Hyperledger Foundation Hyperledger Global Forum 2021, 11 Jun 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Zero Knowledge Proofs: Getting Practical - Mike Lodder, Independent & Avradip Mandal

Description

Zero Knowledge Proofs: Getting Practical - Mike Lodder, Independent & Avradip Mandal, Fujitsu Labs of America

Zero knowledge proofs and related cryptographic primitives have been talked about more and more in the blockchain space in recent times. Techniques like NIZKs, SNARKs, STARKS, and other ZK tools have been put in to practice in more and more blockchain applications to help achieve privacy and confidentiality. But it's not always clear when and how it is appropriate to use them. In this talk, Avradip and Mike will explain the basics of zero knowledge proofs--how they work, how to use them, and what problems they can be used to solve--while keeping the underlying mathematical content at a limit that most people with a little background in computer security should be able to understand. They will also explain the concrete performance and impacts on efficiency of ZK tools using examples from Ursa. They aim to help developers know when to use ZK tools and then use them.

Session Details & Slides (if available)- https://sched.co/j3dH
Access All Sessions: https://events.linuxfoundation.org/hyperledger-global-forum/program/schedule/

----
Hyperledger – Open Source Blockchain Technologies

Hyperledger is an open source community focused on developing a suite of stable frameworks, tools and libraries for enterprise-grade blockchain deployments.
It serves as a neutral home for various distributed ledger frameworks including Hyperledger Besu, Fabric, Sawtooth, Indy, as well as tools like Hyperledger Avalon, Cactus and libraries like Hyperledger Aries, Ursa. Learn more about Hyperledger projects: https://www.hyperledger.org/use

Case Studies: https://www.hyperledger.org/learn/case-studies
Training & Certification: https://www.hyperledger.org/learn/training
Tutorials: https://www.hyperledger.org/use/tutorials
Webinars: https://www.hyperledger.org/learn/webinars
Events: https://www.hyperledger.org/events
Vendor Directory: https://www.hyperledger.org/use/vendor-directory

Subscribe to the Hyperledger Newsletter: https://www.hyperledger.org/newsletter

Follow-us on Twitter @Hyperledger

Learn about Hyperledger Membership: https://www.hyperledger.org/about/join

#Hyperledger #HyperledgerGlobalForum2021 #Blockchain

A

uh Thanks everybody for joining so in this talk, I'm going to talk about journalist, proofs and getting practical when they're getting practical nowadays so and over. So I am avradeep and over here with me. We have mike who is also present in the session.

A

So in this talk, we're we're going to cover the following. So we'll give a very high level introduction on what our journal knowledge, probes and we'll also see that that's a slight difference between proof of statement versus knowledge and the difference between interactive probes and non-interactive proofs. How and how they can interactive once can be converted to the non-interactive ones.

A

Then we will talk about different geo knowledge frameworks and their adaptations in practice such as snarks, bread, proof stocks, plonks etc, and, lastly, uh we'll say talk of the state of the current juvenile implementation in.

A

Hyperledger so.

B

This is a classic.

A

Example of journalist groups is alibaba, so we have the peggy who which who is the proofer and she wants to prove to victor. Who is the very fair that she knows a secret passphrase to open a magic door, but peggy doesn't want to reveal any information about the passphrase.

A

So here we have the cave so in the cave, so at first the peggy enters the cave. So in the cave it's like a the door is in the end and you can the you can reach the door either through a or through through path, a or through path b and initially the vector the verified victor is out, stands outside and peggy enters, and he and she randomly chooses one of the bars and once she reaches the door at that time.

A

The victor enters the entrance of the cave and from there she tells peggy to come back by taking one of the paths either a or b and he chooses it randomly and then, if peggy actually knows the the she can enter her past press, the door will open and then she can uh come back using a the party, and so peggy can also get get lucky.

A

That victor will say the path b and piggy was here, and she in that case she doesn't need to know the password and she can come back, but this protocol can be can be repeated many times and if peggy success succeeds at every iteration, then victor gets really convinced that piggy actually knows the posters and he, the victor, also doesn't really get to know the the passphrase, because he cannot hear what he is saying.

A

So the previous protocol was non-interactive protocols actually, but in the real-life scenario, the if you can have a non-non-interactive journalist proof that is much more helpful in case of non-interactive proofs. There is no need of interaction between the prover and the verifier.

A

The approver computes the proof and sends the proof to verified and verified then verifies the proof and convinces itself about approver's claim and any internet interactive knowledge protocol can can be made non-interactive using fair, shamanic heuristic that actually uses a hash function as a random oracle and what it essentially does is whenever the prover sorry, the verifier sends some random challenge.

A

The uh prover can actually simulate those challenges using the random oracle.

A

So now we have a little bit more math mathematical, formal definition of zero knowledge. So here suppose the error is an np language.

