3 ms·

If I understand this correctly, would an example use case work as follows? I want to get a loan for a house. A lender wants to see that I am trust worthy enoug

If I understand this correctly, would an example use case work as follows? I want to get a loan for a house. A lender wants to see that I am trust worthy enough for a loan, however I don't want just any potential lender to know my exact bank account balance or anything like that, just that I have enough. So, a program is written in Cairo that validates either I do or don't have enough, and the lender can verify the results, without seeing anything else. Is that more or less how it goes or can someone help make this real for me?

norswap 3y ago
There are essentially two use cases for "zero-knowledge" proofs: 1. Zero-knowledge That's proving a statement without revealing information, this is the example your're giving. For instance, you could prove that you have an account number (private information, input to proof generation, but not input to proof verification, so not revealed to the counterparty) on a blockchain (whose state hash is public, input to both proof generation and verification), with enough quality assets to back your loan. 2. Succintness It turns out you can verify zk-SNARKS (where SNARK = Succint Non-interactive ARgument of Knowledge) in less time than it takes to execute the program being proven. Some schemes do this in constant time, some in logarithmtic time (the STARKs currently used with Cairo are logarithmic). This lets you offload computation to a third party (like AWS) but without trusting that the third party will not perform a modified computation instead. The third party gives you back the result along with a cryptographic proof that you can verify relatively fast. In this use case, there doesn't need to be any private input at all (though there can be, and the verification will still be succint), so it's not even necessarily "zero-knowledge". People sometimes call this "validity proof" to distinguish, but the underlying cryptography is the same.
Joker_vD 3y ago
> I want to get a loan for a house. A lender wants to see that I am trust worthy enough for a loan, however I don't want just any potential lender to know my exact bank account balance or anything like that, just that I have enough. That's... what? If you "have enough", you don't need a loan, do you? And lenders generally don't want to know your bank account balance either, they want to know if you have a stable (and large enough) current of income, e.g. that you're employed and yearn at least X per month, so that you'd be able to make monthly payments for years to come.
Reisen 3y ago
This is a correct intuition yes. A program written in Cairo taking your balance (private) and a minimum collateral (public) and outputs a boolean for pass/fail, where the lender can only see "pass/fail" but trust the program was executed correctly is right. However the technology isn't particularly useful in this scenario. It's enough for your bank to just reply to a request with "yes" without running the program because in theory you are forced to trust the bank no matter what as you have no guarantee the bank didn't just lie about your balance in the input to the Cairo program, so in this scenario the proof doesn't bring much. This technology is a lot more useful when the data being verified is combined with something that guarantees that the data input wasn't forged somehow, which is why this is more useful in blockchain environments where all transactions and balances are signed, so someone can't just invent a balance out of thin air.

norswap 3y ago

There are essentially two use cases for "zero-knowledge" proofs: 1. Zero-knowledge That's proving a statement without revealing information, this is the example your're giving. For instance, you could prove that you have an account number (private information, input to proof generation, but not input to proof verification, so not revealed to the counterparty) on a blockchain (whose state hash is public, input to both proof generation and verification), with enough quality assets to back your loan. 2. Succintness It turns out you can verify zk-SNARKS (where SNARK = Succint Non-interactive ARgument of Knowledge) in less time than it takes to execute the program being proven. Some schemes do this in constant time, some in logarithmtic time (the STARKs currently used with Cairo are logarithmic). This lets you offload computation to a third party (like AWS) but without trusting that the third party will not perform a modified computation instead. The third party gives you back the result along with a cryptographic proof that you can verify relatively fast. In this use case, there doesn't need to be any private input at all (though there can be, and the verification will still be succint), so it's not even necessarily "zero-knowledge". People sometimes call this "validity proof" to distinguish, but the underlying cryptography is the same.

Joker_vD 3y ago

> I want to get a loan for a house. A lender wants to see that I am trust worthy enough for a loan, however I don't want just any potential lender to know my exact bank account balance or anything like that, just that I have enough. That's... what? If you "have enough", you don't need a loan, do you? And lenders generally don't want to know your bank account balance either, they want to know if you have a stable (and large enough) current of income, e.g. that you're employed and yearn at least X per month, so that you'd be able to make monthly payments for years to come.

Reisen 3y ago

This is a correct intuition yes. A program written in Cairo taking your balance (private) and a minimum collateral (public) and outputs a boolean for pass/fail, where the lender can only see "pass/fail" but trust the program was executed correctly is right. However the technology isn't particularly useful in this scenario. It's enough for your bank to just reply to a request with "yes" without running the program because in theory you are forced to trust the bank no matter what as you have no guarantee the bank didn't just lie about your balance in the input to the Cairo program, so in this scenario the proof doesn't bring much. This technology is a lot more useful when the data being verified is combined with something that guarantees that the data input wasn't forged somehow, which is why this is more useful in blockchain environments where all transactions and balances are signed, so someone can't just invent a balance out of thin air.