5 ms·

Kimchi: The latest update to Mina’s proof system

81 points by baby 5y ago

lpcvoid 5y ago
I never heard of this before, went to the site, saw it's some new blockchain rugpull with a new coat of paint, and closed the tab. I mean, they literally want me to be a "snark producer", so here we go.
- neuroma 5y ago
  I don't care to defend a blockchain company, however, Mina has been about for a while and is one of the groups actually investing in engineering + tech. Maybe worth another look? If you can persevere past the disgust indicing food names
- space_rock 5y ago
  Most people don't understand this stuff so they'll take it at face value even though it's likely a scam
- dopidopHN 5y ago
  Zero knowledge proof are larger than crypto-currency. I think snark is one of the algorithms that implements it ( again, nothing to do with cryptocurrency ) But correct, that’s a blockchain thingy.
dcposch 5y ago
Congratulations to the cryptographers and engineers at Mina for shipping this. We are getting palpably close to efficiently provable general computation. (For others interested in the evolution, see TinyRAM and the various zkEVM efforts especially zkSync2. This is a fascinating development in CS with wide implications.) My issue with Mina as a platform is the token distribution. It's over 50% allocated to insiders: https://minaprotocol.com/blog/mina-token-distribution-and-supply https://minaprotocol.com/blog/mina-token-distribution-and-su... (Note that of the 1m initial tokens, slightly over half is "backers", "core contributors", and the two foundations. Since Mina is proof-of-stake, all ongoing issurance goes to existing tokenholders, so we can expect that Mina will always be over 50% insider owned unless they sell.)
- tromp 5y ago
  > all ongoing issurance goes to existing tokenholders David Rosenthal also raised this issue in his recent blog entry [1]: "It isn't just that the Gini coefficients of cryptocurrencies are extremely high[4], but that Proof-of-Stake makes this a self-reinforcing problem. Because the rewards for mining new blocks, and the fees for including transactions in blocks, flow to the HODL-ers in proportion to their HODL-ings, whatever Gini coefficient the systems starts out with will always increase. Proof-of-Stake isn't effective at decentralization." [1] https://news.ycombinator.com/item?id=30310317 https://news.ycombinator.com/item?id=30310317
  - klysm 5y ago
    Is the Gini coefficient a valid measure here?
  - anchpop 5y ago
    I haven't read the blog entry, but the logic here doesn't make sense to me. If everyone gets a 5% return on their stake, the gini coefficient doesn't change at all. Probably small holders never stak and so never get any return, but these people were never going to run nodes anyway so I don't know if it matters. Furthermore, let's say it costs $1000 to set up a PoW mining rig, compared to $1000 to buying a stake big enough to let you validate. I'm not sure it makes such a big difference in either case.
    - tromp 5y ago
      > If everyone gets a 5% return on their stake, Transaction fees slightly tip the balance from transactors to hodlers. > let's say it costs $1000 to set up a PoW mining rig Setting it up does nothing. You have to pay the ongoing electricity bill, which most miners do by selling a substantial fraction of their mined coins.
  - dcposch 5y ago
    David's post seems pretty confused. > Because the rewards for mining new blocks, and the fees for including transactions in blocks, [...] whatever Gini coefficient the systems starts out with will always increase That doesn't follow at all. If everyone staked their coins and nobody ever bought or sold, the distribution would remain constant over time. In reality, coins do trade, and this causes diffusion. Coin ownership can decentralize over time. In practice, proof-of-stake is better for distributing ownership than proof-of-work, because the block rewards (new issuance) go to a wider set of participants. Staking can be done by anyone, while mining profitably requires a specialized operation with large upfront capital costs. -- Finally, be wary of anyone quoting Gini coefficients for blockchains. Gini only makes sense if calculated per person. If you calculate Gini from on-chain address balances, you get numbers that are wildly off. See https://vitalik.ca/general/2021/07/29/gini.html https://vitalik.ca/general/2021/07/29/gini.html
tromp 5y ago
Can the provers in this blockchain also get away with not storing any of the underlying chain data?
- milkey_mouse 5y ago
