Cornell Format

Date:

Reviewed:

Topic / Chapter:

Notes

Date:

Reviewed:

Topic / Chapter:

❓Questions

Notes

• Introduction to Modern SNARKs
  • SNARKs
    • SNARK: a succinct proof that a certain statement is true
      • i.e. “short” and “fast” to verify
      • e.g. solution itself: might not be short nor fast to verify
    • zk-SNARK: revealing nothing about $m$
    • potentially: a single reliable PC can monitor supercomputers’ operation
      • or: slow computer monitoring GPUs
      • slow computer: like layer-1s
  • Blockchain applications 1
    • outsourcing computation (not zk)
      • L1: quickly verifies work of off-chain service
    • e.g. scalability: proof-based rollups (zkRollup)
      • off-chain service processes a batch of Tx
      • L1 chain: verifies a succinct proof of correct processing
    • e.g. bridging blockchains: Po-Consensus (zkBridge)
      • enables transfer of assets from one chain to another
      • proving to target chain that asset was locked in source chain
  • Blockchain applications 2
    • (requiring zk)
    • private Tx on a public blockchain
      • zk proof that a private Tx is valid
    • compliance
      • proof that a private Tx is compliant w/ banking laws
      • proof that an exchange is solvent in zk
    • also: non-blockchain applications exist
      • e.g. fighting disinformation: C2PA
      • camera: w/ embedded secret key
        • and signs picture w/ location & timestamp
        • metadata: can be confirmed
      • problem: image post-processing
        • disable further C2PA verification
      • zk-SNARK solution
        • laptop: w/ (Photo, Ops)
        • $\pi$: proves that “I know a pair (Orig, Sig) s.t.”
          • Sig a valid C2PA signature on Orig
          • Photo is result of applying Ops to Orig
          • metadata(Photo)==metadata(Orig)
        • laptop verifies $\pi$ and shows metadata
        • size: ≤ 1 KB, takes ≤ 10 ms in browser
          • proof generation: takes a few minutes w/ sufficient HW
            • parallelizable
        • proof: must be not interactable
• What is SNARK
  • Arithmetic circuits
    • computation model: must be fixed to build SNARK
    • let $\mathbf{F}=\{0,\dots ,p-1\}$ for $p>2$
      • finite field
      • closed w/ addition & multiplication
    • arithmetic circuits
      • $C:F^n\to F$ (n input w/ 1 output)
      • directed acyclic graph, where
        • internal nodes: $+,-,\times$
        • inputs: $1,x_1,\dots ,x_n$
      • defines: n-variate polynomial w/ evaluation recipe
      • $|C|$: no. of gates in $C$
    • interesting cases
      • $C_{sha}(h,m)$: $(SHA256(m)==h)?0:1$
      • $C_{hSHA}(h,m)=(h-SHA256(m))$
        • $|C_{SHA}|\approx 20K$ gates (”small”)
      • $C_{sig}(pk,m,\sigma )$: output 0 if $\sigma$ a valid ECDSA sig of $m,pk$
    • structured vs. unstructured circuits

      • unstructured: w/ arbitrary wires

      • structured: build in layers, one circuit being repeated

        

