►
From YouTube: Practical Zero-Knowledge Proof Concepts on Hyperledger Fabric - Dr. Tan Apaydın, T2 Software
Description
Privacy based blockchains are becoming more popular and they are mostly proposed for public blockchains. On the other hand, privacy and zero knowledge is also required for private blockchains. These are some of the use cases;
Asset and value exchange between financial institutions
Government backed asset coins
Creating a separate channel for any two peers is not always a good solution, because real-time and self-auditing becomes a big issue then.
Currently, the algorithms proposed on zero-knowledge blockchain networks are very complicated and they are impractical to use on Hyperledger implementations. As opposed to this, we figured out some practical zero-knowledge algorithms that are simpler and practical to use on Hyperledger and they solve many problems of corporates and government.
In this workshop, we want to show samples and discuss further about practical implementations of zero knowledge proof on Hyperledger.
----
Hyperledger – Open Source Blockchain Technologies
Hyperledger is an open source community focused on developing a suite of stable frameworks, tools and libraries for enterprise-grade blockchain deployments.
It serves as a neutral home for various distributed ledger frameworks including Hyperledger Besu, Fabric, Sawtooth, Indy, as well as tools like Hyperledger Avalon, Cactus and libraries like Hyperledger Aries, Ursa. Learn more about Hyperledger projects: https://www.hyperledger.org/use
Case Studies: https://www.hyperledger.org/learn/case-studies
Training & Certification: https://www.hyperledger.org/learn/training
Tutorials: https://www.hyperledger.org/use/tutorials
Webinars: https://www.hyperledger.org/learn/webinars
Events: https://www.hyperledger.org/events
Vendor Directory: https://www.hyperledger.org/use/vendor-directory
Subscribe to the Hyperledger Newsletter: https://www.hyperledger.org/newsletter
Follow-us on Twitter @Hyperledger
Learn about Hyperledger Membership: https://www.hyperledger.org/about/join
#Hyperledger #HyperledgerGlobalForum2018 #Blockchain
A
A
So
I'll
start
with
the
simple
transaction
right
here:
Alice
wants
to
set,
send
X
assets
to
Bob
right.
We
all
know
this
right.
This
is
the
simple
transaction
in
hyper
laser
or
blockchain.
But
but
the
thing
is
people
want
to
check
if
the
transaction
is
valid
right,
they
want
to
verify
if
this
is
valid
first
to
do
that,
they
need
to
know
the
amount
the
current
amount
Alice
has
and
also
they
want
to
know
the
the
transfer
amount
on
a
little
bit
more
complex
transaction.
A
A
It's
still
similar
right
here.
We
have
any
inequality
here,
so
we
want
to
make
sure
that
the
sum
of
the
assets
he
currently
has
is
greater
than
or
equal
to
the
total
amount
that
she
wants
to
send
out
right.
But
the
thing
is
here:
we
want
to
hide
these
values.
We
don't
want
to
reveal
the
exact
values
of
a1,
a2,
x1,
x2,
etc.
We
just
want
to
make
sure
that
this
inequality
holds.
We
don't
want
to
give
out
any
more
information
than
that.
A
A
In
this
presentation
we
are
not
actually
interested
in
the
privacy
of
the
participants.
I
think
I
polisher
has
this
identity
feature
right
now
for
that,
but
rather
we
are
bit
confidential.
We
were
interested
in
hiding
the
values
in
the
transaction
data
right,
the
amount
of
transfer,
the
amount
of
assets,
people
have
the
fees
and
the
prices
and
etc,
and
this
feature
is
now
called
zero
knowledge
asset
transfer
in
hyper
ledger,
but
the
mathematics
behind
that
is
really
complex
and
I
think
performance
wise.
It's
pretty
hard
to
grasp.
A
To
get
into
zero
knowledge
proof
suppose
that
Alice
wants
to
prove
to
Bob
that
she
knows
X
and
she
doesn't
want
to
reveal
the
value
of
x
to
Bob.
