Hot answers tagged

3

A Polynomial Commitment is a cryptographic object that binds a party, typically the prover, to a single polynomial. This object could be an elliptic curve point, such as in KZG or Bulletproofs en element of a group of unknown order, such as in DARK the root of a Merkle tree of a Reed-Solomon codeword, such as in FRI. The point is that underlying this ...


3

Let us see an example of how cryptographic hash functions are used in Zero-Knowledge Proof Systems. Following code written in Zokrates DSL Toolbox is an example of computing a Hash using Zero-Knowledge Proof systems. The programming instructions are compiled first. Then we will proceed to the setup of the arithmetic circuit through the setup. Then we export ...


2

final_exp_gadget<>() of libsnark could be a practical example to tune for DLP. The idea is, "final exponentiation" is a part of Ate pairing, that is verified as a part of check_e_equals_e_gadget<>(), which stands for Groth16 verification equation.


1

The line: default_r1cs_ppzksnark_pp::init_public_params(); is used to specify the public parameters used by the proving system ($\mathbb{G}_1, \mathbb{G}_2, \mathbb{G}_T, \mathbb{F}_p,$ ... etc). These are known by the generator, prover, and verifier and therefore are not secret. You are 100% correct that the prover and generator should be different ...


1

Yes, for sure! R1CS is an NP-complete language. It is basically a characterization of arithmetic circuits, hence every computation can be expressed as a R1CS. There are compilers that reduce program executions to R1CS. One of my favourite tools is Zokrates.


1

This sort of programming logic for the ZK SNARK systems can be developed into Arithmetic Circuits using Zokrates, a toolbox for zkSNARKs on Ethereum. It helps you use verifiable computation in your Decentralised Applications, from the specification of your program in a high-level language to generating proofs of computation to verifying those proofs in ...


1

I think there is not necessarily immediate relationship between security of zk-SNARKs and the size of the arithmetic circuit. Mostly the security of zk-SNARKs depends on your security parameter, your cryptographic assumptions and what kind of security properties you want to achieve. In contrast, the size of the arithmetic circuit is more related to the ...


Only top voted, non community-wiki answers of a minimum length are eligible