7 ms·

SP1: A performant, 100% open-source, contributor-friendly zkVM

81 points by plastic3169 2y ago

jrmg 2y ago
Can someone explain this in lay-person’s terms? I feel like I read and ‘understood’ the text of the blog post, but I’m still none the wiser about what sort of things this can prove and what the values of those proofs is.
- Avi-D-coder 2y ago
  Think of zk proofs as an extension of asymmetric cryptography to arbitrary logic. A zkVM makes encoding the arbitrary logic as easy as writing a normal Rust program. A proof is a probabilistic statement that a specific program run with some public inputs and maybe some private inputs was executed correctly. For crypto zk proofs are mostly for their succinctness property, not for privacy. Outside of crypto privacy is the more important property, let's say a government issues a signed document, I could prove any arbitrary statement about that document without revealing the document. We could use zk proofs for anything we use canonical documents for today and we would gain privacy. Will we do this, probably not, but it would be an improvement.
- knazarov 2y ago
  I'm not involved in the project in any way, but I can probably give an explanation. This is a risc-v virtual machine that supports rv32im instruction set (the bare minimum + multiplication). You can compile and run programs there as you would on a usual microcontroller. The "ZK" thing means that you can pass program code + data to this virtual machine, and as a result of execution get some output and a short sequence of bytes that allow the "other side" to verify that the result of program execution is correct without having to re-execute the program. This verification is computationally cheap. In order to do the verification the "other side" only needs that sequence of bytes and a hash of original code+data. Blockchains use this in context of achieving "byzantine consensus", especially in cases where multiple systems that lack mutual trust are involved. Think for example about if you want to relay information that's been computed on one blockchain to the other. If both blockchains can prove their state transitions with such virtual machine, then it is possible to make a sort of trusted "event queue" between them. There are of course caveats that rollbacks can happen, so it's not a silver bullet. Not sure how this applies to day-to-day software, but the thing that comes to mind is that it could serve some cases where TPM (hardware modules) are traditionally utilized. The TPM assumes you don't have means to break the hardware, and so it can attest to certain computation by signing the result with a baked-in key.
  - warkdarrior 2y ago
    How secure is this "ZK" thing? Can I use it for DRM? Trusted hardware is a pain to use.
    - knazarov 2y ago
      Let's put it this way. If you can break it and are willing to commit crime - you can earn a lot of money. I'm personally not equipped to judge the level of security, because I'm not a cryptography researcher. What I understand is that the overall ZK cryptography space has been around for a long time, and basic properties are well researched. I tried to read the PLONK paper for entertainment purposes and it's quite easy to understand. If you want to prove a program, you need to convert it to what is called "arithmetic circuits". This is a clever way of saying "a system of polynomial equations". It is as if you're converting the code to logic gates but instead here you use arithmetic: addition, raising to a certain power, etc. It is a process called "arithmetization". The proof calculation involves folding this system of equations in various ways and collecting a "witness". Not sure if I'm explaining this correctly, but it's probably in the right direction at least. The problem with all ZK proofs is that the last bit of calculating the witness is very computationally expensive. What takes milliseconds to run on the CPU can take many hours to prove. And a lot of research is focused on clever mathematical tricks that allow to speed up the proofs while keeping the risks of circuit compromise low enough. As you may guess, the more bleeding edge the research the less it is peer-reviewed. So I'd say that "it depends". As for DRM - probably not. At least not in a way that companies installing the DRM would want it to work. They likely want you to be unable to decrypt something at all outside of a particular chip, and watermark the video on top of that to be sure that you're not screen-capturing it. UPD: there's a decent free into course into modern ZK cryptography: https://zkiap.com/ https://zkiap.com/
      - DennisP 2y ago
        Proving performance is improving at a rapid pace though, like 10X/year. And converting to circuits is automatic now; there are compilers that can do it for arbitrary Rust code.
    - 2y ago
- DennisP 2y ago
  One simple application is making blockchains vastly more scalable. For a blockchain to be secure you have to store each transaction on chain, with enough information so everyone can verify that it's valid. Normally this means storing the sender's signature, which is bulky. With ZK, you can bundle up thousands of transactions, skip all the signatures, and include a single 256-bit proof that all the transactions had valid signatures.
Philpax 2y ago
Not as inscrutable as these things usually are, but I still don't really know what one would use this for. This world feels like a parallel ecosystem to traditional software, and the paths rarely meet.
- latchkey 2y ago
  When people are working on things like this where I don't understand what it is used for, I tend to run towards it and find out as much as I can. It is easy enough to just google zk usecase and find all sorts of various applications. None may apply to _you_, but that doesn't mean it is not meaningful for _others_.
- matthewdgreen 2y ago
  1. Imagine a situation where someone must run a (publicly-known) program on your behalf, and produce an output. But you don't fully trust them to compute that output correctly. This problem crops up in all sorts of applications, from blockchains to cloud computing. 