So
such
a
proof
needs
to
have
three
properties
right
first
completeness,
which
means
that
if
the
proof
is
valid,
but
will
become
least
at
the
end-
and
we
are
assuming
his
earnest
right
and
soundness
if
Alex
doesn't
know
X,
she
cannot
cheat
and
for
zero
knowledge.
If
Alice
Nozick's
Bob
doesn't
learn
no
more
than
the
information
that
Alice
knows.
X.
A
Here
is
a
widely
used
example
to
explain
zero
knowledge
proof
so
suppose.
Alice
has
two
balls
with
different
colors,
and
just
so
it
happens.
Bob
is
colorblind
and
suspicious
about
if
the
balls
have
really
different
colors,
so
they
play
a
game
to
convince
Bob
right.
First
Alice
chooses
a
ball
with
and
without
revealing
its
color
to
Bob.
We
say
she
commits
to
that
ball
right
and
then
they
repeat
the
following
steps:
Bob
takes
the
balls
and
then
without
showing
them
to
Alice.
A
He
switches
them
with
one
over
two
probability,
and
then
he
presents
them
to
back
to
Alice
and
Alice
picks
the
ball
she
committed
to
before.
So
what
happens
now
in
this
simple
game?
If
else
fails,
the
game
immediately
stops.
Otherwise
we
keep
playing,
we
keep
going
and
then,
if,
after
some
iterations,
if
Bob
is
convinced,
he
stops
the
game
in
this
case,
suppose
that
the
balls
are
identical
right.
If
Alice
wants
to
cheat,
she
can
do
that.
You
can
succeed
in
with
one
or
two
probability
in
a
single
iteration
right.
A
However,
if
we
increase
the
number
of
iterations
like
for
after
30
iterations,
that
probability
goes
to
a
very,
very
small
number,
so
it's
really
really
hard
to
cheat
after
some
some
iterations
and
this
simple
game
also
satisfies
all
those
properties
like
completeness
soundness
and
zero
knowledge.
However,
the
problem
with
this
game
is
it's
kind
of
interactive
right.
Both
Alice
and
Bob
needs
to
take
actions
at
each
step,
and
such
such
a
solution
might
not
be
always
feasible
for
real-life
scenarios
right
and
we
want
to
make
this
non
interactive
in
some
sort
of
sort
of
way.
A
So
let
me
try
to
define
a
commitment.
We
all
know
this
right,
you're
working
on
block
chains
and
we
used
hash
functions
before
right
and
this
is
taken
from
Wikipedia.
So
in
an
ideal
hash
function,
we
have
two
very
important
properties
here.
First,
it
is
preimage
resistance.
That
means
it's
kind
of
computationally
infeasible
to
generate
an
input
given
the
output.
That
means
the
function
only
goes
one
way
from
inputs
out,
but
you
cannot
guess
the
input
and
its
collision
resistant.
That
means
no
true
values
can't
map
to
the
same
output.
A
So,
given
these
properties,
let's
say
Alice
uses
a
hash
function
and
using
her
data,
she
produces
this
output
right.
This
huge
string
here
since
function
is
collision
resistant.
This
commitment,
computationally,
binds
Alice
to
x,
so
alice,
cannot
use
something
else
for
that
output
right.
She
only
you
can
use
the
X.
A
So
given
hash
based
commitments,
this
is
this
is
good
that
the
commitment
binds
the
prover
to
the
information
and
also
it
hides
it
from
the
verifiers
right.
However,
what
we
wanna
do
is
we
wanna
kind
of
arithmetical
combine
our
calculations
and
hash
functions
doesn't
allow
that,
so
you
cannot
add
or
some
you
cannot
add,
or
multiply
the
output
of
an
X
function
right
and
to
rescue
we
use
homomorphism.
A
So
here
you
can
see
two
boxes
right
and
they
represent
two
commitments
and
we
can
use.
We
can
use
them
to
compute
the
commitments
on
a
value
that
is
obtained
by
only
adding
or
multiplying
the
original
values.
So
in
that
sense
we
don't
want
to
use
these
green
and
red
circles.
We
only
have
these
sounds
seven
and
twelve
right.
