0
$\begingroup$

The definition of zk-SNARK involves not leaking any information from the prover-verifier interaction, but what about leaking information from the circuit itself? e.g., could there be a circuit to demonstrate that I know the preimage to s, where s is a signature generate by secret x and signing algorithm HMAC(x, plaintext)? This circuit shouldn't give any information about what x is.

Edit: to clarify my question, neither prover nor verifier should know x; x should just be in the circuit which ideally can't be reverse-engineered to discover x.

Improve this question
$\endgroup$
9
  • 1
    $\begingroup$ We I'm misunderstanding your question, but the circuit didn't need to be reverse engineered. It's publicly known and given to the verifier in plain. However in your example x would not be part of the circuit description, it is the witness, i.e. the input to the circuit. $\endgroup$
    – Maeher
    May 9, 2022 at 7:11
  • $\begingroup$ Thanks, @Maeher. I meant that x shouldn't be a witness, as we don't want the prover to know x either. Is it possible to have a proof where nobody knows x but can still check if HMAC(x, witness) = s? $\endgroup$
    – nnsk
    May 9, 2022 at 15:16
  • $\begingroup$ You can prove that for some circuit you know an input such that the output is $s$. To hide $x$ the circuit would need to be somehow obfuscated but then the question is how you verify that the obfuscated circuit really computes HMAC. $\endgroup$
    – Maeher
    May 9, 2022 at 15:23
  • $\begingroup$ No, the zk-SNARK is a kind of NIZK, which can ensure that the witness, e.g., the secret x, is not disclosed except the proof $\pi$ and the statment s. So, for HMAC, the complier converts it to a arithmetic circuit fistly, and finally generates a QAP/QSP instance. Duo to the QAP is hard, then it is difficult to reverse to get the information of the witnesses. $\endgroup$
    – ming alex
    May 10, 2022 at 9:19
  • $\begingroup$ I edited the problem a bit to clarify: ideally, neither the prover nor verifier knows x. The prover just needs to show they know a valid (signature, plaintext) pair. If i understand correctly, x isn't a witness in this case but rather part of the circuit $\endgroup$
    – nnsk
    May 10, 2022 at 21:45

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.