- aka ZK-systems
- aka spooky moon math
- aka dont show your secrets on a public blockchain
A collection of videos, reading materials and tools for learning all about the ZK side of crypto.
(Succinct non-interactive argument of knowledge)
Fast facts:
- used in Zcash
- available in Ethereum as pre-compiled smart contracts
- has a trusted setup phase, making a trusted party needed (OR having to deal with secure multi part computation (sMPC))
- very fast verification, very small proof
(Succinct transparent argument of knowledge)
Fast facts:
- newer, "hotter" cousin of SNARKs
- newer also means lots of research actively happening during the "warm up phase" for this technique
- does not require a trusted setup phase
- proof length is much longer than SNARK
- Zero-Knowledge Proof Protocol :: Eli Ben-Sasson at Web3 Summit (October 2018)
- STARK Arithmetization :: Eli Ben Sasson at Technion Cyber and Computer Security Summer School (September 2017)
- STARK Low Degree Testing :: Eli Ben Sasson at Technion Cyber and Computer Security Summer School (September 2017)
Fast facts:
- used in Monero
- great proof legth
- verification time
There are other proof systems, and some general Mathematics / ideas / standards that make ZK proofs work in theory and in application.
(Note: summary from the talk "Zero-Knowledge Proof Protocol :: Eli Ben-Sasson at Web3 Summit (October 2018)")
- there are many others proofs now, and more will come in the future, but these three are being used in blockchains already
- STARK prover will be quasi linear to naive computation (naive as in no zero knowledge aspects)
- SNARK is similar, but also has setup which is also scaling linear to the computation & prover time
- needs trust, and larger keys as the computation becomes larger
- Recursive SNARK (Coda) does not have this drawback of large keys, as the setup is scoped smaller due to epochs
- break the computation into a sequence of epochs
- only need to create a key for one epoch
- still have trusted setup
- proving time is larger
- Bulletproofs have a great proof length
- however the verification time is also super linear along with computation and proving time
- not so good for scalability, as there is no savings for the verifiers to process
- all are using pederson hashes
- Starkware
- Sapling release for Zcash
- Bulletproofs in Monero
- 1 TX -> 500kb to 80kb (Consensys 2017) to 45kb now (October 2018)
- yet to identify lower bound, more room for improvement!
- 10k TX -> 190kb to 135kb
- 3x greater size even though 10.000 factor increase in payload
- 1 TX -> 200 byte (with a 50MB key to prove)
- 10k TX -> 200 byte (with a 500GB key to prove)
- 1 TX -> 1.5kb
- 10k TX -> 2.5kb
- but the verification time is scaling linear with proving time