2. Of course there is a simple solution to this problem. You (as a recipient of the output) could simply ask for the inputs, including any random numbers used, and re-compute the program yourself. But there are cases where this doesn't make sense: a. If the inputs to the program are secret (for example, the computing party is running a statistical calculation on some confidential data), then this won't be possible. b. If many, many people have to verify the output is correct, then re-running the calculation millions of times might add up to a huge amount of extra computation. To deal with this, systems like this (zkVMs) allow you to solve problem #1 by producing a short "proof" that the program was run successfully on a virtualized processor, and that the output is the result of that computation. Anyone who has a copy of the program code can efficiently verify that proof in much less time than it would take to re-run the program. As a benefit, it's possible to keep (some of) the program inputs secret -- so the verifier just learns that the program was run on some input, but does not need to learn the raw inputs. The challenge here is that these VM "processors" run at speeds in the KHz if you're very lucky, rather than the GHz we're used to on real processors. So in order for this to be worthwhile you need to be willing to accept a (for example) 1-million-fold slowdown in calculating speed for the person doing the proving. For applications that satisfy 2(a) and 2(b) above, this still might be worthwhile! Currently most of the practical applications are in blockchains: in that setting you have one person making a transaction, and then the whole world (literally millions of people) need to know that the transaction was executed successfully, e.g., that it updated an account ledger correctly and didn't steal money from an unrelated account. So far zkVM proofs have fewer applications outside of that setting.
zb3 2y ago
Is this useful outside the cryptocurrency crap?
- Avi-D-coder 2y ago
  Yes, it could replace all government ids, while allowing you to prove arbitrary statements about said signed government documents without revealing them (not saying it will happen).
  - perching_aix 2y ago
    Wouldn't those "documents" need to be code for that to happen?
    - Avi-D-coder 2y ago
      Those documents would need to be cryptographically signed machine readable data, json, a pdf (difficult). Getting governments, banks, and other trusted third parties to sign documents is very difficult, but is happening in some cases.
    - latchkey 2y ago
      Let's say the usecase is to prove that you're 21+ to enter a bar in the US. I don't want to have to hand over my ID with my personal information on it. On my phone, I could have the "proof", which can be validated by the door guard with a simple NFC device (ie: another phone) that is compatible with that proof.
      - notfed 2y ago
        I really doubt any cryptographic primitive can solve this; what's stopping me from lending my "proof" to my little brother?
        plastic3169 2y ago
        If you have digital id signed with government keys (like passport) you would prove that person has ID where the age is above 18, attached to this photo and that all the info comes from a single government sanctioned id. You don’t need to conceal all the data. Just the bits you don’t want to leak.
anon3459 2y ago
So i could write some complex logic with nested for loops and ofload it to the coprocessor
jeff_carr 2y ago
L. Ron Hubbard has entered the chat.
ikiris 2y ago
If its not obvious what a zKVM is, it shouldn't be unexplained in a headline with no commmentary. edit: The fact that its actually zkVM instead is even more confusing.
- plastic3169 2y ago
  I wasn’t sure if adding text is considered good form when submitting a link to a project I’m not part of. I followed the guidelines and did not editorialize the title. Surprisingly, ‘zkVM’ is a unique acronym, and search only returned relevant results.
raykyri 2y ago
For those looking for applications outside crypto, this might also be interesting: https://docs.ezkl.xyz/ https://docs.ezkl.xyz/ It's similar to Succinct but for proofs of ML models instead of RISCV. So you could generate a proof on some private data, on your computer or in a trusted environment, and submit the proof to show that you pass a fraud check without revealing any of your data.
wslh 2y ago
I cofounded a company doing also this [1] you can check the repositories [2]. [1] https://bitvmx.org https://bitvmx.org [2] https://github.com/FairgateLabs https://github.com/FairgateLabs
- quesomaster9000 2y ago
  While it's commendable that you're trying to extend BitVM to handle RISC-V... Why though? The dispute resolution game is eminently trollable and can be made very expensive by an adversary. Then you try to make it N-party, which reduces all of the security assumptions down to one which isn't verifiable on-chain and doesn't inherit any of Bitcoin's security. Yes, technically it's possible, should it be done? Probably not... Would I trust it? No... Does it come anywhere near the security of SP1... Absolutely not.
  - wslh 2y ago
    The point is that... we were able to reduce price for arbitration doing a lot of research.
- Jommi 2y ago
  that is not a legit company this is the only legit effort to use Bitcoin to verify ZKPs https://bitvm.org/ https://bitvm.org/
jedisct1 2y ago
"verifies the execution of [..] any LLVM-compiled language" Why is it limited to LLVM-compiled languages? Wouldn't anything that compiles to RISC-V work? And since the LLVM bitcode format completely changes every time there's a new LLVM release, how does that work?
eliastaz 2y ago
Allow me to add some context. The idea behind "proving" computation relies on the assumption that someone wants to verify it. Some systems require verification. Most notably: distributed systems that don't rely on a centralized authority to enforce rules. Historically, you either don't verify compute: you don't verify that AWS runs correctly code on the cloud, nor do you verify the algorithm used to compute your taxes. Or you verify compute via re-execution (to make sure a program ran correctly, just run it locally on given inputs): e.g. every participant in the Bitcoin protocol re-executes all transactions on the network. This means that all payments on this platform are verified by peer-to-peer nodes. Moreover, anyone who desires to convince themselves that the system runs with integrity can simply boot a node and join the network. This adds robust security characteristics! Nonetheless, this creates great friction as every time a transaction is verified on these distributed systems, it is re-executed. This does not scale. Enters "ZK" (zero-knowledge), a technology able to grant verifiability to computation that does not rely on re-execution but rather checking a succinct certificate of correct computation. Anything that refers to succinct proofs of computation is currently referred to as ZK. Nonetheless, ZK can grant either Scalability or Privacy. It is usually known to refer to privacy. ZK-VMs are mostly used to achieve scalability. The disruptive advantage of ZK is the separation of two actors: Prover and Verifier. The prover runs a computation once and generates a proof that it did so with integrity (following some pre-defined rules such as "i can't create new money"). Verifiers are then able to check the integrity of the network with overwhelmingly low hardware requirements. TL;DR: ZK compresses compute. The first use case for ZK (in terms of scalability) is to prove Blockchain transactions to greatly increase scalability of blockchains. Many use cases will follow.
1234890 2y ago
[dead]
1234890 2y ago
[dead]
deptyrao 2y ago
[dead]