        • layer: aka VM
  • NARK: Non-interactive ARgument of Knowledge
    • applied arithmetic circuit
      • $C(x,w)\to \mathbf{F}$
        • $x$: oublic statement in ${\mathbf{F}}^n$
        • $w$: secret witness in ${\mathbf{F}}^m$
      • preprocessing: $S(C)\to$ public params ($pp,vp$)
        • public param for prover / verifier
    • prover: $pp,x,w$
      • generate proof $\pi$ that $C(x,w)=0$
    • verifier: $vp,x$
    • preprocessing NARK: triple $(S,P,V)$
      • $S(C)$: description of circuit $C$
      • $P(pp,x,w)\to \pi$
      • $V(vp,x,\pi )$: accept / reject
      • all alg. and adversary: w/ access to random oracle
    • informal requirements
      • complete: $\forall x,w,:C(x,w)$⇒ $Pr[V(vp,x,P(pp,x,w))=1]=1$
        • i.e. always accept if valid
      • or: “knowledge sound”
        • if $V$ accepts ⇒ $P$ “knows” $w$ s.t. $C(x,w)=0$
        • and extractor $E$ can extract a valid $w$
      • optional: ZK: $(C,pp,vp,x,\pi )$ reveals “nothing new” about $w$
    • trivial NARK: $\pi =w$
  • SNARK
    • succinct preprocessing NARK
    • same for $S(C)$
    • $P(pp,x,w)$: short $\pi$
      • len($\pi$) = sublinear($|w|$)
    • $V(vp,x,\pi )$: fast to verify
      • time(V)= $O_{\lambda}(|x|$, sublinear($|C|$))
    • i.e. anything better than NARK: technically SNARK
    • however, strongly succinct NARK is:
      • len($\pi$) = $O_{\lambda}(\log |C|)$
      • time(V)= $O_{\lambda}(|x|,\log(|C|))$
        • i.e. no time to even read circuit $C$
        • thus: preprocessing needed
          • $vp$: summary of $C$
    • most SNARKs to be discussed: in constant time
    • trivial SNARK: not SNARK
      • long proof
      • $C(x,w)$ might be hard (and slow)
      • $w$: might be secret
  • Preprocessing (setup)

    • $S(C;r)\to (pp,vp)$

    • setup types

      • trusted setup per circuit
        • run fresh for each circuit
        • and $r$ must be kept secret
          • if $r$ is learned: false statements can be proven
          • generator: destroyed after task
      • trusted but universal (updatable) setup
        • secret $r$: independent of $C$
        • $S=(S_{init},S_{index})$
        • $S_{init}(\lambda ;r)\to gp$ (global param)
          • one-time setup, secret $r$
        • $S_{index}(gp,C)\to (pp,vp)$
          • deterministic
          • can be repeated
      • transparent setup
        • $S(C)$: doesn’t use secret data

    • significant progress

      	size of $\pi$	verifier time	setup	post-quantum
      Groth’16	$\approx$ 200 Bytes	$\approx$ 1.5 ms	trusted per circuit	no
      Plonk / Marlin	$\approx$ 400 Bytes	$\approx$ 3 ms	universal trusted setup	no
      Bulletproofs	$O_{\lambda }(\log \Vert C\Vert )$ $\approx$ 1.5 KB	$O_{\lambda }(\Vert C\Vert )$ $\approx$ 3 sec	transparent	no
      STARK	$O_{\lambda }({\log }^2\Vert C\Vert )$ $\approx$ 100 KB	$O_{\lambda }({\log }^2\Vert C\Vert )$$\approx$ 10 ms	transparent	yes