A

That means for if there is any x in lr, then that there exists some witness w such that x. W belongs to the input relation r.

A

So the if you recall the property of np is given the language element x and the witness w. It is easy to verify whether the x w actually belongs to the relation.

A

However, if if it is, if some, if you are given only the only x, then finding the witness becomes very difficult.

A

And in this case, we want to the proverb wants to prove that the statement x is actually actually belongs to the language, and he knows the he or she knows the witness w and using this witness w, he can create the proof of pi x and using the proof, pi s. The failure can convince itself that x actually belongs to the language l, but the zero knowledge property guarantees that this pi doesn't leak any information about w and to implement these zero knowledge protocols.

A

We in many cases we also have a common reference string crs, which are generated by some trusted entity.

A

And there is also so this is the regular general, and there is also proof of knowledge that is important in many applications and in case of proof of knowledge that verifies convinces. It says that not only that x belongs to the relation that prover also knows the witness w and again as usual, the effect does not get any information about w.

A

Now um the zero knowledge protocols uh where the existing observer of the in or earth for all relations were invented long time back in uh early in the 90s.

A

However, the they become practical recently with the advent of zika snacks.

A

So the zika snacks are journalists, hashington movement of the knowledge, and they are based on strong number theory, cryptographic assumptions which are non-falsifiable, and this is actually the first practical journalism framework that can handle pretty much any arbitrary computation.

A

However, as you can see, on the left hand follow chart, uh writing is now developing is exactly framework is not easy. It has. It goes through many steps. So the first step you have the computation circuit, the actual computation uh you want to perform and from that you need to create an algebraic circuit and that becomes that gets converted to r1cs, which is rank one constant system.

A

And after that you have that get converted to qap, which are called quadratic, arithmetic programs, and then you have linear pcps or probabilistically proofs, and that becomes linear, interactive proofs and then finally, you can have the non-interactive zika snark, but we have the zika framework that can handle almost everything for the end user.

A

We don't need to know all the details.

A

So leave snark is the presented that the defect to zika snack library- it is written in c plus, plus c, plus plus, and it is actually probably the most feature- complete journalist library available and it supports many formats such as r1cs, bscs, uscs, tbcs, etc.

A

And you can also write arbitrary c code and that can be compiled to tinyrm format, which is supported by libsnart, and it also helps the gadget libraries that helps building r1cs circuits and because there are also choice of different elliptic curves and um it implements the original jigsaw paper, as well as the newer broadcasting paper, which is slightly faster but requires stronger, stronger generic group assumptions.

A

We also have the other zika snack libraries such as bellman, which is a popular zika, snake implementation in dust and it's supposed block system, and this is actually getting used in z, cash and then there are um zoho so so zokradz is.

A

This is zika snacks toolbox on ethereum blockchain and it has a it kind of gives a high level non-turin complete language that simplifies the circuit specifications, because if you are go in if you're, using bellman or uh leave smart, you pretty much have to deal with the r1cs circuits and this library is also written in rust and it supports bill and bellman and leaves narcan as the back end, and there is also narc, which is a first first zikr snark library written in go.

A

This also offers some very high level apis and there are also others just not snarky, etc.

A

So before going into various fin, the other frameworks- just this slide- explains how the journalists frameworks works at a high level. So they usually have two components. One is front end and there is another backend, so they are kind of the separate parts of the framework.

A

So the front end takes a high level statement and it also takes a high level weakness and then.

A

And the syntax of these things depends on the actual funded framework and they also can use the gadgets to help to help the end user to specify the statements and then, in the back end it takes very specific type of formats, either r1cs or arithmetic circuit or boolean circuits, and this backhand text takes this low level statement at witnesses and this actually has the actual core crypto and they generate the proof and then in in the verifier.

A

It again takes the low level statements and will avail the statements as well as the proof it doesn't take. No witness the witness is the private that is used, and then it verifies the proof.

A

So we won't. I don't go into the details on what exactly is rank one constant system, but essentially there are some uh they can be specified by some mattresses and some it is just ensure their existing weaknesses that this condition holds and the robot. What is important about the r1cs? This is a uh np np, complete language, so anything in almost anything that you're interested in doing can be represented in this r1cs format.

A

Now, in terms of the application, so zcash is the, I guess the most often know about what is z cash. This is the similar to bitcoin. Cryptocurrency is similar to bitcoin, but it enhances the privacy guarantees and essentially it ensures that the wallet address can be shielded if the user user wants and only visibility would be the transaction timestamp.

A

However, there are heuristic attacks because of small number of transactions, but in this stock we don't we won't. We won't go into the into that, but uh what's important that it has option of selected disclosures for our voting purposes and previous version of z. Cash used leave stock and then I think from 2018 they moved to bellman and down and which supports the gross 16 proofing systems and implementation.

