3 ms·

I think there is an impedance mismatch in how easy the game is to understand versus how the ZK proof part has required reading. Some (if not most) of the questi

by aib 5y ago

I think there is an impedance mismatch in how easy the game is to understand versus how the ZK proof part has required reading. Some (if not most) of the questions or comments here must sound silly to someone knowledged in the field. Anyway, here is mine: How is the proof different than a signed message saying "This person has found the treasure"? With the private key derived from the coordinates? Anyway, I'm off to read more about ZK proofs in hopes of making the above sound silly to me.

minism 5y ago
I haven't looked at the game implementation in detail yet, but in order to verify "This person has found the treasure" is signed with the key for coordinates (X,Y), we need to know the cooresponding public key for coordinates (X,Y), which means that youre revealing the coordinates themselves in your message. The idea in ZKP is to prove you know a value without revealing the value itself.
- aib 5y ago
  I don't know how actual asymmetric KDFs work, but I was thinking more along the lines of secret -> private key -> public key, i.e. the public key doesn't contain information about the secret.
mattdesl 5y ago
Thanks! You may be correct in that this application could be better achieved with a simple signed message—this is my first time playing with ZK proofs. The main issue is that the circuit is simply hashing the coordinates and the resulting hash is being used to identify the treasures. So it is already fairly similar to the scenario you describe, but in an ideal ZK system it would not even reveal a hash of the coordinates, only verifiable knowledge of them. For example, I _think_ it might be closer to true ZK if I had hardcoded an equality check with exactly (5, 10) coordinates into the ZK circuit, rather than using hashes to support a variety of coordinates (but then it wouldn’t be as general purpose). Perhaps there’s another better way though!

by aib 5y ago

minism 5y ago

I haven't looked at the game implementation in detail yet, but in order to verify "This person has found the treasure" is signed with the key for coordinates (X,Y), we need to know the cooresponding public key for coordinates (X,Y), which means that youre revealing the coordinates themselves in your message. The idea in ZKP is to prove you know a value without revealing the value itself.

aib 5y ago
I don't know how actual asymmetric KDFs work, but I was thinking more along the lines of secret -> private key -> public key, i.e. the public key doesn't contain information about the secret.

mattdesl 5y ago

Thanks! You may be correct in that this application could be better achieved with a simple signed message—this is my first time playing with ZK proofs. The main issue is that the circuit is simply hashing the coordinates and the resulting hash is being used to identify the treasures. So it is already fairly similar to the scenario you describe, but in an ideal ZK system it would not even reveal a hash of the coordinates, only verifiable knowledge of them. For example, I _think_ it might be closer to true ZK if I had hardcoded an equality check with exactly (5, 10) coordinates into the ZK circuit, rather than using hashes to support a variety of coordinates (but then it wouldn’t be as general purpose). Perhaps there’s another better way though!