The definition of zk-SNARK involves not leaking any information from the prover-verifier interaction, but what about leaking information from the circuit itself? e.g., could there be a circuit to demonstrate that I know the preimage to s, where s is a signature generate by secret x and signing algorithm HMAC(x, plaintext)? This circuit shouldn't give any information about what x is.

Edit: to clarify my question, neither prover nor verifier should know x; x should just be in the circuit which ideally can't be reverse-engineered to discover x.

  • 1
    $\begingroup$ We I'm misunderstanding your question, but the circuit didn't need to be reverse engineered. It's publicly known and given to the verifier in plain. However in your example x would not be part of the circuit description, it is the witness, i.e. the input to the circuit. $\endgroup$
    – Maeher
    May 9, 2022 at 7:11
  • $\begingroup$ Thanks, @Maeher. I meant that x shouldn't be a witness, as we don't want the prover to know x either. Is it possible to have a proof where nobody knows x but can still check if HMAC(x, witness) = s? $\endgroup$
    – nnsk
    May 9, 2022 at 15:16
  • $\begingroup$ You can prove that for some circuit you know an input such that the output is $s$. To hide $x$ the circuit would need to be somehow obfuscated but then the question is how you verify that the obfuscated circuit really computes HMAC. $\endgroup$
    – Maeher
    May 9, 2022 at 15:23
  • $\begingroup$ No, the zk-SNARK is a kind of NIZK, which can ensure that the witness, e.g., the secret x, is not disclosed except the proof $\pi$ and the statment s. So, for HMAC, the complier converts it to a arithmetic circuit fistly, and finally generates a QAP/QSP instance. Duo to the QAP is hard, then it is difficult to reverse to get the information of the witnesses. $\endgroup$
    – ming alex
    May 10, 2022 at 9:19
  • $\begingroup$ I edited the problem a bit to clarify: ideally, neither the prover nor verifier knows x. The prover just needs to show they know a valid (signature, plaintext) pair. If i understand correctly, x isn't a witness in this case but rather part of the circuit $\endgroup$
    – nnsk
    May 10, 2022 at 21:45


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.