4 ms·

Can someone explain this in lay-person’s terms? I feel like I read and ‘understood’ the text of the blog post, but I’m still none the wiser about what sort of

by jrmg 2y ago

Can someone explain this in lay-person’s terms? I feel like I read and ‘understood’ the text of the blog post, but I’m still none the wiser about what sort of things this can prove and what the values of those proofs is.

Avi-D-coder 2y ago
Think of zk proofs as an extension of asymmetric cryptography to arbitrary logic. A zkVM makes encoding the arbitrary logic as easy as writing a normal Rust program. A proof is a probabilistic statement that a specific program run with some public inputs and maybe some private inputs was executed correctly. For crypto zk proofs are mostly for their succinctness property, not for privacy. Outside of crypto privacy is the more important property, let's say a government issues a signed document, I could prove any arbitrary statement about that document without revealing the document. We could use zk proofs for anything we use canonical documents for today and we would gain privacy. Will we do this, probably not, but it would be an improvement.
knazarov 2y ago
I'm not involved in the project in any way, but I can probably give an explanation. This is a risc-v virtual machine that supports rv32im instruction set (the bare minimum + multiplication). You can compile and run programs there as you would on a usual microcontroller. The "ZK" thing means that you can pass program code + data to this virtual machine, and as a result of execution get some output and a short sequence of bytes that allow the "other side" to verify that the result of program execution is correct without having to re-execute the program. This verification is computationally cheap. In order to do the verification the "other side" only needs that sequence of bytes and a hash of original code+data. Blockchains use this in context of achieving "byzantine consensus", especially in cases where multiple systems that lack mutual trust are involved. Think for example about if you want to relay information that's been computed on one blockchain to the other. If both blockchains can prove their state transitions with such virtual machine, then it is possible to make a sort of trusted "event queue" between them. There are of course caveats that rollbacks can happen, so it's not a silver bullet. Not sure how this applies to day-to-day software, but the thing that comes to mind is that it could serve some cases where TPM (hardware modules) are traditionally utilized. The TPM assumes you don't have means to break the hardware, and so it can attest to certain computation by signing the result with a baked-in key.
- warkdarrior 2y ago
  How secure is this "ZK" thing? Can I use it for DRM? Trusted hardware is a pain to use.
  - knazarov 2y ago
    Let's put it this way. If you can break it and are willing to commit crime - you can earn a lot of money. I'm personally not equipped to judge the level of security, because I'm not a cryptography researcher. What I understand is that the overall ZK cryptography space has been around for a long time, and basic properties are well researched. I tried to read the PLONK paper for entertainment purposes and it's quite easy to understand. If you want to prove a program, you need to convert it to what is called "arithmetic circuits". This is a clever way of saying "a system of polynomial equations". It is as if you're converting the code to logic gates but instead here you use arithmetic: addition, raising to a certain power, etc. It is a process called "arithmetization". The proof calculation involves folding this system of equations in various ways and collecting a "witness". Not sure if I'm explaining this correctly, but it's probably in the right direction at least. The problem with all ZK proofs is that the last bit of calculating the witness is very computationally expensive. What takes milliseconds to run on the CPU can take many hours to prove. And a lot of research is focused on clever mathematical tricks that allow to speed up the proofs while keeping the risks of circuit compromise low enough. As you may guess, the more bleeding edge the research the less it is peer-reviewed. So I'd say that "it depends". As for DRM - probably not. At least not in a way that companies installing the DRM would want it to work. They likely want you to be unable to decrypt something at all outside of a particular chip, and watermark the video on top of that to be sure that you're not screen-capturing it. UPD: there's a decent free into course into modern ZK cryptography: https://zkiap.com/ https://zkiap.com/
    - DennisP 2y ago
      Proving performance is improving at a rapid pace though, like 10X/year. And converting to circuits is automatic now; there are compilers that can do it for arbitrary Rust code.
  - 2y ago
DennisP 2y ago
One simple application is making blockchains vastly more scalable. For a blockchain to be secure you have to store each transaction on chain, with enough information so everyone can verify that it's valid. Normally this means storing the sender's signature, which is bulky. With ZK, you can bundle up thousands of transactions, skip all the signatures, and include a single 256-bit proof that all the transactions had valid signatures.