  Yes. The proof of block n's validity proves both that the state transition from block n-1 to block n is valid and that the previous block's proof was valid. The arithmetic circuit for a state transition proof actually encodes a program which verifies SNARK proofs (in addition to the less academically interesting "doesn't create $ out of thin air" sort of rules). The proof of the latest block at any height (which is all the state you need to know you're on at least a valid chain history) remains constant size because of the indirection of proving that a verifier accepts the last block's proof without actually including it (taking advantage of the fact that a zero-knowledge proof doesn't have to include or even reveal the data it's proving something about).
  - legutierr 5y ago
    Thanks for this explanation. Do you know anything of how Mina would handle things that need to exist in the public state of a blockchain, but which cannot be learned from the 22KB proof—for instance, DeFi smart contracts? For something like a DeFi DEX to be useful, it's not enough to know that specific operation succeeded. It has to be possible for anyone to invoke the operation themselves, and that means that the state of the smart contract, and the contract's executable code, need to be publicly known.
    - baby 5y ago
      These are called snapps in Mina, basically the state of a smart contract is nothing more special than the balance of an account, so you can store it on the blockchain in the same way. Now Mina is a succinct blockchain and zkp allows most data to be stored off-chain so I think the idea will be to limit heavily the amount of on-chain data.
      - 5y ago
diwsfi 5y ago
byteware 5y ago
does this version of SNARK require a trusted setup (a ceremony)?
- mattdesl 5y ago
  plonk based proof system can take advantage of an existing universal setup (like Powers of Tau ceremony). I’d be curious to know more about how Mina approaches this though.
- trotro 5y ago
- ihm 5y ago
  Hi - I work on proof systems for Mina. Our proof system does not require any trusted setup. It uses a polynomial commitment scheme based on the setupless scheme used in bulletproofs (the version we use is close to the one described in this paper https://eprint.iacr.org/2020/499.pdf https://eprint.iacr.org/2020/499.pdf), which is based on the hardness of discrete-log. Some SNARKs use pairing-based polynomial commitment schemes, which require a trusted setup (and some require a trusted setup for other reasons.)
FridgeSeal 5y ago
Debates about cryptocurrencies aside, that website is beautiful. Colours are nice, aesthetics are great, without being too retro and the performance is good.
stavros 5y ago
I've never seen this before, but this is a bit odd: > the entire Mina blockchain is about 22KB – the size of a couple of tweets When did we get 11,000 character tweets? Certainly looks very interesting otherwise, hopefully it'll be used for more than speculation and money laundering.
- argvargc 5y ago
  From a developers perspective the size of a tweet is typically greater than the character count of its text: https://developer.twitter.com/en/docs/twitter-api/data-dictionary/object-model/tweet https://developer.twitter.com/en/docs/twitter-api/data-dicti...
  - stavros 5y ago
    Ah yeah, you're right, I forgot about wide modes etc.
desertraven 5y ago
As someone not very knowledgeable with cryptography, what practical benefits would such a blockchain have? What benefits would we see with widespread adoption?
- mattdesl 5y ago
  zk proofs could be used to add privacy features to a blockchain, but also verifiable computation. Ethereum smart contracts are bound by “gas” as they run on-chain (and so highly expensive computation is infeasible), in Mina the smart contract computation can execute on the user’s own machine; only the lightweight zk-SNARK proof is submitted to the network. Zk proofs also enable some novel forms of verifiable attestations. For example proving that you have sufficient funds for a bid, or belong to a group of addresses, or know something private, without revealing any additional information about it.
ihm 5y ago
Very cool and unexpected to see something we worked on on HN! If you’re a good hacker who wants to work on this stuff (Rust, C++, or OCaml especially) we’re hiring cryptography engineers[0] and offering training on all the relevant cryptography. We’re also majority worker-owned and worker-governed which is a rare perk for VC funded startups :0 [0]: https://boards.greenhouse.io/o1labs/jobs/4023646004 https://boards.greenhouse.io/o1labs/jobs/4023646004
goodmachine 5y ago
22 tps? Is this still correct? https://www.youtube.com/watch?v=Zj6rNewnbrw https://www.youtube.com/watch?v=Zj6rNewnbrw
- baby 5y ago
  See https://medium.com/minaprotocol/answering-community-questions-and-whats-ahead-for-mina-d771fa94489b https://medium.com/minaprotocol/answering-community-question...
  - goodmachine 5y ago
    thanks

