I am interested in learning more about NIZK proofs in the CRS model.
The CRS must be random but 'trusted' by all parties.
How does these data get generated both in theory and in practice?
$\begingroup$
$\endgroup$
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
The state of the art for generating a structured CRS for a zk-SNARK is the multi-party computation that Zcash did for its Sapling upgrade. The paper, software, and information on security precautions taken for both the Sapling setup and the earlier Sprout setup are linked from https://z.cash/technology/paramgen.html .
$\begingroup$
$\endgroup$
3
The CRS must be generated in some trusted manner. One could use a secure coin tossing protocol involving a number of parties, and this would be fine as long as a majority of the parties are honest.
One could also apply a hash function to the New York Times of January 1st 2000 (or any other date) and use the result, although this would need a random oracle assumption.
answered May 3, 2017 at 11:36
-
1$\begingroup$ what about if the CRS needs to have a certain structure? $\endgroup$– bekahJun 9, 2017 at 12:28
-
$\begingroup$ In this case, you need trust, or a secure multiparty protocol to generate that distribution. Usually one distinguishes between a common RANDOM string (which is uniformly distributed) and a common REFERENCE string (which has some other distribution). Unfortunately, both have the same acronym of CRS. $\endgroup$ Aug 26, 2017 at 19:25
-
1$\begingroup$ Yes, which is why I recommend "structured CRS" vs "unstructured CRS", and abandoning the "Random" terminology. (R then stands for Reference in both cases, which is correct since both are particular cases of a Common Reference String.) $\endgroup$ Sep 23, 2017 at 13:57