2
$\begingroup$

In ZK Snarks bilinear pairings are used to do "encrypted computation". I was wondering if we can use Partial Homomorphic Encryption or Somewhat Homomorphic Encryption instead of bilinear pairings. Can you please elaborate on why they should or should not be used?

$\endgroup$
4
$\begingroup$

Yes it is possible, and in fact, it has been done, with partial homomorphic encryption (for example in this paper) and somewhat homomorphic encryption (here and here).

The main difference is that a SNARG which uses these primitives instead of pairings is not publicy verifiable anymore. Indeed, suppose to simplify that you are supposed to perform a "multiplication" and some additions using a pairing, and that the verification should succeed if the exponent in 0 in the end. When doing so with the pairing, the final "zero test" can be publicly checked by everyone. When replacing it by a homomorphic encryption scheme, however, what you end up with is an encryption of zero. Checking that this does encrypt zero requires knowing the secret key of the scheme. For this reason, these SNARGs are restricted to being designated-verifier: they can only be verified by the owner of a specific secret key (and this secret key cannot be made public, since knowing it allows to forge a proof).

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.