I'm a bit lost. I know that ZKBoo can be used for proving $y = C(x)$ for any boolean or arithmetic circuit $C$. However, I'm unsure how to combine several circuits when we want to do more complex proofs.

Suppose we have $X = \mathsf{Hash}(x)$, $Y = \mathsf{Hash}(y)$ and $Z = \mathsf{Hash}(z)$ and a publicly known prime $p$. Assume we want to prove that $x\cdot y = z\bmod p$, and we already have a circuit for modular multiplication $C_p$ and a circuit for the hash function $C_\mathsf{hash}$. How can we prove the relation between pre-images?

Shall we construct another circuit that combines modular multiplication and hash computation $C_{all}$, or is it possible to use $C_\mathsf{hash}$ and $C_p$? My main confusion is about the share/reconstruct part. In the ZKBoo proof, the reconstruction happens at the end, and all $3$ values are revealed along with selected $2$ traces. However, if we naively combine two circuits, the reconstruction result after the first circuit should remain secret, which makes me think that a naive approach will not work.

Do you know any works about combining several circuits for ZKBoo proofs? I also would appreciate any good article about the modular multiplication (or addition) circuit.



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.