0
$\begingroup$

In the context of zk-SNARKS, we are given an arithmetic circuit $C$, public outputs $y_1, \ldots, y_n = \mathbf{y}$ and some public inputs $x_1, \ldots, x_ℓ$. The prover wants to prove knowledge of some extra secret inputs $s_1, \ldots, s_m$ such that if one were to evaluate the circuit $C$ on inputs $x_1…,x_ℓ,s_1,…,s_m$ the result would be $\mathbf{y}$.

In some application like in HALO, the recursion property depends on the size of the arithmetic circuit being evaluated. However it does not seem to be related to the security of the scheme, fixed at roughly 128bits. If so, given a certain security level $\lambda$, can one create a zk-SNARK with any circuit size? (granted that the circuit does verify the "valid assignments" we want provers to have)

$\endgroup$
1
$\begingroup$

I think there is not necessarily immediate relationship between security of zk-SNARKs and the size of the arithmetic circuit. Mostly the security of zk-SNARKs depends on your security parameter, your cryptographic assumptions and what kind of security properties you want to achieve. In contrast, the size of the arithmetic circuit is more related to the efficiency of zk-SNARKs, such as prover/verifier running time and proof size. For sure sometimes if you need some stronger security property, for example, you want to achieve universal and updatable CRS, this would lead to a larger arithmetic circuit

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.