# IS zk-SNARK not suitable for constructing anonymous authentication scheme?

zk-SNARK was a powerful tool for privacy-respecting e-cash. However, recent years, in the literatures about anonymous authentication scheme, such as group signatures, anonymous credential, blind signature, etc., the construction of these schemes did not use zk-SNARK as the NIZK tool, but traditional ways(Fiat-Shamir transform in ROM or CRS-based Groth-Sahai NIZK). So, my questions are:

1. If one use zk-SNARK as NIZK tool in an anonymous authentication scheme, will it lead to some effiency or secure problems? and why?
2. Can the zk-SNARK only be used in Blockchain-based privacy-preserving schemes or verifiable computation?

In other words, I wanna construct a group signatures/anonymous credential scheme by using zk-SNARK, due to its "succinct" proof. But for now I haven't found any literature about this counstruction method for group signatures/anonymous credential scheme. So the above questions are presented.

• You seem to assume that using a Fiat-Shamir transformation never yields a zk-SNARK, but this is not necessarily the case I think. Maybe crypto.stackexchange.com/questions/74382/… helps you grasp a bit more. A zk-SNARK is not a specific algorithm, but a category of algorithms. Your questions aren't very clear to me, especially the second one: do you ask whether a zk-SNARK is something that cannot be used outside of blockchain? May 25 at 10:31
• @RubenDeSmet Thank you for your answers. Acutally, I wanna design a group signatures where the NIZK is very important component. So, when I learn the advantages of zk-SNARK, I wanna use it as the NIZK argument in my construction of group signatures. But there is no paper talked about this. Therefore, I wondered that whether the zk-SNARK can only be used in verifable computation or limited scenes? May 27 at 0:19

For now, I have gradually understood why the zk-SNARK cannot be suitable for constructing anonymous authentication scheme. That is the performance issue.

According to some references:

The zk-SNARK takes seconds to perform a proof operation. Therefore, due to the requirement of efficent computing for the prover is essential to an anonymous authentication scheme, the zk-SNARK cannot meet it.

• I disagree. zk-SNARKs are actually terribly fast. The things you link there use extremely complex circuits, [1] for instance runs a full RISC and then seems slow to prove a TSP witness, but it actually has a lot of overhead because it's proving a whole Turing machine with a lot of state transitions. Proving their TSP witness shouldn't$^{\text{[citation needed]}}$ take more than a few thousand constraints at most, while their example takes ~300k multiplication gates. That said, constructing your own ZK scheme for your specific authentication system will probably always be faster. Jun 1 at 8:00
• @RubenDeSmet A huge thanks to your response. You inspired me to continue researching zk-SNARK and update this answer. Jun 2 at 0:18
• I wish you very well in your search. I might post an answer in a few months myself, because I'm actually authoring a paper that's very much related to this topic. Jun 2 at 14:03
• @RubenDeSmet Great! I also have some ideas to build my scheme by improving the zk-SNARK, and I look forward to your answer or paper:) Jun 16 at 1:11