Agglomerate zksnarks

Let a, b be two statements. Given succinct (fixed size) zero-knowledge proofs z(a), z(b) that a, b are true, how easy is it to build z(a AND b)?

• For what succinct ZK schemes? ​ ​ – user991 May 28 '17 at 6:06
• I'm interested in ZK schemes similar to the zksnarks used in zcash (z.cash) – Randomblue May 28 '17 at 6:52
• What's the issue with just sending z(a) et z(b) ? – Geoffroy Couteau May 29 '17 at 17:00
• @GeoffroyCouteau I'm looking to agglomerate n zero-knowledge proofs into one for conciseness. Each zk-SNARK proof is 288 bytes and I want to "compress" n*288 bytes into just 288 bytes. – Randomblue May 30 '17 at 9:22

One way to do this is to construct two pairing-friendly curves such that the scalar field of the "outer" curve efficiently supports arithmetic for the "inner" curve. Then you can define a circuit for a zk-SNARK over the outer curve, that can verify proofs of a zk-SNARK over the inner curve. This can be done by constructing the outer curve using the Cocks-Pinch method, as in Zexe. In this case you would use an efficient zk-SNARK proving system such as Groth16, to reduce the cost of verifying the inner proofs.

Since I first wrote this answer, another approach has become available using $$2$$-cycles of non-pairing-friendly curves, as in Halo. (I'm a codesigner of Halo, with Sean Bowe and Jack Grigg.)

The #zcash-wizards channel of the Zcash community chat is a good place to ask about such things.

(This answer previously included a suggestion to use a nested pair of curves with the inner curve as BLS12 and the outer curve as BN. In fact there's no known method of matching up the base field of the BLS12 curve with the scalar field of the BN curve, and there are good reasons to believe that it is not possible to do so.)

Note that any of these approaches will only pay off if the number of proofs being aggregated is large.

• "Cycles of elliptic curves" term was introduced for a pair of curves such that order of the group of points on the first curve is field characteristic the second curve is defined over, and this also holds for curves the other way (switched first-second). youtube.com/watch?v=cLjfufsi2gM starting 41:00 – Vadym Fedyukovych Jul 22 '17 at 19:57
• May I suggest that pair of curves is only a part of the answer? It would be nice to have a bird-view of how this particular AND translates into polynomials, "quadratic arithmetic" program, recursion. Yes, I'm aware it is not easy to write that down. It might be reasonable to skip easy known parts like general bilinear pairing and knowledge of exponent assumption. – Vadym Fedyukovych Jul 31 '17 at 21:21
• Well, the AND is just a single multiplication constraint. The hard part is optimising the number of R1CS constraints required to implement the pairing operations in the Groth16 proof verification. – Daira Hopwood Sep 23 '17 at 13:54