What role does a circuit play in ZK-SNARKS? Is it executed on both the prover's and the verifier's machine? If so, how would you program it to check if one value is greater than another value?


Technically neither party necessarily evaluates the circuit.

The two parties share the description of a circuit $C$, an output value $y$ and potentially some input values $x_1\dots,x_\ell$. the prover than proves to the verifier that they know additional secret inputs $s_1,\dots,s_n$, such that if one were to evaluate the circuit $C$ on inputs $x_1\dots,x_\ell,s_1,\dots,s_n$ the result would be $y$. I.e., $$C(x_1\dots,x_\ell,s_1,\dots,s_n)=y.$$

The argument of knowledge property guarantees that the prover must actually know said inputs in order to convince the verifier. The zero-knowledge property guarantees that the verifier learns nothing from the exchange except that the above statement is true. In particular the verifier learn no information about $s_1,\dots,s_n$.

| improve this answer | |
  • $\begingroup$ zero knowledge property usually means a simulator algorithm exists. $\endgroup$ – Vadym Fedyukovych Apr 2 at 18:30
  • 1
    $\begingroup$ Which is the formalization of the notion that the verifier learns nothing from the interaction. $\endgroup$ – Maeher Apr 2 at 19:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.