Zef: Low-latency, Scalable, Private Payments

Zef is the first Byzantine-Fault Tolerant (BFT) protocol to support payments in anonymous digital coins at arbitrary scale. Zef achieves its performance by forgoing the expense of BFT consensus and using instead Byzantine Consistent Broadcast as its core primitive. Zef is asynchronous, low-latency, linearly-scalable, and powered by partially-trusted sharded authorities. Zef introduces opaque coins represented as off-chain certificates that are bound to user accounts. In order to hide the values of coins when a payment operation consumes or creates them, Zef uses cryptographically hiding commitments and NIZK proofs. Coins creation and spending are unlinkable through the Coconut [28] blind and randomizable threshold anonymous credentials scheme. To control storage costs associated with coin replay prevention, Zef allows safe accounts deletion once the account is deactivated. Our extensive benchmarks on AWS confirm textbook linear scalability and demonstrate a confirmation time under one second at nominal capacity. Compared to existing anonymous payment systems based on a blockchain [22, 34], this represents a latency speedup of three orders of magnitude, with no theoretical limit on throughput.