      • prover time: almost $O_{\lambda }(\Vert C\Vert )$
  • Knowledge
    • if $V$ accepts ⇒ $P$ knows $w$ s.t. $C(x,w)=0$
    • if $P$ knows $w$: we can “torture” $P$ to get $w$
    • formal knowledge
      • $(S,P,V)$ is knowledge sound for $C$ if
      • $\forall$ eff. adversary $A=(A_0,A_1)$ s.t.
      • $gp\leftarrow S_{init}()$, $(C,x,st)\leftarrow A_0(gp)$
      • $(pp,vp)\leftarrow S_{index}(C)$
      • $\pi \leftarrow A_1(pp,x,st)$
      • $Pr[V(vp,x,\pi )=1]>1/10^6$
        • i.e. non-negl
      • then $\exists$ eff. extractor $E$ s.t.
        • $gp\leftarrow S_{init}()$
        • $(C,x,st)\leftarrow A_0(gp)$
        • $w\leftarrow E(gp,C,x)$
        • $Pr[C(x,w)=0]>1/10^6-\epsilon$
    • i.e. if there is an efficient prover, then we can extract the knowledge
• Building an eff. SNARK
  • Building SNARK
    • general paradigm: two steps
      • a functional commitment scheme
        • cryptographic obj
      • a compatible interactive oracle proof (IOP)
        • info. theoretic obj
      • result: SNARK for general circuits
    • commitments scheme
      • made of commit & verify
      • must satisfy: binding & hiding property
    • standard commitment
      • $H:M\times R\to T$
      • $commit(m,r)$: com:=H(m,r)
      • $verify(m,com,r)$: accepts if com=H(m,r)
  • Functional commitment scheme
    • given a family of functions $F=\{f:X\to Y\}$
    • $co{m}_f\leftarrow commit(f,r)$
      • sent to verifier
    • verifier: sends $x\in X$
    • prover: sends $y\in Y$ and $\pi$
      • proving that $f(x)=y$ and $f\in F$
    • a functional commitment scheme for $F$
      • $setup(1^{\lambda })\to gp$: outputs public param
      • $commit(gp,f,r)\to co{m}_f$
        • binding & optional hiding (for zk-SNARK)
      • $eval(P,V)$
        • $P(gp,f,x,y,r)\to \pi$
        • $V(gp,co{m}_f,x,y,\pi )\to$ accept / reject
        • a SNARK for relation
          • $f(x)=y$, $f\in F$, and $commit(gp,f,r)=co{m}_f$
    • four important functional commitments
      • polynomial commitments
        • commit to a univariate $f(X)$ in $F_p^{\le d}[X]$
      • multilinear commitments
        • commit to multilinear $f$ in $F_p^{\le 1}[X_1,\dots ,X_k]$
        • e.g. $f(x_1,\dots ,x_k)=x_1{x}_3+x_1{x}_4{x}_5+x_7$
      • vector commitments (e.g. Merkle tree)
        • commit to $\overrightarrow{u}=(u_1\dots ,u_d)\in F_p^d$
        • open cells: $f_{\overrightarrow{u}}(i)=u_i$
          • prove that $i$th index is $u_i$
      • inner product commitments
        • aka inner product arguments (IPA)
        • commit to $\overrightarrow{u}\in F_p^d$
        • open an inner product $f_{\overrightarrow{u}}(\overrightarrow{v})=(\overrightarrow{u},\overrightarrow{v})$
  • Polynomial commitments
    • commit to a univariate $f(X)$ in $F_p^{\le d}[X]$
    • eval: for public $u,v\in F_p$, prover can convince
      • $f(u)=v$ and $\mathrm{deg}(f)\le d$
      • for verifier w/ $(d,co{m}_f,u,v)$
    • eval proof size & verifier time: $O_{\lambda }(\log d)$
    • few examples
      • w/ bilinear groups: KZG’10 (trusted setup), Dory’20
      • w/ hash functions only: based on FRI (long eval proofs)
      • w/ elliptic curves: Bulletproofs (short proof, but verifier time being $O(d)$)
      • w/ groups of unknown order: Dark’20 (slow)
      • KZG’10: most widely used
    • trivial commitment scheme: not a polynomial commitment
      • let $commit(f={\sum }_{i=0}^d{a}_i{X}^i,r)$
        • output $co{m}_f\leftarrow H((a_0,\dots ,a_d),r)$
      • eval: prover sends $\pi =((a_0,\dots ,a_d),r)$ to verifier
        • verifier accepts if $f(u)=v$ and $H((a_0,\dots ,a_d),r)=co{m}_f$
        • proof size & verification time: linear in $d$
  • Useful observation
    • for a non-zero $f\in F_p^{\le d}[X]$