A

Trust, and one thing that is uh kind of a drawback of snarks is that that they require a trusted parameter generation at the setup phase and to achieve the distributed. Trust the zika, the public parameters with npcc.

B

A

Mostly exactly.

B

Right, not all snarks require tests and subs, but a lot of them do yes, exactly.

A

And uh uh I mean not all zoonos framework.

A

This requires this to this trusted setup, but the leaves not like the snap so that there are the other frameworks that don't that do not such as bulletproof and stocks.

A

But zcash is using this snarks and from bellman, and it requires the trusted setup and to achieve this trusted setup.

A

They are doing this mpcs ceremonies and it guarantee that as long as one of the participant is honest, the generated parameters can be trusted and the first set of parameters were generated in 2016, and then they moved to growth, 16 and and used bellman, and that required in a new set of parameters and those parameters were generated in 2018 and both of them. When both the cases they were performed through elaborate implicit ceremonies and the next, the second one for the first one, it was kind of restrictive because all the participants needed to be online.

A

At the same time, however, for the second one it it was a more advanced protocol where anybody can join and leave the ceremony from whenever they want, and it can be done in a sequential manner.

B

A

Yes, exactly mpc is tough, and but on the other hand, so one advantage for them was even though regular is not. They require new. So like a as a setup, whenever you want to prove you want a new statement, but for z cash, what they did, they included something called a universal circuit.

A

So for that, so what the advantage was that then, once they are doing it, they can do it only once, and then that would be good enough for a long time unless they are changing the protocol.

A

However, we have now, we have a new advanced proof system, called bullet proof and advantage the main advantage. The saving point of this one is, it doesn't require the trusted setup and also the security is based on more standard, restrict the discrete log based assumption, as opposed to very fancy assumption that is disrespectful, snark and for range proofs, which are required required for variety of conditions, confidential transactions.

A

They are actually super efficient and both in terms of proof, size and the verification. Time, however, for arbitrary circuit, the verification time is high, and but the proof size is still remains relatively small and the advantage is the setup is trusted and the cpu depends on the standard assumption and the direct. The direct cryptography maintains a bulletproof library that is implemented in pure rest, and actually we also have a blueproof implementation in hyperled ursa. At present,.

A

And monero is the first cryptocurrency that adapted the bulletproof. It is a private digital currency where transactions are confidential and untraceable, it uses one-time addresses and existing signatures signatures and dream confidential transactions, and with group adaptation, monero reported 80 percent reduction in the transaction fees. This was due to the reduction in the proof size, as well as the verification time and monitor. Source course includes the implementation from scratch and c plus plus for reading configuration of transaction.

B

B

Because it was so practical right.

A

Yeah, I mean blue proof search, I mean it was a huge improvement, even though this was a bit experimental when I think they started implementing it, but I think they just went ahead because of the thing the paper was well received as well as theirs. They were seeing huge improvement.

B

Yeah, so we got 10 minutes left.

A

Okay, maybe I should go quickly for the rest, so, and maybe I should try to finish with by five five more minutes, and then we have five minutes for questions so there also.

A

So one of the different disadvantage of the uh snark was the this, the setup equal to the trusted setup and and that now we have the plonks which are kind of uh improvements over snots, where the setup is universal and updatable, and it also relies on very much easier.

A

Crypto assumptions called uh get commitments.

A

And then you also have zika stark and they are kind of a they are not which have the complete transfer setup so similar to.

A

Bullet proofs and yeah it is, it has a clip struck as the current surplus percent implementation, and there is also a language called cairo for that produces the production get great stocks, uh so why they are important. We will see shortly because they are getting used in the ethereum zika rollups.

A

So these zika rollups are the solution that perform transaction execution outside the main ethereum chain.

A

But then they post the transaction data on layer, one so actual chain, essentially that they prove they post. The the journal is proof that everything is fine and currently there are multiple implementation of zika rollups and they are using different. This advanced script protector, the crypto frameworks, so one of them is looping. This is knock based and you it uses, uh leave snark as back end and it's not as front end, and then we have the start net by star quad.

A

This is this is based on stocks that we just talked about and it uses cairo. This is a as as a result. This is completely permissionless.

A

So the one thing that you might think that why you cannot use bullet group over here. That is because, in case of bulletproof, the the bulletproofs are really efficient for range proofs, but for so they are uh fine when you are just doing pure just transactions, but in case of ethereum we are kind of going to prove something more.

A

We have to run the smart contracts and we have we kind of need a more future complete language, so for that blood troops are not so good because of the large verification times and that's where the stocks come into play.

A

And then we have the zika sync this that uses the plonks, not so the, and this doesn't require the app specific trusted setup and and they are similar to smart. So that's why this is faster verification than starts, and there there is also aztec 2.0.

