ZK-SecreC: a Domain-Specific Language for Zero Knowledge Proofs

Abstract

We present ZK S C, a domain-specific language for zero-knowledge proofs. We present the rationale for its design, its syntax and semantics, and demonstrate its usefulness on the basis of a number of non-trivial examples. The design features a type system, where each piece of data is assigned both a confidentiality and an integrity type, which are not orthogonal to each other. We perform an empiric evaluation of the statements produced by its compiler in terms of their size. We also show the integration of the compiler with the implementation of a zero-knowledge proof technique, and evaluate the running time of both Prover and Verifier.

Formal Verification of Zero-Knowledge Circuits

“…For a top-level gadget P L that represents P in a zero-knowledge proof (see Section 1 and Section 2), whose formal semantics is a relation R P as above, the specification S P is derived from the high-level description P H of P. If P H is a program in a higher-level language [2,5,25,31,11,29], a function f P that denotes the execution of the program is formally defined, based on a formalization of the language, and a specification relation S P is derived from it as above. If P H is a description of a fixed application-specific computation (e.g.…”

“…R1CS circuits are normally constructed programmatically using libraries [3,4,6,27,28] that provide facilities to build gadgets hierarchically. These libraries are invoked directly, by programs written to build specific circuits, or indirectly, by compilers of higher-level languages to R1CS [2,5,25,31,11,29]. As these libraries are invoked, they generate growing sequences of the R1CS constraints that form the gadgets.…”