4 ms·

Look at this code: https://docs.zama.ai/concrete/getting-started/quick_start https://docs.zama.ai/concrete/getting-started/quick_start This is a rust based Fu

by xrd 4y ago

Look at this code: https://docs.zama.ai/concrete/getting-started/quick_start https://docs.zama.ai/concrete/getting-started/quick_start This is a rust based Fully Homomorphic Encryption (FHE) example. That is to say, you can encrypt two numbers, do a mathematical calculation on them without decrypting them, and then, only the person with the private key can decrypt the result to get the value. If you add something like FHE to blockchains (it's coming) then you can get anonymous transactions on the blockchain directly. By the way, Zero knowledge proofs are not what is needed to get anonymous transactions. When you use ZK, you are issuing the proof AND have knowledge of the inputs. The prover needs to know the inputs, but does not need to reveal them to the verifier (which happens on chain). This means the transaction can assert that the mathematical operation occurred without doubt, but when you need to get at the numbers, you are back to a transparent value on the chain.

cto_of_antifa 4y ago
DSingularity 4y ago
Given the high complexity of FHE, surely there be limits to FHE based transactions?
- xrd 4y ago
  Definitely. And, the founder of Zama says there are new chips which will optimize these types of calculations and make them more mainstream. For the record, no clue how true that assertion is, but seems like now that the calculations are possible, Moore's law will solve that problem one way or another. FHE is going to make things interesting and it seems like it is only a matter of time before they are workable on existing blockchains. Plus, these types of calculations are not susceptible to side-chain attacks, since no private keys are used in the calculations.
  - tsimionescu 4y ago
    FHE computations are hundreds of thousands of times slower than non-encrypted computations, and are non-parallelizable, and Moore's law is long since dead for single-core performance.
    - xrd 4y ago
      I didn't know that. I'm interested in understanding why they aren't parallelizable? I'm surprised that is the case. It's a good point you make, and makes me wonder whether a combination of zk proofs where the inputs to the zk proof are the encrypted inputs of the FHE conjuration. If so, that could be used against a verifier to move the computation off chain. Seems like a complicated circuit you would need to make but if you could do it, you wouldn't need to worry about the computational cost on chain. Thanks for that information, very thought provoking.
  - latchkey 4y ago
    > new chips which will optimize these types of calculations and make them more mainstream. There are quite a few people working on this problem from both the hardware and software side of things. Source: I've talked to a large number of them. It is still early days, but given the level of interest out there to do this, I believe strongly that it will happen.
krackers 4y ago
>When you use ZK, you are issuing the proof AND have knowledge of the inputs. The prover needs to know the inputs, but does not need to reveal them to the verifier (which happens on chain). Can you elaborate more on this? What is this a ZKP proof for? That the transaction is valid? Also from all the ZKP examples I've seen in crypto[graphy] class, soundness relies on the ability to repeat the process again and again. How does this work for the blockchain case where it seems like there's only one round of communication between prover/verifier?
- shakow 4y ago
  ZK rollups/EVMs are one among the myriad of arguably badly named things in maths & CS. They are named so because they are an implementation of what is called ZK proofs, but they leverage them to be able to prove a succession of modifications of the state (i.e. the accounts and their money) in a quick & easy way to check. As a simplification, you may think of them as a hash of transactions & smart contract executions that are a tad expensive to compute, but trivial to check. The end goal typically being to multiplex multiple level-2 transactions onto a single Ethereum transaction to enhance bandwidth and reduce fees. However, they are not ZK in the applied sense of it; e.g. they do not even try to mask the operations; anyone could rebuild them themselves with a bit of effort.

by xrd 4y ago

cto_of_antifa 4y ago

DSingularity 4y ago

Given the high complexity of FHE, surely there be limits to FHE based transactions?

xrd 4y ago
Definitely. And, the founder of Zama says there are new chips which will optimize these types of calculations and make them more mainstream. For the record, no clue how true that assertion is, but seems like now that the calculations are possible, Moore's law will solve that problem one way or another. FHE is going to make things interesting and it seems like it is only a matter of time before they are workable on existing blockchains. Plus, these types of calculations are not susceptible to side-chain attacks, since no private keys are used in the calculations.
- tsimionescu 4y ago
  FHE computations are hundreds of thousands of times slower than non-encrypted computations, and are non-parallelizable, and Moore's law is long since dead for single-core performance.
  - xrd 4y ago
    I didn't know that. I'm interested in understanding why they aren't parallelizable? I'm surprised that is the case. It's a good point you make, and makes me wonder whether a combination of zk proofs where the inputs to the zk proof are the encrypted inputs of the FHE conjuration. If so, that could be used against a verifier to move the computation off chain. Seems like a complicated circuit you would need to make but if you could do it, you wouldn't need to worry about the computational cost on chain. Thanks for that information, very thought provoking.
- latchkey 4y ago
  > new chips which will optimize these types of calculations and make them more mainstream. There are quite a few people working on this problem from both the hardware and software side of things. Source: I've talked to a large number of them. It is still early days, but given the level of interest out there to do this, I believe strongly that it will happen.

krackers 4y ago

>When you use ZK, you are issuing the proof AND have knowledge of the inputs. The prover needs to know the inputs, but does not need to reveal them to the verifier (which happens on chain). Can you elaborate more on this? What is this a ZKP proof for? That the transaction is valid? Also from all the ZKP examples I've seen in crypto[graphy] class, soundness relies on the ability to repeat the process again and again. How does this work for the blockchain case where it seems like there's only one round of communication between prover/verifier?

shakow 4y ago
ZK rollups/EVMs are one among the myriad of arguably badly named things in maths & CS. They are named so because they are an implementation of what is called ZK proofs, but they leverage them to be able to prove a succession of modifications of the state (i.e. the accounts and their money) in a quick & easy way to check. As a simplification, you may think of them as a hash of transactions & smart contract executions that are a tad expensive to compute, but trivial to check. The end goal typically being to multiplex multiple level-2 transactions onto a single Ethereum transaction to enhance bandwidth and reduce fees. However, they are not ZK in the applied sense of it; e.g. they do not even try to mask the operations; anyone could rebuild them themselves with a bit of effort.