Transparent SNARKs from DARK Compilers

Bünz, Benedikt; Fisch, Ben; Szepieniec, Alan

doi:10.1007/978-3-030-45721-1_24

Cited by 139 publications

(92 citation statements)

References 36 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Finally, we note the entire discussion on these enhancements holds verbatim when we replace linear forms by affine forms. 4 Note that we have identified two distinct intractability assumptions, each of which supports this pivot: the Discrete Logarithm assumption (as used in prior work involving Bulletproofs [5,7]) but also one derived from the Strong-RSA assumption (as nailed down in a recent work [8] on Bulletproofs and their improved applications). The introduction focuses on the DL assumption, but the Σ-protocol for the solution derived from the Strong-RSA assumption follows similarly.…”

Section: A Our Pivotal σ-Protocolmentioning

confidence: 66%

“…Besides some minor details in the compressed pivot, we show that the above discussion holds verbatim for a commitment scheme based on an assumption derived from the Strong-RSA assumption. More precisely, we show how the polynomial commitment scheme from a recent work [8] can be adapted to open arbitrary linear forms. Our adaptations of the linearization techniques from [12] are directly applicable to the Strong-RSA derived pivot.…”

Section: F Our Program From the Strong-rsa Assumptionmentioning

confidence: 99%

See 1 more Smart Citation

Compressed $$\varSigma $$-Protocol Theory and Practical Application to Plug & Play Secure Algorithmics

Attema

Cramer

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Σ-Protocols provide a well-understood basis for secure algorithmics. Recently, Bulletproofs (Bootle et al., EUROCRYPT 2016, and Bünz et al., S&P 2018) have been proposed as a drop-in replacement in case of zero-knowledge (ZK) for arithmetic circuits, achieving logarithmic communication instead of linear. Its pivot is an ingenious, logarithmicsize proof of knowledge BP for certain quadratic relations. However, reducing ZK for general relations to it forces a somewhat cumbersome "reinvention" of cryptographic protocol theory. We take a rather different viewpoint and reconcile Bulletproofs with Σ-Protocol Theory such that (a) simpler circuit ZK is developed within established theory, while (b) achieving exactly the same logarithmic communication. The natural key here is linearization. First, we repurpose BPs as a blackbox compression mechanism for standard Σ-Protocols handling ZK proofs of general linear relations (on compactly committed secret vectors); our pivot. Second, we reduce the case of general nonlinear relations to blackbox applications of our pivot via a novel variation on arithmetic secret sharing based techniques for Σ-Protocols (Cramer et al., ICITS 2012). Orthogonally, we enhance versatility by enabling scenarios not previously addressed, e.g., when a secret input is dispersed across several commitments. Standard implementation platforms leading to logarithmic communication follow from a Discrete-Log assumption or a generalized Strong-RSA assumption. Also, under a Knowledge-of-Exponent Assumption (KEA) communication drops to constant, as in ZK-SNARKS. All in all, our theory should more generally be useful for modular ("plug & play") design of practical cryptographic protocols; this is further evidenced by our separate work (2020) on proofs of partial knowledge.

show abstract

Section: A Our Pivotal σ-Protocolmentioning

confidence: 66%

Section: F Our Program From the Strong-rsa Assumptionmentioning

confidence: 99%

Compressed $$\varSigma $$-Protocol Theory and Practical Application to Plug & Play Secure Algorithmics

Attema

Cramer

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…2) SUCCINCT ZK PROOF SYSTEMS WITHOUT A TRUSTED SETUP 16 Within the latest few years, especially late 2019, several works have explored succinct zero-knowledge proofs without a trusted setup (also denoted as transparent setup). The most well-known of these proof systems are the STARK [84], Fractal [85] and Supersonic [86]. While these proof systems are promising, the size of their proofs are magnitudes larger than the current trusted setup, making them impractical for a blockchain setting (varying from tens to hundreds of KB for each proof, the current trusted setup SNArKs is 127 bytes [87], [88]).…”

Section: A Possible Research Directions 1) Transactions Propagation mentioning

confidence: 99%

Privacy and Cryptocurrencies—A Systematic Literature Review

2020

View full text Add to dashboard Cite

Our transaction history in the current centralized banking system has the ability to reveal a lot of private information for each spender, both to the banking system itself, but also to those entities that surround it (e.g., governments, industry etc). Examples of leaking information constitute the amounts spent, the goods on which the amounts were spent, the spending locations and the users we exchange money with. This knowledge is powerful in the hands of those who have it, and can be used in multiple ways, not always to our benefit. Cryptocurrencies, such as the famous Bitcoin, were proposed as a means to address the limitations of centralized banking systems and to offer its users privacy with regards to their transactional data. In this work, we perform a systematic literature review on the realm of privacy for electronic currencies. We present the development of digital money from electronic cash to cryptocurrencies and focus on the techniques that are employed to enhance user-privacy. Furthermore, we present flaws of the current cryptocurrency systems, which reduce the privacy of the cryptocurrency users. Finally, we describe three research directions to enhance privacy for cryptocurrencies: transaction propagation mechanisms, succinct ZK proof systems without a trusted setup, and specialised trustless zero-knowledge proofs. INDEX TERMS Anonymity, bitcoin, confidentiality, cryptocurrencies, electronic cash, privacy, zero-knowledge.

show abstract

“…If no trusted setup is required, it is called transparent [7], [8], [58]- [60]. Bulletproof [8] efficiently reduces the proof size logarithmically with the circuit size, by optimizing inner product operations.…”

Section: A Cryptographic Approachesmentioning

confidence: 99%

“…Hyrax [7] is based on a sum-check protocol in-troduced by Goldwasser et al [47], and improved by [5]. Dark [58] is an efficient polynomial commitment scheme using an unknown order group. It is the first approach to generate a logarithmic-size proof and logarithmic verification time.…”

Section: A Cryptographic Approachesmentioning

confidence: 99%

Practical Verifiable Computation by Using a Hardware-Based Correct Execution Environment

et al. 2020

View full text Add to dashboard Cite

The verifiable computation paradigm has been studied extensively as a means to verifying the result of outsourced computation. In said scheme, the verifier requests computation from the prover and verifies the result by checking the output and proof received from the prover. Although they have great potential for various critical applications, verifiable computations have not been widely used in practice, because of their significant performance overhead. Existing cryptography-based approaches incur significant overhead, because a cryptography-based mathematical frame needs to be constructed, which prevents deviation from the correct computation. The proposed approach is to reduce the overhead by trusting the computing hardware platform where the computation is outsourced. If one trusts the hardware to do the computation, the hardware can take the place of the cryptographic computing frame, thereby guaranteeing correct computation. The key challenge of this approach is to define what exactly the hardware should guarantee for verifiable computation. For this, we introduce the concept of Correct Execution Environment (CEE), which guarantees instruction correctness and state preservation. We prove that these two requirements are satisfactory conditions for a correct output. By employing a CEE, the verifiable computation scheme can be simplified, and its overhead can be reduced drastically. The presented experimental results demonstrate that the execution time is approximately 1.7 million times faster and the verification time over 50 times faster than a state-of-the-art cryptographic approach.

show abstract

Transparent SNARKs from DARK Compilers

Cited by 139 publications

References 36 publications

Compressed $$\varSigma $$-Protocol Theory and Practical Application to Plug & Play Secure Algorithmics

Compressed $$\varSigma $$-Protocol Theory and Practical Application to Plug & Play Secure Algorithmics

Privacy and Cryptocurrencies—A Systematic Literature Review

Practical Verifiable Computation by Using a Hardware-Based Correct Execution Environment

Contact Info

Product

Resources

About