81 points by baby 5y ago

I never heard of this before, went to the site, saw it's some new blockchain rugpull with a new coat of paint, and closed the tab. I mean, they literally want me to be a "snark producer", so here we go.

neuroma 5y ago
I don't care to defend a blockchain company, however, Mina has been about for a while and is one of the groups actually investing in engineering + tech. Maybe worth another look? If you can persevere past the disgust indicing food names
space_rock 5y ago
Most people don't understand this stuff so they'll take it at face value even though it's likely a scam
dopidopHN 5y ago
Zero knowledge proof are larger than crypto-currency. I think snark is one of the algorithms that implements it ( again, nothing to do with cryptocurrency ) But correct, that’s a blockchain thingy.

dcposch 5y ago

Congratulations to the cryptographers and engineers at Mina for shipping this. We are getting palpably close to efficiently provable general computation. (For others interested in the evolution, see TinyRAM and the various zkEVM efforts especially zkSync2. This is a fascinating development in CS with wide implications.) My issue with Mina as a platform is the token distribution. It's over 50% allocated to insiders: https://minaprotocol.com/blog/mina-token-distribution-and-supply https://minaprotocol.com/blog/mina-token-distribution-and-su... (Note that of the 1m initial tokens, slightly over half is "backers", "core contributors", and the two foundations. Since Mina is proof-of-stake, all ongoing issurance goes to existing tokenholders, so we can expect that Mina will always be over 50% insider owned unless they sell.)

tromp 5y ago
> all ongoing issurance goes to existing tokenholders David Rosenthal also raised this issue in his recent blog entry [1]: "It isn't just that the Gini coefficients of cryptocurrencies are extremely high[4], but that Proof-of-Stake makes this a self-reinforcing problem. Because the rewards for mining new blocks, and the fees for including transactions in blocks, flow to the HODL-ers in proportion to their HODL-ings, whatever Gini coefficient the systems starts out with will always increase. Proof-of-Stake isn't effective at decentralization." [1] https://news.ycombinator.com/item?id=30310317 https://news.ycombinator.com/item?id=30310317
- klysm 5y ago
  Is the Gini coefficient a valid measure here?
- anchpop 5y ago
  I haven't read the blog entry, but the logic here doesn't make sense to me. If everyone gets a 5% return on their stake, the gini coefficient doesn't change at all. Probably small holders never stak and so never get any return, but these people were never going to run nodes anyway so I don't know if it matters. Furthermore, let's say it costs $1000 to set up a PoW mining rig, compared to $1000 to buying a stake big enough to let you validate. I'm not sure it makes such a big difference in either case.
  - tromp 5y ago
    > If everyone gets a 5% return on their stake, Transaction fees slightly tip the balance from transactors to hodlers. > let's say it costs $1000 to set up a PoW mining rig Setting it up does nothing. You have to pay the ongoing electricity bill, which most miners do by selling a substantial fraction of their mined coins.
- dcposch 5y ago
  David's post seems pretty confused. > Because the rewards for mining new blocks, and the fees for including transactions in blocks, [...] whatever Gini coefficient the systems starts out with will always increase That doesn't follow at all. If everyone staked their coins and nobody ever bought or sold, the distribution would remain constant over time. In reality, coins do trade, and this causes diffusion. Coin ownership can decentralize over time. In practice, proof-of-stake is better for distributing ownership than proof-of-work, because the block rewards (new issuance) go to a wider set of participants. Staking can be done by anyone, while mining profitably requires a specialized operation with large upfront capital costs. -- Finally, be wary of anyone quoting Gini coefficients for blockchains. Gini only makes sense if calculated per person. If you calculate Gini from on-chain address balances, you get numbers that are wildly off. See https://vitalik.ca/general/2021/07/29/gini.html https://vitalik.ca/general/2021/07/29/gini.html

tromp 5y ago

Can the provers in this blockchain also get away with not storing any of the underlying chain data?

