zk-SNARKs

A Non-interactive Zero-knowledge Proof

Outline

  • Recap
  • Non-interactive Zero-knowledge Proof
  • zk-SNARKs
    • Homomorphic Hiding
    • QAP (brief)
    • KCA (brief)
  • Reference

Recap

Zero-knowledge Proof

Prover

Verifier

the 1st block

Non-interactive Zero-knowledge Proof

Prover

Verifier

Where's Wally

???

zk-SNARKs

Features

  • non-interactive
    • less computation
  • tiny and easy to verify
    • keep Mina's blockchain light
    • keep personal data private

but I don't need to tell you where he is

my credit score is high enough to ...

but I don't need to tell you what my credit score exactly is

Goal - Blindness & Verifiable

Polynomial P(x)

Secret Point s

Verify P(s)

s

P(s)

P(x) = c_0 + c_1x + c_2x^2 + c_3x^3...

Concepts

Polynomial P(x)

Secret Point s

Verify P(s)

s

P(s)

P(x) = c_0 + c_1x + c_2x^2 + c_3x^3...

1. Homomorphic Hidings

2. QAP

3. KCA

Homomorphic Hidings

the most prominent

verify x + y = 7

x + y = 7

x, y

  • E(x) -x-> x
  • x != y then E(x) != E(y)
  • E(x+y) can be computed by E(x), E(y)
= g^x

verify x + y = 7

x + y = 7

x, y

verify x + y = 7

check E(x+y) ?= E(7)

x + y = 7

E(x), E(y)

So it is different from hash

E(x)

Secret Point s

Verify P(s)

Secret Point s

Verify P(s)

s

P(x) = c_0 + c_1x + c_2x^2 + c_3x^3...
E(s), E(s^2), E(s^3)...

E(P(x)) can be computed

E(x+y) can be computed by E(x), E(y)

QAP & KCA

brief

Secret Point s

Verify P(s) ?

Secret Point s

P(x) = c_0 + c_1x + c_2x^2 + c_3x^3...
E(s), E(s^2), E(s^3)...

QAP - the most complex

E(P(s))
E(P(s)) = H(s) * Z(s)
H(s)

Secret Point s

Verify P(s) ?

Secret Point s

P(x) = c_0 + c_1x + c_2x^2 + c_3x^3...
E(s), E(s^2), E(s^3)...

Problem: P'(x) & H'(x)

E(P'(s))
E(P'(s)) = H'(s) * Z(s)
H'(s)
(a, b), b = \alpha a

KCA - prevent P'(x) & H'(x)

  • alpha pair
  • alpha can't be computed by b/a
(c, d), c = \alpha d

how

(a, b), b = \alpha a

KCA - prevent P'(x) & H'(x)

  • alpha pair
  • alpha can't be computed by b/a
(\gamma a, \gamma b)

Secret Point s

Verify P(s)

Secret Point s

Verify P(s)

P(x) = c_0 + c_1x + c_2x^2 + c_3x^3...
E(s), E(s^2), E(s^3)...

KCA - prevent P'(x) & H'(x)

E(P(s)), E(\alpha P(s)), H(s)
E(P(s)) = H(s) * Z(s)
E(\alpha s), E(\alpha s^2), E(\alpha s^3)...

Summary

  • zk-SNARKs is non-interactive
  • Homomorphic Hidings for hiding secret point s
  • QAP for verifying P(x)
  • KCA for making sure that secret point s is used

Reference

Made with Slides.com