The Dark Side of Zero Knowledge: Masking the initial setup in Zk-SNARK
1–10 of 30 posts
Re: The Dark Side of Zero Knowledge: Masking the initial setup in Zk-SNARK
#2Zcash knew the problem of backdoor-able initial setup, they understood that it can raise serious doubts on the trustworthiness of their system, they even named the initial key material for setup as "cryptographic toxic waste". As an attempt to bring confidence to the setup ceremony, Zcash used a multiparty setup of 6 people, and invited prominent developers of the cryptocurrency community to participate. The setup was performed at each person's own undisclosed geolocation, and coordinated online. The rough idea was, if at least one participant during the setup was honest, properly destructed the secret, and wasn't hacked, the setup will be secure.
The prominent Bitcoin developer, Peter Todd was invited to participate, too. You can read his entertaining blogpost about the setup procedure at here.
https://web.archive.org/web/20161114214233/https://petertodd...
The funny and alarming story is, after he finished the setup, he became increasingly suspicious about the security of the procedures, especially casted doubts on some technical problems that prevented reproducible build (!!!) of the setup programs. And he later had withdrawn his blogpost and all the claims of security altogether. To me, it's alarming, in the end, we'll never get solid security guarantees.
Re: The Dark Side of Zero Knowledge: Masking the initial setup in Zk-SNARK
#3Zcash knew the problem of backdoor-able initial setup, they understood that it can raise serious doubts on the trustworthiness of their system, they even named the initial key material for setup as "cryptographic toxic waste". As an attempt to bring confidence to the setup ceremony, Zcash used a multiparty setup of 6 people, and invited prominent developers of the cryptocurrency community to participate. The setup wa…
Check out this podcast about the Zcash ceremony: https://www.wnycstudios.org/story/ceremony
Re: The Dark Side of Zero Knowledge: Masking the initial setup in Zk-SNARK
#4It looks like there's nothing new here, making the title clickbait-y. One of the first things anyone learns about Zcash is that there was a trusted ceremony.
Re: The Dark Side of Zero Knowledge: Masking the initial setup in Zk-SNARK
#5As the article states, but is a confusing in the title, this isn't a problem with all Zero Knowledge Protocols (ZKP) but is a problem with a specific ZKP, namely zk-Snarks.
You can do ZKPs without a trusted setup, they are less performant than zk-Snarks. It seems likely that in the next few years these performance problems will be overcome. Most people I've talked to in the field are very confident that protocols like zk-snarks can be done without trusted setup.
Re: The Dark Side of Zero Knowledge: Masking the initial setup in Zk-SNARK
#6As the article states, but is a confusing in the title, this isn't a problem with all Zero Knowledge Protocols (ZKP) but is a problem with a specific ZKP, namely zk-Snarks. You can do ZKPs without a trusted setup, they are less performant than zk-Snarks. It seems likely that in the next few years these performance problems will be overcome. Most people I've talked to in the field are very confident that protocols lik…
ZK-Starks already do this.
https://medium.com/coinmonks/zk-starks-create-verifiable-tru...
Re: The Dark Side of Zero Knowledge: Masking the initial setup in Zk-SNARK
#7It looks like there's nothing new here, making the title clickbait-y. One of the first things anyone learns about Zcash is that there was a trusted ceremony.
This is an attempt to explain the details of the trusted ceremony, why it was needed, and what is being trusted.
I like that it describes two different levels of trust required — trust in both the destruction of the initial secrets and in the original formulation of the problem. Were both levels of trust established, in the case of ZCash?
Re: The Dark Side of Zero Knowledge: Masking the initial setup in Zk-SNARK
#8It looks like there's nothing new here, making the title clickbait-y. One of the first things anyone learns about Zcash is that there was a trusted ceremony.
Wrong.
"One of the first things anyone learns about Zcash" is that at least one of the ceremony's participants must be trusted to have securely destroyed his toxic waste.
This article is about the fact that there could be a backdoor, whose absence can only be proven by revealing all participants' toxic waste.
You'll note that these two things are at odds with each other.
Re: The Dark Side of Zero Knowledge: Masking the initial setup in Zk-SNARK
#9Zcash knew the problem of backdoor-able initial setup, they understood that it can raise serious doubts on the trustworthiness of their system, they even named the initial key material for setup as "cryptographic toxic waste". As an attempt to bring confidence to the setup ceremony, Zcash used a multiparty setup of 6 people, and invited prominent developers of the cryptocurrency community to participate. The setup wa…
Check out this podcast about the Zcash ceremony: https://www.wnycstudios.org/story/ceremony
Peter is a man child looking for controversy.
Re: The Dark Side of Zero Knowledge: Masking the initial setup in Zk-SNARK
#10Zcash knew the problem of backdoor-able initial setup, they understood that it can raise serious doubts on the trustworthiness of their system, they even named the initial key material for setup as "cryptographic toxic waste". As an attempt to bring confidence to the setup ceremony, Zcash used a multiparty setup of 6 people, and invited prominent developers of the cryptocurrency community to participate. The setup wa…
Note that the technical problems made it more complicated and messy to reproduce the build, but didn't outright prevent it. Mainly the executable binaries were reproducible, but other metadata in the disk image changed each time. https://github.com/zcash/mpc/issues/2