Zero Knowledge Proofs

Shared
Secret

Typical Proofs

reveal knowledge

in proving 26781 is not a prime

we reveal its factorization

Alice will convince Bob that an assertion is true
without revealing
anything in the process

Desired

Completeness
Soundness
Zero Knowledge

For all valid assertions, Verifier says "yes"

For all invalid assertions, Verifier says "no"

Verifier is convinced, but gains "zero knowledge"

Reality

Completeness
Soundness
Zero Knowledge

For all valid assertions, Verifier says "yes"

For all invalid assertions, Verifier says "no"

( with a very high probability )

Verifier is convinced, but gains "zero knowledge"

Colour blindness

analogy

Example uses

Proving
you have a preimage to a hash function

Discrete Logarithm Problem

ZkP \{(\color{red}a) : \color{blue}A = \color{blue}g^\color{red}a \}

\(\color{blue}g\) is the generator of cyclic group \(\color{blue}G\) of prime order \(\color{blue}p\)

\(\color{blue}A \in \color{blue}G \) is an arbitrary group element having discrete logarithm $$ \color{red}a = \log_\color{blue}g(\color{blue}A) $$

Interactive Protocol

ZkP \{(\color{red}a) : \color{blue}A = \color{blue}g^\color{red}a \}
\begin{matrix} \text{Prover} && \text{Verifier} \\ \color{red}k \leftarrow \mathbb{Z}_\color{blue}p \\ \color{blue}r = \color{blue}g^\color{red}k & \longrightarrow & \\ \\ & \longleftarrow & \color{blue}e \leftarrow \mathbb{Z}_\color{blue}p \\ \\ \color{blue}s = \color{red}k + \color{red}a\color{blue}e & \longrightarrow & \text{accept if } \\ && \color{blue}r = \color{blue}g^\color{blue}s \times \color{blue}A^{-\color{blue}e} \end{matrix}

Non Interactive Protocol

\begin{matrix} \text{Prover} && \text{Verifier} \\ \color{red}k \leftarrow \mathbb{Z}_\color{blue}p \\ \color{blue}r = \color{blue}g^\color{red}k \\ \color{blue}e \leftarrow \mathcal{H}(\color{blue}r) \\ \color{blue}s = \color{red}k + \color{red}a\color{blue}e & \longrightarrow & \text{accept if } \\ && \color{blue}r = \color{blue}g^\color{blue}s \times \color{blue}A^{-\color{blue}e} \end{matrix}

\( \mathcal{H} \) is function where every input is mapped to a unique output

learn more!

3 step process (NIP)

testNonInteractiveProof :: IO Bool
testNonInteractiveProof = do
  let secret = 42
  let a' = pointBaseMul secp256k1 secret
  
  -- Prover
  (r, k) <- commmitment

  -- Prover
  let e = oracle (show r)

  -- Prover
  let s = response k e secret

  -- Verifer 
  pure (verify a' r e s)

3 step process (IP)

testInteractiveProof :: IO Bool
testInteractiveProof = do
  let secret = 42
  let a' = pointBaseMul secp256k1 secret
  
  -- Prover
  (r, k) <- commmitment

  -- Verifier
  e <- challange

  -- Prover
  let s = response k e secret

  -- Verifer 
  pure (verify a' r e s)


Haskell or GTFO

\begin{matrix} \color{red}k \leftarrow \mathbb{Z}_\color{blue}p \\ \color{blue}r = \color{blue}g^\color{red}k \end{matrix}
commmitment :: MonadRandom m => m (Point, Integer)
commmitment = do
  k <- generateBetween 0 p
  pure (pointBaseMul secp256k1 k, k)
\text{Prover}
\color{blue}e \leftarrow \mathbb{Z}_\color{blue}p
challange :: MonadRandom m => m Integer
challange = generateBetween 0 p
\color{blue}s = \color{red}k + \color{red}a\color{blue}e
response :: Integer -> Integer -> Integer -> Integer
response k chal secret = (k + chal*secret)

Haskell or GTFO

\begin{matrix} \text{accept if } \\ \color{blue}r = \color{blue}g^\color{blue}s \times \color{blue}A^{\color{blue}e} \end{matrix}
verify :: Point -> Point -> Integer -> Integer -> Bool
verify a' r e s = lhs == rhs 
  where
    lhs = pointBaseMul secp256k1 s
    rhs = pointAdd secp256k1 r (pointMul secp256k1 e a')

\text{Verifier}

Completeness

\begin{matrix} \text{accept if } \\ \color{blue}r & = & \color{blue}g^\color{blue}s \times \color{blue}A^{\color{blue}e} \\ \color{blue}r & = & \color{blue}g^{\color{red}k+\color{red}a\color{blue}e} \times ( \color{blue}g^\color{red}k)^{\color{blue}e} \\ \color{blue}r & = & \color{blue}g^{\color{red}k} \end{matrix}

And

Not Optimal

testAndProof :: IO (Bool, Bool)
testAndProof= do
  a <- testNonInteractiveProof
  b <- testNonInteractiveProof
  pure (a, b)

Common
Challenge And Response

Single commitment


testAndProof' :: IO Bool
testAndProof' = do
  
  let secretA = 42
  let a' = pointBaseMul secp256k1 secretA
  let secretB = 43
  let b' = pointBaseMul secp256k1 secretB
  
  -- Prover
  (r, k) <- commmitment

  -- Prover
  let e = oracle (show r)

  -- Prover
  let s = (response k e secretA) + e * secretB

  -- Verifer 
  pure (verifyAnd a' b' r e s)

verifyAnd a' b' r e s = lhs == rhs
  where
    lhs = pointBaseMul secp256k1 s
    rhs = pointAdd secp256k1 r (pointAdd secp256k1 a b)
    a = pointMul secp256k1 e a'  
    b = pointMul secp256k1 e b'

Equality

Title Text

testEqProof :: IO Bool
testEqProof = do
  
  let secret = 42
  let a' = pointBaseMul secp256k1 secret
  let b' = pointBaseMul secp192r1 secret
  
  -- Prover
  k <- generateBetween 0 p
  let rA = pointBaseMul secp256k1 k
  let rB = pointBaseMul secp192r1 k

  -- Prover
  let e = oracle (show [rA,rB])

  -- Prover
  let s = (response k e secret)

  -- Verifer 
  pure (verifyEq secp256k1 a' rA e s && verifyEq secp192r1 b' rB e s)
verifyEq :: Curve -> Point -> Point -> Integer -> Integer -> Bool
verifyEq curve a' r e s = lhs == rhs 
  where
    lhs = pointBaseMul curve s
    rhs = pointAdd curve r (pointMul curve e a')

Or

Fin.

I hope this was a

"talk about zero-knowledge” and not a

"zero-knowledge talk."

deck

By ..

deck

  • 1,851