For a public one-way function $f()$, we can use zero proof to prove I know some secret $x$, such that the output of $x$ is a specific number $y$.

However, in zcash, I need to prove that I have some secret $x$, then $cm$ which is the commitment result of $x$ is a leaf in Merkle tree. Here, $cm$ is not a specific number and it is secret.

How should I prove this statement? I cannot figure out the circuit structure and the process using ZK-snark.


1 Answer 1


"[T]he process using ZK-snark" is to express the statement being proved as an R1CS system, produce proving and verifying public keys, produce and verify a snark-proof. A large non-trivial R1CS system is often expressed in terms of "gadgets" according to high-level "circuit structure".

A popular algorithm/proof was introduced at https://eprint.iacr.org/2016/260.pdf and implemented in libsnark. Zcash-specific "circuit" is documented in their "protocol" paper.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.