by jrmg 2y ago

Avi-D-coder 2y ago

Think of zk proofs as an extension of asymmetric cryptography to arbitrary logic. A zkVM makes encoding the arbitrary logic as easy as writing a normal Rust program. A proof is a probabilistic statement that a specific program run with some public inputs and maybe some private inputs was executed correctly. For crypto zk proofs are mostly for their succinctness property, not for privacy. Outside of crypto privacy is the more important property, let's say a government issues a signed document, I could prove any arbitrary statement about that document without revealing the document. We could use zk proofs for anything we use canonical documents for today and we would gain privacy. Will we do this, probably not, but it would be an improvement.

knazarov 2y ago

I'm not involved in the project in any way, but I can probably give an explanation. This is a risc-v virtual machine that supports rv32im instruction set (the bare minimum + multiplication). You can compile and run programs there as you would on a usual microcontroller. The "ZK" thing means that you can pass program code + data to this virtual machine, and as a result of execution get some output and a short sequence of bytes that allow the "other side" to verify that the result of program execution is correct without having to re-execute the program. This verification is computationally cheap. In order to do the verification the "other side" only needs that sequence of bytes and a hash of original code+data. Blockchains use this in context of achieving "byzantine consensus", especially in cases where multiple systems that lack mutual trust are involved. Think for example about if you want to relay information that's been computed on one blockchain to the other. If both blockchains can prove their state transitions with such virtual machine, then it is possible to make a sort of trusted "event queue" between them. There are of course caveats that rollbacks can happen, so it's not a silver bullet. Not sure how this applies to day-to-day software, but the thing that comes to mind is that it could serve some cases where TPM (hardware modules) are traditionally utilized. The TPM assumes you don't have means to break the hardware, and so it can attest to certain computation by signing the result with a baked-in key.

warkdarrior 2y ago
How secure is this "ZK" thing? Can I use it for DRM? Trusted hardware is a pain to use.
- knazarov 2y ago
  Let's put it this way. If you can break it and are willing to commit crime - you can earn a lot of money. I'm personally not equipped to judge the level of security, because I'm not a cryptography researcher. What I understand is that the overall ZK cryptography space has been around for a long time, and basic properties are well researched. I tried to read the PLONK paper for entertainment purposes and it's quite easy to understand. If you want to prove a program, you need to convert it to what is called "arithmetic circuits". This is a clever way of saying "a system of polynomial equations". It is as if you're converting the code to logic gates but instead here you use arithmetic: addition, raising to a certain power, etc. It is a process called "arithmetization". The proof calculation involves folding this system of equations in various ways and collecting a "witness". Not sure if I'm explaining this correctly, but it's probably in the right direction at least. The problem with all ZK proofs is that the last bit of calculating the witness is very computationally expensive. What takes milliseconds to run on the CPU can take many hours to prove. And a lot of research is focused on clever mathematical tricks that allow to speed up the proofs while keeping the risks of circuit compromise low enough. As you may guess, the more bleeding edge the research the less it is peer-reviewed. So I'd say that "it depends". As for DRM - probably not. At least not in a way that companies installing the DRM would want it to work. They likely want you to be unable to decrypt something at all outside of a particular chip, and watermark the video on top of that to be sure that you're not screen-capturing it. UPD: there's a decent free into course into modern ZK cryptography: https://zkiap.com/ https://zkiap.com/
  - DennisP 2y ago
    Proving performance is improving at a rapid pace though, like 10X/year. And converting to circuits is automatic now; there are compilers that can do it for arbitrary Rust code.
- 2y ago

DennisP 2y ago

One simple application is making blockchains vastly more scalable. For a blockchain to be secure you have to store each transaction on chain, with enough information so everyone can verify that it's valid. Normally this means storing the sender's signature, which is bulky. With ZK, you can bundle up thousands of transactions, skip all the signatures, and include a single 256-bit proof that all the transactions had valid signatures.