81 points by plastic3169 2y ago

jrmg 2y ago

Can someone explain this in lay-person’s terms? I feel like I read and ‘understood’ the text of the blog post, but I’m still none the wiser about what sort of things this can prove and what the values of those proofs is.

Avi-D-coder 2y ago
Think of zk proofs as an extension of asymmetric cryptography to arbitrary logic. A zkVM makes encoding the arbitrary logic as easy as writing a normal Rust program. A proof is a probabilistic statement that a specific program run with some public inputs and maybe some private inputs was executed correctly. For crypto zk proofs are mostly for their succinctness property, not for privacy. Outside of crypto privacy is the more important property, let's say a government issues a signed document, I could prove any arbitrary statement about that document without revealing the document. We could use zk proofs for anything we use canonical documents for today and we would gain privacy. Will we do this, probably not, but it would be an improvement.
knazarov 2y ago
I'm not involved in the project in any way, but I can probably give an explanation. This is a risc-v virtual machine that supports rv32im instruction set (the bare minimum + multiplication). You can compile and run programs there as you would on a usual microcontroller. The "ZK" thing means that you can pass program code + data to this virtual machine, and as a result of execution get some output and a short sequence of bytes that allow the "other side" to verify that the result of program execution is correct without having to re-execute the program. This verification is computationally cheap. In order to do the verification the "other side" only needs that sequence of bytes and a hash of original code+data. Blockchains use this in context of achieving "byzantine consensus", especially in cases where multiple systems that lack mutual trust are involved. Think for example about if you want to relay information that's been computed on one blockchain to the other. If both blockchains can prove their state transitions with such virtual machine, then it is possible to make a sort of trusted "event queue" between them. There are of course caveats that rollbacks can happen, so it's not a silver bullet. Not sure how this applies to day-to-day software, but the thing that comes to mind is that it could serve some cases where TPM (hardware modules) are traditionally utilized. The TPM assumes you don't have means to break the hardware, and so it can attest to certain computation by signing the result with a baked-in key.
- warkdarrior 2y ago
  How secure is this "ZK" thing? Can I use it for DRM? Trusted hardware is a pain to use.
  - knazarov 2y ago
    Let's put it this way. If you can break it and are willing to commit crime - you can earn a lot of money. I'm personally not equipped to judge the level of security, because I'm not a cryptography researcher. What I understand is that the overall ZK cryptography space has been around for a long time, and basic properties are well researched. I tried to read the PLONK paper for entertainment purposes and it's quite easy to understand. If you want to prove a program, you need to convert it to what is called "arithmetic circuits". This is a clever way of saying "a system of polynomial equations". It is as if you're converting the code to logic gates but instead here you use arithmetic: addition, raising to a certain power, etc. It is a process called "arithmetization". The proof calculation involves folding this system of equations in various ways and collecting a "witness". Not sure if I'm explaining this correctly, but it's probably in the right direction at least. The problem with all ZK proofs is that the last bit of calculating the witness is very computationally expensive. What takes milliseconds to run on the CPU can take many hours to prove. And a lot of research is focused on clever mathematical tricks that allow to speed up the proofs while keeping the risks of circuit compromise low enough. As you may guess, the more bleeding edge the research the less it is peer-reviewed. So I'd say that "it depends". As for DRM - probably not. At least not in a way that companies installing the DRM would want it to work. They likely want you to be unable to decrypt something at all outside of a particular chip, and watermark the video on top of that to be sure that you're not screen-capturing it. UPD: there's a decent free into course into modern ZK cryptography: https://zkiap.com/ https://zkiap.com/
    - DennisP 2y ago
      Proving performance is improving at a rapid pace though, like 10X/year. And converting to circuits is automatic now; there are compilers that can do it for arbitrary Rust code.
  - 2y ago
DennisP 2y ago
One simple application is making blockchains vastly more scalable. For a blockchain to be secure you have to store each transaction on chain, with enough information so everyone can verify that it's valid. Normally this means storing the sender's signature, which is bulky. With ZK, you can bundle up thousands of transactions, skip all the signatures, and include a single 256-bit proof that all the transactions had valid signatures.

