3
$\begingroup$

zk-SNARK was a powerful tool for privacy-respecting e-cash. However, recent years, in the literatures about anonymous authentication scheme, such as group signatures, anonymous credential, blind signature, etc., the construction of these schemes did not use zk-SNARK as the NIZK tool, but traditional ways(Fiat-Shamir transform in ROM or CRS-based Groth-Sahai NIZK). So, my questions are:

  1. If one use zk-SNARK as NIZK tool in an anonymous authentication scheme, will it lead to some effiency or secure problems? and why?
  2. Can the zk-SNARK only be used in Blockchain-based privacy-preserving schemes or verifiable computation?

In other words, I wanna construct a group signatures/anonymous credential scheme by using zk-SNARK, due to its "succinct" proof. But for now I haven't found any literature about this counstruction method for group signatures/anonymous credential scheme. So the above questions are presented.

Improve this question
$\endgroup$
2
  • $\begingroup$ You seem to assume that using a Fiat-Shamir transformation never yields a zk-SNARK, but this is not necessarily the case I think. Maybe crypto.stackexchange.com/questions/74382/… helps you grasp a bit more. A zk-SNARK is not a specific algorithm, but a category of algorithms. Your questions aren't very clear to me, especially the second one: do you ask whether a zk-SNARK is something that cannot be used outside of blockchain? $\endgroup$
    – Ruben De Smet
    May 25, 2021 at 10:31
  • 1
    $\begingroup$ @RubenDeSmet Thank you for your answers. Acutally, I wanna design a group signatures where the NIZK is very important component. So, when I learn the advantages of zk-SNARK, I wanna use it as the NIZK argument in my construction of group signatures. But there is no paper talked about this. Therefore, I wondered that whether the zk-SNARK can only be used in verifable computation or limited scenes? $\endgroup$
    – ming alex
    May 27, 2021 at 0:19

1 Answer 1

Reset to default
1
$\begingroup$

For now, I have gradually understood why the zk-SNARK cannot be suitable for constructing anonymous authentication scheme. That is the performance issue.

According to some references:

[1]Succinct Non-Interactive Zero Knowledge for a von Neumann Architecture;

[2]Comparing General Purpose zk-SNARKs

The zk-SNARK takes seconds to perform a proof operation. Therefore, due to the requirement of efficent computing for the prover is essential to an anonymous authentication scheme, the zk-SNARK cannot meet it.

Improve this answer
$\endgroup$
4
  • 1
    $\begingroup$ I disagree. zk-SNARKs are actually terribly fast. The things you link there use extremely complex circuits, [1] for instance runs a full RISC and then seems slow to prove a TSP witness, but it actually has a lot of overhead because it's proving a whole Turing machine with a lot of state transitions. Proving their TSP witness shouldn't$^{\text{[citation needed]}}$ take more than a few thousand constraints at most, while their example takes ~300k multiplication gates. That said, constructing your own ZK scheme for your specific authentication system will probably always be faster. $\endgroup$
    – Ruben De Smet
    Jun 1, 2021 at 8:00
  • 1
    $\begingroup$ @RubenDeSmet A huge thanks to your response. You inspired me to continue researching zk-SNARK and update this answer. $\endgroup$
    – ming alex
    Jun 2, 2021 at 0:18
  • $\begingroup$ I wish you very well in your search. I might post an answer in a few months myself, because I'm actually authoring a paper that's very much related to this topic. $\endgroup$
    – Ruben De Smet
    Jun 2, 2021 at 14:03
  • $\begingroup$ @RubenDeSmet Great! I also have some ideas to build my scheme by improving the zk-SNARK, and I look forward to your answer or paper:) $\endgroup$
    – ming alex
    Jun 16, 2021 at 1:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.