Gorilla CRM | Das einzige CRM, das alle Tools vereint http://bit.ly/2AG8IN4
The Dark Side of Zero Knowledge: Masking the initial setup in Zk-SNARK
11–20 of 30 posts
Re: The Dark Side of Zero Knowledge: Masking the initial setup in Zk-SNARK
#12Does this apply to monero as well?
Re: The Dark Side of Zero Knowledge: Masking the initial setup in Zk-SNARK
#13Does this apply to monero as well?
No. Monero uses RingCT for transaction privacy. RingCT employs Borromean ring signatures, Pedersen Commitments and Bulletproofs (for range proofs). It does not use the zkSNARK construction. The Bulletproof (and the Pedersen Commitments) can be seen as another zero knowledge proof system.
Re: The Dark Side of Zero Knowledge: Masking the initial setup in Zk-SNARK
#14Does this apply to monero as well?
I don't know that Monero uses ZK-SNARKS for anything, do they? Don't they solve their similar problem with ring signatures?
Re: The Dark Side of Zero Knowledge: Masking the initial setup in Zk-SNARK
#15This discusses a weakness with all zero knowledge proofs which require a trusted setup.
Zero knowledge proofs which don’t require a trusted setup include BCCCGP[1], Bullet Proofs[2], ZKBOO++[3], Ligero[4], Hyrax[5], ZK-STARKs[6], and Aurora[7].
[1]https://eprint.iacr.org/2016/263.pdf
[2]https://eprint.iacr.org/2017/1066.pdf
[3] https://eprint.iacr.org/2017/279.pdf
[4] https://acmccs.github.io/papers/p2087-amesA.pdf
[5] https://eprint.iacr.org/2017/1132.pdf
[6] https://eprint.iacr.org/2018/046.pdf
[7] https://eprint.iacr.org/2018/828.pdf
To clear up confusion in the comments, the new ZCash release, sappling, used a trusted setup with 87 people up from the original six[8].
Re: The Dark Side of Zero Knowledge: Masking the initial setup in Zk-SNARK
#16Does this apply to monero as well?
Monero's backdoor was the development team releasing a severely weakened version of the mining app during the phase where 25% of the supply was minted, along with a production curve that released 80% of the supply in less than half the time of Bitcoins minting production time.
https://old.reddit.com/r/MoneroMining/comments/6fixnr/monero...
Re: The Dark Side of Zero Knowledge: Masking the initial setup in Zk-SNARK
#17Zcash knew the problem of backdoor-able initial setup, they understood that it can raise serious doubts on the trustworthiness of their system, they even named the initial key material for setup as "cryptographic toxic waste". As an attempt to bring confidence to the setup ceremony, Zcash used a multiparty setup of 6 people, and invited prominent developers of the cryptocurrency community to participate. The setup wa…
> Zcash used a multiparty setup of 6 people
That's true of the original (Sprout) SNARK, but the newer (Sapling) SNARK used a much more scalable MPC ceremony, which they called Powers of Tau: https://z.cash.foundation/blog/powers-of-tau/
There was a public call for participation at the time, so if you wanted to be sure that the ceremony was not corrupted, you could just participate yourself.
For backwards compatibility, the Sprout SNARK can still be used, so if the original ceremony was compromised, an attacker could still create coins "out of thin air". But converting a Sprout account to a Sapling account requires making the amount public, so if the number of coins converted exceeded the intended currency supply, that would be detected. Worst case scenario, a hard fork could be arranged to disable the Sprout SNARK.
Re: The Dark Side of Zero Knowledge: Masking the initial setup in Zk-SNARK
#18Zcash knew the problem of backdoor-able initial setup, they understood that it can raise serious doubts on the trustworthiness of their system, they even named the initial key material for setup as "cryptographic toxic waste". As an attempt to bring confidence to the setup ceremony, Zcash used a multiparty setup of 6 people, and invited prominent developers of the cryptocurrency community to participate. The setup wa…
> Zcash used a multiparty setup of 6 people That's true of the original (Sprout) SNARK, but the newer (Sapling) SNARK used a much more scalable MPC ceremony, which they called Powers of Tau: https://z.cash.foundation/blog/powers-of-tau/ There was a public call for participation at the time, so if you wanted to be sure that the ceremony was not corrupted, you could just participate yourself. For backwards compatibilit…
The original Sprout SNARK has been disabled and replaced with a new implementation based on the powers of tao ceremony. You can still spend Sprout coins, but not with the old parameters.
Re: The Dark Side of Zero Knowledge: Masking the initial setup in Zk-SNARK
#19It looks like there's nothing new here, making the title clickbait-y. One of the first things anyone learns about Zcash is that there was a trusted ceremony.
Wrong. "One of the first things anyone learns about Zcash" is that at least one of the ceremony's participants must be trusted to have securely destroyed his toxic waste. This article is about the fact that there could be a backdoor, whose absence can only be proven by revealing all participants' toxic waste. You'll note that these two things are at odds with each other.
I don’t think that’s true. The article seems to be saying that you can sneak a backdoor into the circuit. You can also verify that the parameters implement the circuit, and you don’t need the toxic waste to do that.
Re: The Dark Side of Zero Knowledge: Masking the initial setup in Zk-SNARK
#20Does this apply to monero as well?
Monero's backdoor was the development team releasing a severely weakened version of the mining app during the phase where 25% of the supply was minted, along with a production curve that released 80% of the supply in less than half the time of Bitcoins minting production time. https://old.reddit.com/r/MoneroMining/comments/6fixnr/monero...
That was bytecoin, not Monero. Monero is a code fork of Bytecoin. Bytecoin is considered a scam. Monero was a fair launch with no backdoors.