Skip to content
Blockchain LabBlockchain LabTHE VENTURE STUDIO

LibraryPrivacy2019Design paperCorpus record

Ouroboros Crypsinous: Privacy-Preserving Proof-of-Stake

Ouroboros Crypsinous. Thomas Kerber, Aggelos Kiayias, Markulf Kohlweiss and Vassilis Zikas.

Crypsinous combines a stake lottery with a private transaction ledger so the leader proof and the transfers do not reveal the stake and the amounts in the way a public chain does.

A reading of the public paper. Not a copy, not a benchmark, and not a claim about any later network.

A private stake chain has to answer two questions this paper separates: who can extend the chain, and what the payment revealed.
Evidence
Primary paper
Re-measured
No
Assumptions
3
Records linked
3

Code

Source, repository, and what is actually hosted

  • ePrint 2018/1132https://eprint.iacr.org/2018/1132
  • The source URL is not a GitHub repository. No code remote is invented.
  • Full text is not mirrored. Public availability is not a licence to copy the file onto this site.
  • Add to a reading list

01 Claim ledger

What the paper is allowed to say

Each row is a sentence already in the study. The status is the same on every row: a model claim, not a live measurement.

  1. Claim 01 · Paper model

    The defect

    A stake chain publishes who was eligible to produce a block if the leader election is a public function of the stake.

  2. Claim 02 · Paper model

    The proposal

    Crypsinous combines a stake lottery with a private transaction ledger so the leader proof and the transfers do not reveal the stake and the amounts in the way a public chain does.

  3. Claim 03 · Paper model

    Leader privacy and transaction privacy are different leaks.

    The construction uses zero-knowledge proofs over the stake and the coins.

  4. Claim 04 · Paper model

    The bound

    This is not Cardano's deployed privacy and not a mixing instruction.

02 Three cuts

Observation, model, falsifier

A desk does not stop at the summary. Each claim is cut three ways, using only this study's own assumptions and checks. Nothing here is a new figure.

  1. 01 The defect

    Observation

    What the study says

    A stake chain publishes who was eligible to produce a block if the leader election is a public function of the stake.

    Model

    What has to hold

    Leader privacy fails if the implementation publishes the key anyway.

    Falsifier

    What would retire it

    What is still public in the block header?

  2. 02 The proposal

    Observation

    What the study says

    Crypsinous combines a stake lottery with a private transaction ledger so the leader proof and the transfers do not reveal the stake and the amounts in the way a public chain does.

    Model

    What has to hold

    Leader privacy fails if the implementation publishes the key anyway.

    Falsifier

    What would retire it

    Is the slot leader hidden?

  3. 03 Leader privacy and transaction privacy are different leaks.

    Observation

    What the study says

    The construction uses zero-knowledge proofs over the stake and the coins.

    Model

    What has to hold

    Leader privacy fails if the implementation publishes the key anyway.

    Falsifier

    What would retire it

    Is the slot leader hidden?

  4. 04 The bound

    Observation

    What the study says

    This is not Cardano's deployed privacy and not a mixing instruction.

    Model

    What has to hold

    This is not Cardano's deployed privacy and not a mixing instruction.

    Falsifier

    What would retire it

    Is the slot leader hidden?

03 Sequence

One action, as an operating tape

  1. 01A party proves it won the slot without showing the stake in public.
  2. 02A transfer is a private state update with a proof.
  3. 03The ledger rules still have to reject a double-spend.
  4. 04Are amounts hidden?

04 Load-bearing

The argument, and where a pitch drops it

  1. What the paper is for

    The cut

    A private stake chain has to answer two questions this paper separates: who can extend the chain, and what the payment revealed.

    Why it carries weight

    If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.

    Where it is dropped

    A later client, parameter or reward formula is a different object from this paragraph.

  2. What happened after

    The cut

    Deployed stake chains mostly kept public leader schedules. That is a refusal of this property, not an implementation of it.

    Why it carries weight

    If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.

    Where it is dropped

    Leader privacy fails if the implementation publishes the key anyway.

05 Register

What has to be true

  • Model · Not re-measured

    This is not Cardano's deployed privacy and not a mixing instruction.

  • Cryptography · Not re-measured

    The proofs are only as strong as the relation.

  • Cryptography · Not re-measured

    Leader privacy fails if the implementation publishes the key anyway.

06 Divergence

What happened after the paper

Deployed stake chains mostly kept public leader schedules. That is a refusal of this property, not an implementation of it.

A later client, parameter set, or reward formula is a different object. Cite this paper for the mechanism. Cite a primary release for the network. This desk has not re-run the proof.

07 Pre-mortem

What to check before you use the idea

  4. 0 of 3 marked on this browser. A mark is a reading note, not a pass, a rating, or a recommendation.

08 Anatomy

The paper, in the order a builder needs

The problem it names

A stake chain publishes who was eligible to produce a block if the leader election is a public function of the stake.

What the design proposes

  • Leader privacy and transaction privacy are different leaks.
  • The construction uses zero-knowledge proofs over the stake and the coins.
  • It is a protocol paper, not a wallet.

How the mechanism is specified

  • A party proves it won the slot without showing the stake in public.
  • A transfer is a private state update with a proof.
  • The ledger rules still have to reject a double-spend.

What this page does not treat as proven

  • This is not Cardano's deployed privacy and not a mixing instruction.
  • The proofs are only as strong as the relation.
  • Leader privacy fails if the implementation publishes the key anyway.

Why the desk still reads it

A private stake chain has to answer two questions this paper separates: who can extend the chain, and what the payment revealed.

09 Lexicon

Terms, opened into the record

Leader privacy
An observer cannot tell who was eligible from the block alone.
Private ledger
Transfers that do not publish amounts and identities.

10 Repository

Every linked record on this page

Underlined words open a page that already exists: a concept, a protocol profile, a failure record, or another paper. If a word is not underlined, this desk does not have a record for it.

This is Blockchain Lab's reading of a public design paper. It is not the paper, not a copy of it, and not an offer of tokens, equity, custody or a partnership. Later network behaviour can diverge from the text. Nothing here is investment, legal or technical advice.

Research status: Design paper. Last reviewed: 1 October 2026. This is a reading of a public paper, not investment, legal or security advice.