Abstract-Bitcoin is the first digital currency to see widespread adoption. While payments are conducted between pseudonyms, Bitcoin cannot offer strong privacy guarantees: payment transactions are recorded in a public decentralized ledger, from which much information can be deduced. Zerocoin (Miers et al., IEEE S&P 2013) tackles some of these privacy issues by unlinking transactions from the payment's origin. Yet, it still reveals payments' destinations and amounts, and is limited in functionality.In this paper, we construct a full-fledged ledger-based digital currency with strong privacy guarantees. Our results leverage recent advances in zero-knowledge Succinct Non-interactive ARguments of Knowledge (zk-SNARKs).First, we formulate and construct decentralized anonymous payment schemes (DAP schemes). A DAP scheme enables users to directly pay each other privately: the corresponding transaction hides the payment's origin, destination, and transferred amount. We provide formal definitions and proofs of the construction's security.Second, we build Zerocash, a practical instantiation of our DAP scheme construction. In Zerocash, transactions are less than 1 kB and take under 6 ms to verify -orders of magnitude more efficient than the less-anonymous Zerocoin and competitive with plain Bitcoin.

Abstract. An argument system for NP is a proof system that allows efficient verification of NP statements, given proofs produced by an untrusted yet computationally-bounded prover. Such a system is non-interactive and publiclyverifiable if, after a trusted party publishes a proving key and a verification key, anyone can use the proving key to generate non-interactive proofs for adaptivelychosen NP statements, and proofs can be verified by anyone by using the verification key.We present an implementation of a publicly-verifiable non-interactive argument system for NP. The system, moreover, is a zero-knowledge proof-ofknowledge. It directly proves correct executions of programs on TinyRAM, a nondeterministic random-access machine tailored for efficient verification. Given a program P and time bound T , the system allows for proving correct execution of P , on any input x, for up to T steps, after a one-time setup requiringÕ(|P |·T ) cryptographic operations. An honest prover requiresÕ(|P |·T ) cryptographic operations to generate such a proof, while proof verification can be performed with only O(|x|) cryptographic operations. This system can be used to prove the correct execution of C programs, using our TinyRAM port of the GCC compiler.This yields a zero-knowledge Succinct Non-interactive ARgument of Knowledge (zk-SNARK) for program executions, in the preprocessing model -a powerful solution for delegating NP computations, with several features not achieved by previously-implemented primitives.Our approach builds on recent theoretical progress in the area. We present efficiency improvements and implementations of two main ingredients: 1. Given a C program, we produce a circuit whose satisfiability encodes the correctness of execution of the program. Leveraging nondeterminism, the generated circuit's size is merely quasilinear in the size of the computation. In particular, we efficiently handle arbitrary and data-dependent loops, control flow, and memory accesses. This is in contrast with existing "circuit generators", which in the general case produce circuits of quadratic size. 2. Given a linear PCP for verifying satisfiability of circuits, we produce a corresponding SNARK. We construct such a linear PCP (which, moreover, is zero-knowledge and very efficient) by building and improving on recent work on quadratic arithmetic programs.

The existence of non-interactive succinct arguments (namely, non-interactive computationally-sound proof systems where the verifier's time complexity is only polylogarithmically related to the complexity of deciding the language) has been an intriguing question for the past two decades. The question has gained renewed importance in light of the recent interest in delegating computation to untrusted workers. Still, other than Micali's CS proofs in the Random Oracle Model, the only existing candidate construction is based on an elaborate assumption that is tailored to the specific proposal [Di Crescenzo and Lipmaa, CiE '08]. We modify and re-analyze that construction:• We formulate a general and relatively mild notion of extractable collision-resistant hash functions (ECRHs), and show that if ECRHs exist then the modified construction is a non-interactive succinct argument (SNARG) for NP. Furthermore, we show that (a) this construction is a proof of knowledge, and (b) it remains secure against adaptively chosen instances. These two properties are arguably essential for using the construction as a delegation of computation scheme.• We show that existence of SNARGs of knowledge (SNARKs) for NP implies existence of ECRHs, as well as extractable variants of some other cryptographic primitives. This provides further evidence ECRHs are necessary for the existence of SNARKs.• Finally, we propose several quite different candidate ECRHs.Similarly to other extractability (or "knowledge") assumptions, the assumption that ECRHs exist does not fit into the standard mold of cryptographic assumptions. Still, ECRH is a natural and basic primitive that may deserve investigation in of itself. Indeed, we demonstrate its power in obtaining a goal that is provably out of reach in more traditional methods [Gentry and Wichs, STOC '10].

The physical implementation of quantum information processing relies on individual modules—qubits—and operations that modify such modules either individually or in groups—quantum gates. Two examples of gates that entangle pairs of qubits are the controlled NOT-gate (CNOT) gate, which flips the state of one qubit depending on the state of another, and the gate that brings a two-qubit product state into a superposition involving partially swapping the qubit states. Here we show that through supramolecular chemistry a single simple module, molecular {Cr7Ni} rings, which act as the qubits, can be assembled into structures suitable for either the CNOT or gate by choice of linker, and we characterize these structures by electron spin resonance spectroscopy. We introduce two schemes for implementing such gates with these supramolecular assemblies and perform detailed simulations, based on the measured parameters including decoherence, to demonstrate how the gates would operate.

We demonstrate that the [Yb(trensal)] molecule is a prototypical coupled electronic qubit-nuclear qudit system. The combination of noise-resilient nuclear degrees of freedom and large reduction of nutation time induced by electron-nuclear mixing enables coherent manipulation of this qudit by radio frequency pulses. Moreover, the multilevel structure of the qudit is exploited to encode and operate a qubit with embedded basic quantum error correction.