-13T06:10:40.143Z
2018-07-13T06:10:40.143Z
David Schwartz
<p>If by "anonymizes the value of a coin" you mean "anonymizes the amounts in a transaction", then this answer about RingCT on the monero stack exchange might be helpful:
<a href="https://monero.stackexchange.com/questions/880/eli5-how-does-ringct-work">https://monero.stackexchange.com/questions/880/eli5-how-does-ringct-work</a></p>

CC BY-SA 3.0
2018-01-25T08:21:40.127Z
2018-01-25T08:21:40.127Z
Tony Rizko
<p>I'm pretty sure I understand how cryptographic accumulators work to anonymize a coin's history, for example as described here: <a href="https://anoncoin.net/Cryptographic_accumulator/" rel="nofollow noreferrer">https://anoncoin.net/Cryptographic_accumulator/</a> but I have read that ZCash anonymizes the value of a coin as well. Presumably this means that somehow the coin and its value are somehow deposited in the accumulator. How is this done? Is it just an extra hash of the coin serial and the value, or something more elaborate/better? </p>

<privacy><zcash>
How does an anonymous cryptocurrency encode coin values
uper
# How does an anonymous cryptocurrency encode coin values

(Asked by: username_0 on 2018-01-25)

I'm pretty sure I understand how cryptographic accumulators work to anonymize a coin's history, for example as described here: <https://anoncoin.net/Cryptographic_accumulator/> but I have read that ZCash anonymizes the value of a coin as well. Presumably this means that somehow the coin and its value are somehow deposited in the accumulator. How is this done? Is it just an extra hash of the coin serial and the value, or something more elaborate/better?

**Tags:** privacy, zcash


---

## 2 answers

### Answer by username_1 on 2018-07-13. Score: 1

Suppose Alice has an output with 1 unit of value we'll call AO1 (Alice output 1). And suppose Bob has an output with 2 units of value we'll call BO1 (Bob output 1).

Alice sends AO1 to Charlie, forming CI1 (Charlie input 1), with one unit of value. Bob sends BO1 to Charlie, forming CO2, with two units of value.

Charlie now pulls CI1 (an input of Charlie's that claims CO1) and CI2 (an input of Charlie's that claims CO2) into a single output, CO3, with three unites of value.

Charlie now sends CI3 (an input that claims CO3) to Dave, forming DO1.

If this system provides privacy, nobody can map CI1 to CO1, nor can they map CI2 to CO2, nor can they tell that CO3 belongs to the same person that CI1 and CI2 belong to.

So while everyone can see that CI1+CI2=CO3, this really doesn't do them any good. Even if they can tell that CI1 has 1 unit, CI2 has 2 units, and CO3 has 3 units, this does them no good. They can't map CO3 to CI3, so they can't tell how much was sent to Dave. They can't map AO1 to AI2, so they can't tell how much Alice sent to Bob. And so on.

Once you can't tell which output an input claims, the rest is pretty easy.


---

### Answer by username_2 on 2018-01-25. Score: 0

If by "anonymizes the value of a coin" you mean "anonymizes the amounts in a transaction", then this answer about RingCT on the monero stack exchange might be helpful:
<https://monero.stackexchange.com/questions/880/eli5-how-does-ringct-work>


---

