Tachyon
How Zcash plans to make its secret money smaller, faster, and easier to carry around.
A tachyon is a made-up particle that would go faster than light. Pretty good name for a plan to make things fast.
First, what's Zcash?
Zcash is money you can send over the internet.
The special thing about it: every payment travels inside a sealed envelope. Nobody can peek in. Nobody can see who sent it, who got it, or how much was inside.
Lots of computers around the world work together like one giant post office. They pass the envelopes along and make sure nobody cheats.
So what's the problem?
Sealed envelopes are great for secrets. But they cause two headaches.
Headache 1: every envelope is heavy
How does the post office know an envelope has real money in it, and not fake money? Each one carries a thick math booklet that proves it's honest, without opening it.
And the post office keeps a little note from every envelope, forever. The shelves never stop filling up.
Headache 2: finding your own mail is slow
Every envelope is sealed, so your wallet can't tell which ones are for you. Today it has to try opening every single envelope the post office has ever handled, just to find the few that are yours.
That's like checking every mailbox in the whole city to find your birthday card.
Split each letter in two
Tachyon cuts every payment into two parts.
A small permission slip. It says "I'm allowed to spend this money," and it's signed, like a note from your parents.
And a stamp. That's the heavy math part that proves everything is honest.
Why bother? Because now the stamps can be squished down (that's trick 2) and the permission slips don't have to change at all.
The grown-up words
- Bundle
- The envelope. Holds one or more actions, the overall value balance, and one binding signature that ties them together.
- Action
- The permission slip. A value commitment, a randomized verification key, and a spend-authorization signature (RedPallas).
- Stamp
- The heavy part. Carries the "tachygrams" (nullifiers and note commitments), an anchor, and the proof. Kept separate so proofs can be aggregated while the action authorizations stay as they are.
Squish lots of stamps into one
Picture a line of kids checking homework.
The first kid checks a sheet and hands over a gold star. The next kid checks their own sheet and the first kid's star, then hands over a new star. And on down the line.
At the end, the teacher only has to look at one star. That one star means every sheet got checked. And the star is the same size whether there were 3 sheets or 300.
Tachyon does this with stamps. Lots of stamps go in. One small proof comes out. The post office checks just that one.
Homework sheets: 12
check
→
12 sheets checked. The teacher looks at 1 star.
This is a picture of the idea, not a measurement.
The grown-up words
The "line of kids" is proof-carrying data (PCD): recursive proofs where each step verifies the previous one. Tachyon's PCD framework is Ragu, a modified version of the recursive SNARK construction from Halo, built to work on the Pasta curves Zcash already uses. The project's stated goal is shielded transactions roughly 100× smaller than today.
Only open your own mail
Remember headache 2? Tachyon fixes it in a simple way. The person paying you hands you the details of your letter directly, like passing a note in class. So your wallet never has to open anyone else's envelopes.
And while your wallet is asleep, a helper keeps an eye on the post office for it. The helper does this job without ever learning your secrets.
Your wallet tries all 12 envelopes. Only 2 are yours.
The grown-up words
Today, wallets trial-decrypt every shielded output to find their own notes. In Tachyon, payments are delivered out of band: the sender gives the recipient the note information directly, for example in a payment request or URI, so note ciphertexts no longer go on chain. Wallets can hand the work of following new blocks to an oblivious syncing service, which is not trusted with private information.
And the shelves?
With Tachyon, your wallet carries its own gold star that proves its money is real. So the post office only has to remember the newest "already spent" markers. Everything older can go in the recycling bin.
The shelves stop filling up forever. That was headache 1.
One more bonus: the secret notes that used to sit inside every envelope aren't kept at the post office anymore. That leaves less for the super-powerful quantum computers people might build one day to try to crack.
The grown-up words
The wallet's state is represented as proof-carrying data, which it attaches when spending. Validators then only need recent anchors and recently revealed nullifiers, and can prune almost everything else in a block. Removing on-chain note ciphertexts also removes privacy-sensitive data that isn't yet protected by quantum-resistant cryptography.
Is it finished?
Not yet. People are building it right now. Here's what's done so far.
- Making the secret keyskey derivation
- Hiding the amountsvalue commitments (Pedersen, Pallas curve)
- Signing the permission slipsspend authorization signatures (RedPallas)
- Checking the whole envelope adds upbinding signatures, bundle verification
- Making the "already spent" markersnote commitments, nullifier derivation
- Making the stamps and squishing themproofs and stamp compression, waiting on Ragu and Poseidon
Even when it's all built, it doesn't just switch on. The Zcash community has to agree to it first.