milkey_mouse 5y ago
Yes. The proof of block n's validity proves both that the state transition from block n-1 to block n is valid and that the previous block's proof was valid. The arithmetic circuit for a state transition proof actually encodes a program which verifies SNARK proofs (in addition to the less academically interesting "doesn't create $ out of thin air" sort of rules). The proof of the latest block at any height (which is all the state you need to know you're on at least a valid chain history) remains constant size because of the indirection of proving that a verifier accepts the last block's proof without actually including it (taking advantage of the fact that a zero-knowledge proof doesn't have to include or even reveal the data it's proving something about).
- legutierr 5y ago
  Thanks for this explanation. Do you know anything of how Mina would handle things that need to exist in the public state of a blockchain, but which cannot be learned from the 22KB proof—for instance, DeFi smart contracts? For something like a DeFi DEX to be useful, it's not enough to know that specific operation succeeded. It has to be possible for anyone to invoke the operation themselves, and that means that the state of the smart contract, and the contract's executable code, need to be publicly known.
  - baby 5y ago
    These are called snapps in Mina, basically the state of a smart contract is nothing more special than the balance of an account, so you can store it on the blockchain in the same way. Now Mina is a succinct blockchain and zkp allows most data to be stored off-chain so I think the idea will be to limit heavily the amount of on-chain data.
    - 5y ago

diwsfi 5y ago

byteware 5y ago

does this version of SNARK require a trusted setup (a ceremony)?

mattdesl 5y ago
plonk based proof system can take advantage of an existing universal setup (like Powers of Tau ceremony). I’d be curious to know more about how Mina approaches this though.
trotro 5y ago
ihm 5y ago
Hi - I work on proof systems for Mina. Our proof system does not require any trusted setup. It uses a polynomial commitment scheme based on the setupless scheme used in bulletproofs (the version we use is close to the one described in this paper https://eprint.iacr.org/2020/499.pdf https://eprint.iacr.org/2020/499.pdf), which is based on the hardness of discrete-log. Some SNARKs use pairing-based polynomial commitment schemes, which require a trusted setup (and some require a trusted setup for other reasons.)

FridgeSeal 5y ago

Debates about cryptocurrencies aside, that website is beautiful. Colours are nice, aesthetics are great, without being too retro and the performance is good.

stavros 5y ago

I've never seen this before, but this is a bit odd: > the entire Mina blockchain is about 22KB – the size of a couple of tweets When did we get 11,000 character tweets? Certainly looks very interesting otherwise, hopefully it'll be used for more than speculation and money laundering.

argvargc 5y ago
From a developers perspective the size of a tweet is typically greater than the character count of its text: https://developer.twitter.com/en/docs/twitter-api/data-dictionary/object-model/tweet https://developer.twitter.com/en/docs/twitter-api/data-dicti...
- stavros 5y ago
  Ah yeah, you're right, I forgot about wide modes etc.

desertraven 5y ago

As someone not very knowledgeable with cryptography, what practical benefits would such a blockchain have? What benefits would we see with widespread adoption?

mattdesl 5y ago
zk proofs could be used to add privacy features to a blockchain, but also verifiable computation. Ethereum smart contracts are bound by “gas” as they run on-chain (and so highly expensive computation is infeasible), in Mina the smart contract computation can execute on the user’s own machine; only the lightweight zk-SNARK proof is submitted to the network. Zk proofs also enable some novel forms of verifiable attestations. For example proving that you have sufficient funds for a bid, or belong to a group of addresses, or know something private, without revealing any additional information about it.

ihm 5y ago

Very cool and unexpected to see something we worked on on HN! If you’re a good hacker who wants to work on this stuff (Rust, C++, or OCaml especially) we’re hiring cryptography engineers[0] and offering training on all the relevant cryptography. We’re also majority worker-owned and worker-governed which is a rare perk for VC funded startups :0 [0]: https://boards.greenhouse.io/o1labs/jobs/4023646004 https://boards.greenhouse.io/o1labs/jobs/4023646004

goodmachine 5y ago

22 tps? Is this still correct? https://www.youtube.com/watch?v=Zj6rNewnbrw https://www.youtube.com/watch?v=Zj6rNewnbrw

baby 5y ago
See https://medium.com/minaprotocol/answering-community-questions-and-whats-ahead-for-mina-d771fa94489b https://medium.com/minaprotocol/answering-community-question...
- goodmachine 5y ago
  thanks