3 ms·

This is a technical question for Gregory or the other authors. When the verifier (i.e. buyer) produces the public parameters for the SNARK (or any NIZK for tha

by abhv 11y ago

This is a technical question for Gregory or the other authors. When the verifier (i.e. buyer) produces the public parameters for the SNARK (or any NIZK for that matter), the protocol may no longer be zero-knowledge. The protocol is ZK because there exists a simulator which can produce an indistinguishable setup, and simulate proofs. This does not mean that if you allow any V* to produce a CRS, the simulator can still simulate. I cannot think of an explicit attack off-hand, but wonder how you deal with this.

9mit3t2m9h9a 11y ago
A person who monitors transactions and immediately submits a competing transaction with ridiculously high transaction fee (50% of the payoff) may have a chance to induce miners to include his illicit transaction in the new block instead of the legitimate payment. Maybe illicit CRS can be a problem for some kinds of checks, but I guess you could feed first Linux kernel commits in the 2016 to some randomness extractor to get something that is harder to manipulate freely.
- abhv 11y ago
  I believe it is not possible to submit a competing transaction to spend, the identity of the seller (via seller's public key) is included in the script. The CRS issue is that off-chain, a malicious Verifier (buyer) may learn about the witness, i.e., either enc key or solution.
ianmiers 11y ago
Hi (not one of the authors on this, but one of the Zerocash/ZCash authors and a co-worker of Sean's) This isn't the case with SNARKs, they are zero-knowledge no matter what. For a generic zero-knowledge proof, what you point out is completely true. You are not guaranteed zero-knowledge if the CRS is maliciously generated. For SNARKS, the proofs become zero-knowledge simply by the prover adding in randomness to his proof. This holds even if the verifier generates the CRS maliciously. Indeed, the original use of SNARKS was for verifiable computation where this was exactly what was done. See section 1.2,3.2, and 4.4 of [0]. In particular, note the last paragraph of 4.4 where the verifier is generating the CRS. (The point you raise about the simulator is a complex one. Zero-knowledge is an existential statement that there can exist such a simulator, therefor all proofs even when there clearly isn't one are zero-knowledge. The verifier can create a CRS and not tell anyone the information needed to simulate, but that information still exists and we could still, in theory, construct a simulator using it. Therefor the thing is zero-knowledge in both theory and practice. This is not always the case with all proof systems.) [0]https://eprint.iacr.org/2012/215.pdf https://eprint.iacr.org/2012/215.pdf
nullc 11y ago
See Theorem 6 of the GGPR'12 paper, its on page 26. https://eprint.iacr.org/2012/215 https://eprint.iacr.org/2012/215 which addresses the rerandomization of the proofs in the prover that result in them being a uniform sample of all acceptable proofs.

by abhv 11y ago

9mit3t2m9h9a 11y ago

A person who monitors transactions and immediately submits a competing transaction with ridiculously high transaction fee (50% of the payoff) may have a chance to induce miners to include his illicit transaction in the new block instead of the legitimate payment. Maybe illicit CRS can be a problem for some kinds of checks, but I guess you could feed first Linux kernel commits in the 2016 to some randomness extractor to get something that is harder to manipulate freely.

abhv 11y ago
I believe it is not possible to submit a competing transaction to spend, the identity of the seller (via seller's public key) is included in the script. The CRS issue is that off-chain, a malicious Verifier (buyer) may learn about the witness, i.e., either enc key or solution.

ianmiers 11y ago

Hi (not one of the authors on this, but one of the Zerocash/ZCash authors and a co-worker of Sean's) This isn't the case with SNARKs, they are zero-knowledge no matter what. For a generic zero-knowledge proof, what you point out is completely true. You are not guaranteed zero-knowledge if the CRS is maliciously generated. For SNARKS, the proofs become zero-knowledge simply by the prover adding in randomness to his proof. This holds even if the verifier generates the CRS maliciously. Indeed, the original use of SNARKS was for verifiable computation where this was exactly what was done. See section 1.2,3.2, and 4.4 of [0]. In particular, note the last paragraph of 4.4 where the verifier is generating the CRS. (The point you raise about the simulator is a complex one. Zero-knowledge is an existential statement that there can exist such a simulator, therefor all proofs even when there clearly isn't one are zero-knowledge. The verifier can create a CRS and not tell anyone the information needed to simulate, but that information still exists and we could still, in theory, construct a simulator using it. Therefor the thing is zero-knowledge in both theory and practice. This is not always the case with all proof systems.) [0]https://eprint.iacr.org/2012/215.pdf https://eprint.iacr.org/2012/215.pdf

nullc 11y ago

See Theorem 6 of the GGPR'12 paper, its on page 26. https://eprint.iacr.org/2012/215 https://eprint.iacr.org/2012/215 which addresses the rerandomization of the proofs in the prover that result in them being a uniform sample of all acceptable proofs.