A

This uses more advanced plonks and then there is hermes and zika tubes. They are also based on zika, snacks and plums.

A

Now, coming to hyperledger hyperledger, so we have the zika zika proof so in the india, as well as hyper fabric, and they are using ide mix. So I id mx is a crypto cryptographic protocol that provides strong authentication as well as diameter and unlinkability.

A

However, this doesn't actually use the general purpose uh framework. It uses specialized signature schemes and, as a result, they are very efficient and they are, you can implement it from the very standard assumptions and so indi also uses the animation credential, which require proving the knowledge of signatures similar to idmx and woodside is a raspberry, shared crypto library.

A

It currently supports signature groups of knowledge, the bullet proofs range groups and state membership by cryptographic, accumulators and the wood subreddit group implementation is a bit different than the the direct one which is uh which was not supporting the pairing fairly.

A

Friendly cards and there is, in addition, the hyperlink fabric also supports the generic acid transfer, and this is also. This also doesn't require the general purpose framework and can be built using the knowledge of signature schemes.

A

And in conclusion, so juneau proofs have come a long way since the inception in 1985.

A

There are multiple uh practical journalist frameworks that support general purpose and relations, and these new protocols based on fancy crypto, are seeing rapid adaptation to practice because of their application to blockchain, and there are also gkp schemes used in practice that are using standard assumptions.

A

I think, with that I will go to.

B

Practical and applied is not just in block gains, although that's where they're heavily used right now, it's with anything you want kind of like custom circus that you want to create. Basically, I want to be able to prove something to you without dealing with the inputs were just.

B

I want to be able to prove a statement is valid and that's starting to become more and more practical practical in these cases, so you can see, there's a whole bunch of different schemes that you can pick to do that and we're just showing you the ones that are the most practical today.

B

I mean yeah yeah.

A

So I think that jason over here has some interesting questions right.

B

Like just like just that,.

A

Visual, so one of you, I think he is asking about the implementation question. So how do you transform a general general question to the to z, language that we have all the input, variables and functions we're running yeah? So I think for that.

A

So one option is using this feature complete it's almost during copyright. Complete is zero knowledge languages and, in fact, if you want to use the leave snark, I think you can write your program in c c and it will compile the c program to a tiny ramp format that is supported by the lift snark.

A

But if you know more ab about the program, it is always better if you can write it in a more high level, language that is supported by the framework.

B

Yeah I mean um I was thinking. Let me just share my screen.

A

B

um So I just wanted to reiterate one thing so as I'm doing this uh jason's question about why he.

A

B

Trying to break things down into what you're actually trying to do so with the thing to keep in mind with snarks or any of these base languages is you have what are called private inputs and public inputs? Public inputs are basically known to all parties usually, and the private inputs are only known to the prover, so I like to break it down into that form. Okay, what does only the approver know?

B

What does everybody else know and then what is the exact statement, we're trying to prove and kind of make it true or false statements once we can get it to that point, then we can kind of compose a circuit and what you call, I guess, encode and verify, um but that that's how I start breaking it down.

B

I don't know if that helps, but that's how I think of it.

B

Let's see dan has a question on the way back, it says: does indy with cl signatures, use ursa to implement range proofs, predicate proofs? Yes, so because cl signatures are rsa based, they don't have to use any bulletproofs or any of these snarks.

B

But the downside is the the range proofs are large, like four kilobytes, so they're quite large and they're expensive, compared to say bulletproofs, so which library would was appropriate when we introduced range proofs to bbs, plus, I would say bulletproofs.

B

I know there's some research um right now by the inventors of bulletproofs that if you are going to use pairings, there might be ways to also make bulletproofs even more efficient during verification by the use of pairings.

B

So that's what I would recommend.

B

Snarks and starks are more for kind of general purpose statements, but if we just want range proofs, bulletproofs were designed just for that purpose.

B

See, that's all the questions I can see.

B

Here's one by rob, robert everdeep, if you want to answer what about a monero style voting system which the coins are issued by a governing body to a wallet and then the vote coin can be spent into a candidate wallet without revealing the citizen identity.

B

I'm not sure if that would work, because the thing is voting as far as I understand it has different rules about based on countries like at least in the united states.

B

um You don't get to know who casts the vote, but you also have to make sure that if I vote that um they know it was me that voted, but they don't know who I voted for and that I can't double spend. So I guess that's why a lot of people.

A

Some properties would hold that you would want in a secure voting system, but I think there are some fundamental difference between voting and what do you want in the transactions? There is some similarity and you can achieve those things, but, for example, we want.

A

Probably the there should be if somebody outside other than the like, the general public should be able to see that as a overall. The aggregate voting is fine. There should be zero proof of that one.

A

So I guess for that we need to go to actual electric electric.

B