Philpax 2y ago

Not as inscrutable as these things usually are, but I still don't really know what one would use this for. This world feels like a parallel ecosystem to traditional software, and the paths rarely meet.

latchkey 2y ago
When people are working on things like this where I don't understand what it is used for, I tend to run towards it and find out as much as I can. It is easy enough to just google zk usecase and find all sorts of various applications. None may apply to _you_, but that doesn't mean it is not meaningful for _others_.
matthewdgreen 2y ago
1. Imagine a situation where someone must run a (publicly-known) program on your behalf, and produce an output. But you don't fully trust them to compute that output correctly. This problem crops up in all sorts of applications, from blockchains to cloud computing. 2. Of course there is a simple solution to this problem. You (as a recipient of the output) could simply ask for the inputs, including any random numbers used, and re-compute the program yourself. But there are cases where this doesn't make sense: a. If the inputs to the program are secret (for example, the computing party is running a statistical calculation on some confidential data), then this won't be possible. b. If many, many people have to verify the output is correct, then re-running the calculation millions of times might add up to a huge amount of extra computation. To deal with this, systems like this (zkVMs) allow you to solve problem #1 by producing a short "proof" that the program was run successfully on a virtualized processor, and that the output is the result of that computation. Anyone who has a copy of the program code can efficiently verify that proof in much less time than it would take to re-run the program. As a benefit, it's possible to keep (some of) the program inputs secret -- so the verifier just learns that the program was run on some input, but does not need to learn the raw inputs. The challenge here is that these VM "processors" run at speeds in the KHz if you're very lucky, rather than the GHz we're used to on real processors. So in order for this to be worthwhile you need to be willing to accept a (for example) 1-million-fold slowdown in calculating speed for the person doing the proving. For applications that satisfy 2(a) and 2(b) above, this still might be worthwhile! Currently most of the practical applications are in blockchains: in that setting you have one person making a transaction, and then the whole world (literally millions of people) need to know that the transaction was executed successfully, e.g., that it updated an account ledger correctly and didn't steal money from an unrelated account. So far zkVM proofs have fewer applications outside of that setting.

zb3 2y ago

Is this useful outside the cryptocurrency crap?