      • for $r\stackrel{\$}{\leftarrow }{F}_p$: $Pr[f(r)=0]\le d/p$
        • aka SZDL lemma
        • also holds for multivariate polynomials
          • $d$: total degree of $f$
      • has at most $d$ roots in finite field
        • and $p$ possibilities for $r$
    • thus, suppose $p\approx 2^{256}$ and $d\le 2^{40}$
      • then $d/p$ is negligible
    • and if $f(r)=0$, $f=0$ for high probability
    • suppose $p\approx 2^{256}$ and $2\le 2^{40}$
      • let $f,g\in F_p^{\le d}[X]$
      • for $r\stackrel{\$}{\leftarrow }{F}_p$: if $f(r)=g(r)$
        • ⇒ $f=g$ w.h.p.
      • as $f(r)-g(r)=0$
        • ⇒ $f-g=0$ w.h.p.
      • $Pr[f(r)=0]\le d/p$
    • ⇒ simple equality test for two committed polynomials
  • Equality test protocol
    • interactive protocol
      • prover: $f,g\in F_p^{\le d}[X]$
      • verifier: gives $r\stackrel{\$}{\leftarrow }R$
      • prover: computes $y\leftarrow f(r)$, $y^{\prime }\leftarrow g(r)$
        • and attaches proof for
          • $y=f(r)$
          • $y^{\prime }=g(r)$
        • along w/ $y,y^{\prime }$
      • verifier: accepts if
        • valid proof
        • $y=y^{\prime }$
    • can be made non-interactive (Fiat-Shamir)
      • for all public-coin IP
      • prover: generates $r$ by its own w/ $H$
      • $P(pp,x=(co{m}_f,co{m}_g),w=(f,g))$
        • $r\leftarrow H(x)$
        • $y\leftarrow f(r)$, $y^{\prime }\leftarrow g(r)$
        • sends $y,y^{\prime },{\pi }_f,{\pi }_g$
      • $V(vp,x=(co{m}_f,co{m}_g))$
        • compute $r=H(x)$ itself as well
      • not a zk-SNARK as $f(r)$, $g(r)$ is revealed
  • F-IOP
    • goal: boost functional commitment
      • ⇒ SNARK for general circuits
    • let $C(x,w)$ be arith. circuit and $x\in F_p^n$
    • F-IOP: proof system that proves $\exists w:C(x,w)=0$ as follows
      • $setup(C)\to pp,vp$
        • $=(f_0,f_{-1},\dots f_{-s})$
        • oracles for functions in $F$
          • can be replaced into commitments
      • proof
        • prover: sends $f_1\in F$
          • verifier: sends $r_1\stackrel{\$}{\leftarrow }{F}_p$
        • prover: sends $f_2\in F$
          • verifier: sends $r_2\stackrel{\$}{\leftarrow }{F}_p$
        • … repeated t times
          • and verifier: runs ${\text{verify}}^{f_{-s},\dots f_t}(x,r_1,\dots ,r_{t-1})$
    • properties
      • complete: $\exists w:C(x,w)=0$ then $Pr[V=1]=1$
      • knowledge sound: unable to fake knowledge
  • Example poly-IOP
    • $C(X,W)=0$ ↔ $X\subseteq W\subseteq F_p$
    • prover
      • $f(Z):={\prod }_{w\in W}(Z-w)$
      • $g(Z):={\prod }_{x\in X}(Z-x)$
      • $q(Z):=f/g\in F_p^{\le d}[X]$
        • as $X\subseteq W$, $f/g$ is a polynomial
      • sends: $f,q$
    • verifier
      • $g(X):={\prod }_{x\in X}(Z-x)$
      • $r\stackrel{\$}{\leftarrow }{F}_p$ (public)
      1. query $w\leftarrow f(r)$
      2. query $q^{\prime }\leftarrow q(r)$
      3. compute $x\leftarrow g(r)$
      4. accept if $x\cdot q^{\prime }=w$
    • V accepts ⇒ $f=g\cdot q$ w.h.p. ⇒ $X\subseteq W$
      • kind of reversed logic
    • Extractor: $E(X,f,q,r)$
      • output $W$ by computing all roots of $f(Z)$
  • IOP Zoo
    • ⇒ SNARKs for general circuits
    • Poly-IOP (w/ Poly-Commit)
      • Sonic
      • Marlin
      • Plonk
    • Multilinear-IOP (w/ Multilinear-Commit)
      • Spartan
      • Clover
      • Hyperplonk
    • Vector-IOP (w/ Merkle)
      • STARK
      • Breakdown
      • Orion
    • ⇒ SNARK (non-interactive via Fiat-Shamir)
  • SNARKs in practice
    • programs: written in Domain-Specific Language
      • Circom, ZoKrates, Leo, Cairo, Noir..
    • compiles to SNARK friendly format
      • circuit, R1CS, …, EVM byte code
    • → SNARK backend prover (heavy computation)
      • outputs $\pi$