What role does a circuit play in ZK-SNARKS? Is it executed on both the prover's and the verifier's machine? If so, how would you program it to check if one value is greater than another value?
$\begingroup$
$\endgroup$
1
-
1$\begingroup$ You may check a relevant question and related discussions in crypto.stackexchange.com/questions/59324/… $\endgroup$– K.BagheryCommented Jan 4, 2019 at 15:29
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
2
Technically neither party necessarily evaluates the circuit.
The two parties share the description of a circuit $C$, an output value $y$ and potentially some input values $x_1\dots,x_\ell$. the prover than proves to the verifier that they know additional secret inputs $s_1,\dots,s_n$, such that if one were to evaluate the circuit $C$ on inputs $x_1\dots,x_\ell,s_1,\dots,s_n$ the result would be $y$. I.e., $$C(x_1\dots,x_\ell,s_1,\dots,s_n)=y.$$
The argument of knowledge property guarantees that the prover must actually know said inputs in order to convince the verifier. The zero-knowledge property guarantees that the verifier learns nothing from the exchange except that the above statement is true. In particular the verifier learn no information about $s_1,\dots,s_n$.
-
$\begingroup$ zero knowledge property usually means a simulator algorithm exists. $\endgroup$ Commented Apr 2, 2020 at 18:30
-
1$\begingroup$ Which is the formalization of the notion that the verifier learns nothing from the interaction. $\endgroup$– MaeherCommented Apr 2, 2020 at 19:26