I am interested in learning more about NIZK proofs in the CRS model.
The CRS must be random but 'trusted' by all parties.
How does these data get generated both in theory and in practice?
$\begingroup$
$\endgroup$
$\begingroup$
$\endgroup$
The state of the art for generating a structured CRS for a zk-SNARK is the multi-party computation that Zcash did for its Sapling upgrade. The paper, software, and information on security precautions taken for the earlier Sprout upgrade are linked from https://z.cash/technology/paramgen.html ; I hope that they will be updated for the Sapling CRS generation soon.
$\begingroup$
$\endgroup$
The CRS must be generated in some trusted manner. One could use a secure coin tossing protocol involving a number of parties, and this would be fine as long as a majority of the parties are honest.
One could also apply a hash function to the New York Times of January 1st 2000 (or any other date) and use the result, although this would need a random oracle assumption.
answered May 3 '17 at 11:36
-
1$\begingroup$ what about if the CRS needs to have a certain structure? $\endgroup$ – bekah Jun 9 '17 at 12:28
-
$\begingroup$ In this case, you need trust, or a secure multiparty protocol to generate that distribution. Usually one distinguishes between a common RANDOM string (which is uniformly distributed) and a common REFERENCE string (which has some other distribution). Unfortunately, both have the same acronym of CRS. $\endgroup$ – Yehuda Lindell Aug 26 '17 at 19:25
-
1$\begingroup$ Yes, which is why I recommend "structured CRS" vs "unstructured CRS", and abandoning the "Random" terminology. (R then stands for Reference in both cases, which is correct since both are particular cases of a Common Reference String.) $\endgroup$ – Daira Hopwood Sep 23 '17 at 13:57
