1
$\begingroup$

I am engaged in the research of zk-SNARKs. After I read some papers about zk-SNARKs, I realize the Kate Commitment and the Algebraic Group Model is used a lot since 2019. They are used in Sonic, Plonk, Marlin and etc. Most of these papers are about "universal and updatable zk-SNARKs". I want to know if the Kate Commitment, the AGM and the "universal and updatable zk-SNARKs" have some kind of connection, and what inspired the Kate Commitment, the AGM be used a lot in "universal and updatable zk-SNARKs"?

Hope someone can help me solve this problem, thank you in advance!

Improve this question
$\endgroup$
5
  • 1
    $\begingroup$ These zk-SNARKs are universal and updatable beacuse Kate is. More precisely, the structured referenced string (srs) used in the Kate commiment tends to be the commitments of powers of some secret number $s$ up to some exponent $n$. As long as your circuit does not exceed $n$ gates, you can keep using the same srs. Moreover, at any time, you can change this srs with any other (this is why it is updatable). $\endgroup$
    – Bean Guy
    Oct 13, 2021 at 15:09
  • $\begingroup$ I think you are right about Kate Commitment. What about AGM? Why it is used a lot since 2019? Almost all of these papers about zk-SNARKs. $\endgroup$
    – 张海军
    Oct 14, 2021 at 3:58
  • $\begingroup$ This is due to a more theoretical reason. The AGM is used because it is a security model where it is much more friendly to assume the Q-Discrete Logarithm Assumption (which is necessary to keep the system consistent). $\endgroup$
    – Bean Guy
    Oct 14, 2021 at 5:49
  • $\begingroup$ According to Plonk, “real pairing check” means checking element relation in Gi, and “ideal pairing check” means checking relevant element relation in Fp. The q-Dlog Assumption is used to prove the probability gap between these two checks to being negligible. Is it right? $\endgroup$
    – 张海军
    Oct 19, 2021 at 12:04
  • $\begingroup$ The AGM vs KoE assumptions allows for half of group elements both in the SRS and the proof, so for scalability it is really useful. the AGM's first paper was published in 2017, and I guess people needed sometimes to realize how useful it is $\endgroup$
    – AntonioFa
    Oct 22, 2021 at 10:43

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.