MATT Green would like you to think of Zerocoin, a Bitcoin-like alternative currency in the process of finalising its specifications, as a bulletin board in a shared space—like an office tea room. Pin a ten-pound note to the board and you may later remove any other similar note from the board so long as you can prove that you pinned a like amount at any previous time. Such a pool of cash would launder a transaction, disconnecting the serial number on the note you pinned from the one you claimed. Money laundering attempts to disguise the origin of funds so that ill-gotten gains are recycled into seemingly legitimate purchases; or, for those opposed to government oversight, to prevent snooping on private interactions. In a world of government-issued currencies, the sort of laundering envisioned by Dr Green is impractical and often illegal. In America, the cash-handling threshold is $5,000 for banks to report suspicious activities and $10,000 for all deposits or transfers. Electronic transactions have varying regulatory requirements for reporting and banks may have their own rules. There's no such restriction in Bitcoin, the cryptographically derived virtual currency that has no governance per se; rather, technical limitations prevent effective bitwashing.

Bitcoin was designed, in part, to ensure complete and permanent transparency about each transfer of value from one party to another, while uncoupling it largely from the concept of an independent identity. Researchers have shown it is possible in many circumstances with the current version of the common Bitcoin software code, widely used on servers and client software, to track transactions well enough to group them by the parties engaged. Tie that to an exchange, which converts legal tender to and from Bitcoins, or a wallet service, which stores the coins on behalf of members, and external authorities could issue warrants and finger individuals.

This is largely because every Bitcoin transaction has to have an originating and destination account, or "address" in Bitcoin lingo. The owner of a given Bitcoin value signs it over in a way that proves he possesses the value's secret. Once signed away, it is the property of the recipient and secured by a secret of the recipient's sole knowledge.

So-called mixing services offer a form of laundering that accepts Bitcoins from any party's address and then returns an equal amount, typically less a fee, originating from another address. Only the mixing service, if it retains records, could connect the incoming and outgoing currency. That is a big risk, as is a service absconding with funds or engaging in lazy behaviour (effectively sending back the same coins), all of which researchers and regular Bitcoin users have encountered.

There is another way to hide transaction trails, which requires rethinking the cryptographic basis under which virtual currency is minted. In Bitcoin and many similar systems, public-key cryptography underlies the secret that currency owners possess. Bitcoin users create addresses by using encryption software to create a public/private key pair which are complementary. The public key may be freely distributed, and acts as an address to receive value. The private key is kept secret lest malefactors pilfer one's purse. This has happened on the order of many tens of millions of dollars so far through thefts and embezzlement. A Bloomberg TV anchor managed to have gift certificates stolen when displaying the private key unthinkingly during a broadcast.

Dr Green and three colleagues at Johns Hopkins University—Christina Garman, Ian Miers, and Aviel D. Rubin—released a paper in April 2013 that charted a different path relying on zero-knowledge proofs (ZKP). In Zerocoin, originally proposed as an extension to Bitcoin that could be incorporated into the currency's basic protocols, a Zerocoin is minted by a party who creates a unique serial number for a coin and then generates a random number. The two numbers are combined with a cryptographic function called hashing that is effectively impossible to reverse: only the possessor of the serial number and random number can produce the resulting hash.

Once a coin is created through a mining process—a computationally fiendish way to look for needles in haystacks that rewards the finder every few minutes—it is part of the public record, as with Bitcoin, and becomes part of a pool of coins that may be spent.

The nifty part comes next. Unlike Bitcoin, the serial number of a given coin (the equivalent of a Bitcoin address) is never associated with the transaction in which the coin is created. Anyone who owns a Zerocoin in any denomination can spend the coin by taking the full set of existing coins in circulation that haven't yet been claimed, creating a ZKP on his own computer and publishing it along with the serial number of the coin in question. Because the serial number wasn't published when the coin was minted, that creation can't be tracked back to the party now proving he owns it.

Dr Green explains that this proof gives no insight to other parties as to which coin is possessed by the owner even though the serial number has been revealed. The random number remains private and cannot be deduced. But because the owner knows it, the ZKP provides full assurance to the rest of the currency ecosystem of that ownership as all other parties can duplicate the ZKP without knowledge of that secret number. "We are proving to you that we are talking about something that is in the set of previous transactions," says Dr Green.

The owner of one coin can then mint a new one, essentially exchanging the old for the new, and provide the serial number and random key to another party who has no ability to connect ownership of the original coin with this newly minted virtual replacement. The serial number of the original coin only then becomes part of the public record, preventing it from being spent again.

Dr Green says that he and his colleagues were unable to gain enough support from the Bitcoin community to allow Zerocoin to operate within the ecosystem. This led them a few weeks ago to create a plan to launch a full-fledged alternative currency. The Zerocoin system will be based on the open-source Bitcoin software code, and will allow both zero-knowledge coins and Bitcoin-style public/private key coins to co-exist.

But many details remain to be settled before the new system launches. Dr Green says that the specification may change the algorithm used in minting to prevent the race upward in computational power consumed in Bitcoin. (Bitcoin "miners" currently perform roughly 200 quadrillion operations per second, utilising 800 times the reckoning force of the top 500 supercomputers in the world combined. Alternative approaches can have the same difficulty with far lower computational requirements.)

Dr Green says he has no particular political agenda for Zerocoin. Instead, it's the academic delight of perfecting a system which takes Bitcoin's pseudo-anonymity into something approaching full anonymity. His group wants to sort out now how to fairly administer the early generation of coins and the like, but "if people want to go a different direction with it after it's out there, that's fine." Once the genie is out of the bottle, Dr Green doesn't plan to retain the stopper.