Avi-D-coder 2y ago
Yes, it could replace all government ids, while allowing you to prove arbitrary statements about said signed government documents without revealing them (not saying it will happen).
- perching_aix 2y ago
  Wouldn't those "documents" need to be code for that to happen?
  - Avi-D-coder 2y ago
    Those documents would need to be cryptographically signed machine readable data, json, a pdf (difficult). Getting governments, banks, and other trusted third parties to sign documents is very difficult, but is happening in some cases.
  - latchkey 2y ago
    Let's say the usecase is to prove that you're 21+ to enter a bar in the US. I don't want to have to hand over my ID with my personal information on it. On my phone, I could have the "proof", which can be validated by the door guard with a simple NFC device (ie: another phone) that is compatible with that proof.
    - notfed 2y ago
      I really doubt any cryptographic primitive can solve this; what's stopping me from lending my "proof" to my little brother?
      - plastic3169 2y ago
        If you have digital id signed with government keys (like passport) you would prove that person has ID where the age is above 18, attached to this photo and that all the info comes from a single government sanctioned id. You don’t need to conceal all the data. Just the bits you don’t want to leak.

anon3459 2y ago

So i could write some complex logic with nested for loops and ofload it to the coprocessor

jeff_carr 2y ago

L. Ron Hubbard has entered the chat.

ikiris 2y ago

If its not obvious what a zKVM is, it shouldn't be unexplained in a headline with no commmentary. edit: The fact that its actually zkVM instead is even more confusing.

plastic3169 2y ago
I wasn’t sure if adding text is considered good form when submitting a link to a project I’m not part of. I followed the guidelines and did not editorialize the title. Surprisingly, ‘zkVM’ is a unique acronym, and search only returned relevant results.

raykyri 2y ago

For those looking for applications outside crypto, this might also be interesting: https://docs.ezkl.xyz/ https://docs.ezkl.xyz/ It's similar to Succinct but for proofs of ML models instead of RISCV. So you could generate a proof on some private data, on your computer or in a trusted environment, and submit the proof to show that you pass a fraud check without revealing any of your data.

wslh 2y ago

I cofounded a company doing also this [1] you can check the repositories [2]. [1] https://bitvmx.org https://bitvmx.org [2] https://github.com/FairgateLabs https://github.com/FairgateLabs

quesomaster9000 2y ago
While it's commendable that you're trying to extend BitVM to handle RISC-V... Why though? The dispute resolution game is eminently trollable and can be made very expensive by an adversary. Then you try to make it N-party, which reduces all of the security assumptions down to one which isn't verifiable on-chain and doesn't inherit any of Bitcoin's security. Yes, technically it's possible, should it be done? Probably not... Would I trust it? No... Does it come anywhere near the security of SP1... Absolutely not.
- wslh 2y ago
  The point is that... we were able to reduce price for arbitration doing a lot of research.
Jommi 2y ago
that is not a legit company this is the only legit effort to use Bitcoin to verify ZKPs https://bitvm.org/ https://bitvm.org/

jedisct1 2y ago

"verifies the execution of [..] any LLVM-compiled language" Why is it limited to LLVM-compiled languages? Wouldn't anything that compiles to RISC-V work? And since the LLVM bitcode format completely changes every time there's a new LLVM release, how does that work?

eliastaz 2y ago

Allow me to add some context. The idea behind "proving" computation relies on the assumption that someone wants to verify it. Some systems require verification. Most notably: distributed systems that don't rely on a centralized authority to enforce rules. Historically, you either don't verify compute: you don't verify that AWS runs correctly code on the cloud, nor do you verify the algorithm used to compute your taxes. Or you verify compute via re-execution (to make sure a program ran correctly, just run it locally on given inputs): e.g. every participant in the Bitcoin protocol re-executes all transactions on the network. This means that all payments on this platform are verified by peer-to-peer nodes. Moreover, anyone who desires to convince themselves that the system runs with integrity can simply boot a node and join the network. This adds robust security characteristics! Nonetheless, this creates great friction as every time a transaction is verified on these distributed systems, it is re-executed. This does not scale. Enters "ZK" (zero-knowledge), a technology able to grant verifiability to computation that does not rely on re-execution but rather checking a succinct certificate of correct computation. Anything that refers to succinct proofs of computation is currently referred to as ZK. Nonetheless, ZK can grant either Scalability or Privacy. It is usually known to refer to privacy. ZK-VMs are mostly used to achieve scalability. The disruptive advantage of ZK is the separation of two actors: Prover and Verifier. The prover runs a computation once and generates a proof that it did so with integrity (following some pre-defined rules such as "i can't create new money"). Verifiers are then able to check the integrity of the network with overwhelmingly low hardware requirements. TL;DR: ZK compresses compute. The first use case for ZK (in terms of scalability) is to prove Blockchain transactions to greatly increase scalability of blockchains. Many use cases will follow.

1234890 2y ago

[dead]

1234890 2y ago

[dead]

deptyrao 2y ago

[dead]