We
want
only
only
one
to
use
them,
not
the
individual
values
itself.
A
So
here
is
the
key
point.
You
can
see
a
simple
homomorphic
commitment
here.
We
use
a
function.
C
of
X
right
see
here
represents
systems
for
the
commitment,
so
we
use
a
power
function
instead
of
using
X.
We
use
G
to
the
power
of
X
and
we
take
the
mod
P
and
T
is
a
very
large
prime
number
here,
like
thousands
of
bits
and
using
that
function,
it
is
obvious
that
we
can
apply
the
following
rule
c
of
x,
multiplied
by
c
of
y
equals
e
of
X
plus
y.
A
Is
the
power
function
right,
and
this
is
a
key
point-
we're
going
to
be
applying
such
a
commitment?
However,
computational
highs
the
secret
information,
because
when
you
use
the
logarithm
problem,
it's
kind
of
interactable
to
go
from
the
output
off
function
back
to
the
input
right.
However,
let's
say
in
some
near
future:
we
have
these
nanotechnology
coming
up
right
and,
let's
say
a
computational
supreme
adversity
can
in
practice,
can
still
obtain
X
right.
A
So
we
need
to
do
a
little
bit
more
to
make
that
function
a
little
bit
more
complex
so
that
it's
hard
to
figure
out
the
value
of
x.
So
for
that
we
use
Pederson
commitment,
so
we
introduce
another
term
here,
H
to
the
power
of
r
and
where
H
is
a
number
unrelated
to
G
here,
and
we
can
still
hold
that
property
right.
Ppc,
fitters
and
commitments
of
X
x,
pc
y,
is
still
equal
to
PC
of
X
plus
y,
and
we
call
this
additive
normal
morphic.
A
So
the
good
news
is,
it
statically
hides
the
secret
X
right
and
how
does
that
do
that?
Even
if
we
guess
the
values
here,
like
G,
H
and
P
for
every
given
X,
we
have
a
matching
pair
of
our
right,
so
X
and
our
pairs
are
not
unique
in
that
sense,
so
it's
very
very
hard
computation
hard
to
guess
the
exact
value
of
x,
so
using
peterson
commitments.
You
know
they
form
the
basis
of
confidential
transactions
on
a
number
of
existing
layer
technologies,
and
I
want
to
introduce
a
couple
of
use
cases
here.
A
There
is
a
customer
of
the
issuer
Bank
and
let's
say
he
wants
to
go
shopping
and
once
to
pay,
you
must
pay
his
belongs
with
the
purest
machines
of
the
acquire
Bank,
his
own
bank,
but
the
other
bank,
and
what
happens
is
at
the
end
of
the
day,
both
banks
report
to
the
exchange
center
and
exchange
hundred
spent
some
time
doing
his
job,
calculating
what
needs
to
be,
and
only
the
second
day
the
bank's
pay,
each
other
right
kind
of
the
reconciliation.
So
it's
not
real
time.
A
So
what
can
we
do
so
using
blockchain?
This
is
simple
approach,
right,
I.
Think
most
of
us
are
familiar
with
this.
If
the
banks
represent
the
note
on
the
blockchain
topology
here
we
can
do
this
in
real
time,
but
the
problem
is,
data
is
transparent
right,
we
didn't
encrypt
it,
so
everyone
can
see
all
the
transactions
happening
between
the
banks.
What
can
we
do?
We
can
use
these
private
channels
right.
Hyper
ledger.
Has
these
proteins?
Maybe
these
two
banks
have
a
private
deal
in
between
and
they
don't
want
to
share
their
prices
to
other
banks.
A
One
solution
could
be
to
use
an
exchange
Center
within
those
private
channels
and
then
let
them
do
the
work
for
us.
But
after
some
time
we
have
a
lot
of
private
channels
and
each
Pro
channel
has
an
exchange
center
right.
This
becomes
infeasible
and
since
we
are
using
blockchain
technology,
we
want
to
get
rid
of
the
central
exchange
center
right
in
the
first
place.
So
here
comes
our
solution.
A
So
up
until
now,
our
examples
were
only
using
additions
or
multiplications,
and
the
traditional
cryptography
was
enough
for
us,
but
for
some
other
complex
cases
we
need
full
homo.
We
need
full
homo,
perfect
schemes.
What
do
we
mean
by
that?
So
here's
a
simple
example:
let's
say
Alice
has
some
data
private
data
and
she
wants
to
make
profit
using
that
data,
but
she
doesn't
want
to
reveal
that
data
to
third
parties
right.
She
wants
them
to
use
it,
but
she
doesn't
wanna
reveal
it.
A
So
what
happens
is
Bob
sends
a
function
to
Alice
and
then
Alice
runs
that
function
on
her
own
data
and
then
Bob
wants
to
make
sure
that
she
actually
did
what
she
was
supposed
to
do
right.
She
needs
some
confirmation
right
and
then
Alice
also
sends
the
Zeke
a
proof
of
her
data,
so
that
Bob
can
make
sure
that
he
actually
ran
the
function
on
her
own
data.
A
Dr.
Commer
is
currently
working
on
a
problem.
Actually,
this
is
a
real
real
research
going
on.
So
it's
a
similar
problem
like
Alice,
allows
Bob
to
use
her
genome
sequence
without
revealing
it
to
anyone
right.
She
has
the
genome
sequence
data.
She
wants
to
open
that
to
research,
but
she
doesn't
want
to
actually
reveal
it.
So
from
Alice
perspective,
she
wants
confidentiality
right.
She
wants
to
be
the
sole
custody
over
Jeannette
genetic
data
and
communicate
with
Bob.
She
doesn't
want
to
deal
with
third
parties.
A
She
wants
to
communicate
with
him
directly
and
she
wants
to
make
some
profit
right.
She
wants
to
gain
some
beneficial
benefits
from
her
data
and
from
the
Bob's
perspective,
sure
he
also
wants
to
communicate
with
Alice
directly
right.
He
also
doesn't
want
to
deal
with
third
parties
and
he
also
needs
her
results
verified
by
else.
A
So,
in
our
real
case,
we
encoded
the
paternity
testing
and
genomic
business
computation
with
arithmetic
operations
on
polynomials,
since
we
are
using
polynomials.
Let's
assume
that
we
mapped
the
sequence
data
to
polynomials
right
and
polynomials
have
these
metric
operations
of
both
multiplications
and
additions
at
the
same
time.
So
that's
where
we
needed
the
full
homomorphism
scheme
and
we
are
currently
working
with
hyper
ledger
to
integrate
our
solution.
A
Actually
I
was
supposed
to
stop
here,
but
since
we
have
more
time,
I
can
go
over
one
more
use
case
here.
So
let's
say
we
apply
this
letter
of
credit
use
case.
We
have
two
banks.
Here
we
have
one
importer,
one
exporter,
two
banks
and
one
reimbursement
bank
right.
The
importer
wants
to
the
importer
first
communicates
his
bank
sends
the
money
to
the
confirming
bank
and
the
confirmed
bank
does
some
paperwork
and
then,
at
the
end,
exporter
yet
sends
the
money
to
the
importer
right
and
then
the
reimbursement
bank
is
the
central
authority
here.
A
A
A
A
So
what
happens
in
a
simple
scenario?
Is
opening
bank
ish
just
sends
12
million
of
its
own
letter
of
credit,
the
ABC
here
right
and
then
the
cent
and
Santander
bank
gets
those
12
million.
But
let's
say
these:
these
banks
are
small.
This
Bank
is
very
small
and
some
time
that
doesn't
trust
them
right,
so
they
need
a
coin
of
a
big
bigger
bag
like
Bank
of
America.
A
So
as
a
business
model
here,
every
letter
of
credit
is
credible
as
its
own
bank
right
I
mean
the
bigger
the
bank
or
the
trustable.
Bank
is
the
trust
abuse
coil
will
be
and
they
are
transferable
transferable
between
banks
and
every
payment
is
made
using
the
cost
answers,
and
here
we
can
still
apply
the
zero
knowledge
proof.