Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Dark Side of Zero Knowledge: Masking the initial setup in Zk-SNARK

blog.smartdec.net

Post reply on HN
Print view View original

21–30 of 30 posts

Re: The Dark Side of Zero Knowledge: Masking the initial setup in Zk-SNARK

#21

Post by ewillbefull »

hendi_ wrote: post #8
cjbprime wrote: post #4

It looks like there's nothing new here, making the title clickbait-y. One of the first things anyone learns about Zcash is that there was a trusted ceremony.

Wrong. "One of the first things anyone learns about Zcash" is that at least one of the ceremony's participants must be trusted to have securely destroyed his toxic waste. This article is about the fact that there could be a backdoor, whose absence can only be proven by revealing all participants' toxic waste. You'll note that these two things are at odds with each other.

There is nothing new about this article. The article is pointing out that in addition to the trapdoors of the proving system, it's possible to subvert the arithmetic circuit used as well. The ceremonies used by Zcash have the property that the parameters are perfectly bound to the circuit.

Not sure why this isn't mentioned in the article.

> This article is about the fact that there could be a backdoor, whose absence can only be proven by revealing all participants' toxic waste.

This is incorrect, as stated above. Instead of revealing their toxic waste, we reveal proofs-of-knowledge so we can use pairings to ensure the parameters encode the circuit correctly.

Re: The Dark Side of Zero Knowledge: Masking the initial setup in Zk-SNARK

#22

Post by spacewrangler »

nosuchthing wrote: post #16
sschueller wrote: post #12

Does this apply to monero as well?

Monero's backdoor was the development team releasing a severely weakened version of the mining app during the phase where 25% of the supply was minted, along with a production curve that released 80% of the supply in less than half the time of Bitcoins minting production time. https://old.reddit.com/r/MoneroMining/comments/6fixnr/monero...

This is false.

Re: The Dark Side of Zero Knowledge: Masking the initial setup in Zk-SNARK

#23

Post by hendi_ »

ewillbefull wrote: post #21
hendi_ wrote: post #8

Earlier quoted context omitted.

Wrong. "One of the first things anyone learns about Zcash" is that at least one of the ceremony's participants must be trusted to have securely destroyed his toxic waste. This article is about the fact that there could be a backdoor, whose absence can only be proven by revealing all participants' toxic waste. You'll note that these two things are at odds with each other.

There is nothing new about this article. The article is pointing out that in addition to the trapdoors of the proving system, it's possible to subvert the arithmetic circuit used as well. The ceremonies used by Zcash have the property that the parameters are perfectly bound to the circuit. Not sure why this isn't mentioned in the article. > This article is about the fact that there could be a backdoor, whose absence…

I stand corrected. Thank you for the clarification!

I still learned something "new" from the article, I was only aware of the ceremony issue that "everbody knows" of.

Re: The Dark Side of Zero Knowledge: Masking the initial setup in Zk-SNARK

#25

Post by [deleted] »

segfaultbuserr wrote: post #2

Zcash knew the problem of backdoor-able initial setup, they understood that it can raise serious doubts on the trustworthiness of their system, they even named the initial key material for setup as "cryptographic toxic waste". As an attempt to bring confidence to the setup ceremony, Zcash used a multiparty setup of 6 people, and invited prominent developers of the cryptocurrency community to participate. The setup wa…

[deleted]

Re: The Dark Side of Zero Knowledge: Masking the initial setup in Zk-SNARK

#26

Post by ewillbefull »

hendi_ wrote: post #23
ewillbefull wrote: post #21

Earlier quoted context omitted.

There is nothing new about this article. The article is pointing out that in addition to the trapdoors of the proving system, it's possible to subvert the arithmetic circuit used as well. The ceremonies used by Zcash have the property that the parameters are perfectly bound to the circuit. Not sure why this isn't mentioned in the article. > This article is about the fact that there could be a backdoor, whose absence…

I stand corrected. Thank you for the clarification! I still learned something "new" from the article, I was only aware of the ceremony issue that "everbody knows" of.

That's great! There are many issues with trusted setups that people aren't paying enough attention to.

Re: The Dark Side of Zero Knowledge: Masking the initial setup in Zk-SNARK

#27

Post by petertodd »

socrates1024 wrote: post #10
segfaultbuserr wrote: post #2

Zcash knew the problem of backdoor-able initial setup, they understood that it can raise serious doubts on the trustworthiness of their system, they even named the initial key material for setup as "cryptographic toxic waste". As an attempt to bring confidence to the setup ceremony, Zcash used a multiparty setup of 6 people, and invited prominent developers of the cryptocurrency community to participate. The setup wa…

Note that the technical problems made it more complicated and messy to reproduce the build, but didn't outright prevent it. Mainly the executable binaries were reproducible, but other metadata in the disk image changed each time. https://github.com/zcash/mpc/issues/2

As you know, my complaints with regard to the reproducible build were not that the scripts themselves didn't work - indeed I fixed an issue related to that - but that the direct dependencies of the build were both high entropy (e.g. very specific nightly builds of a niche Linux distribution) and themselves not at all reproducible.

Your reply here is highly misleading, even lying by omission.

Re: The Dark Side of Zero Knowledge: Masking the initial setup in Zk-SNARK

#28

Post by shpx »

g45y45 wrote: post #20
nosuchthing wrote: post #16

Earlier quoted context omitted.

Monero's backdoor was the development team releasing a severely weakened version of the mining app during the phase where 25% of the supply was minted, along with a production curve that released 80% of the supply in less than half the time of Bitcoins minting production time. https://old.reddit.com/r/MoneroMining/comments/6fixnr/monero...

That was bytecoin, not Monero. Monero is a code fork of Bytecoin. Bytecoin is considered a scam. Monero was a fair launch with no backdoors.

> I woke up on May 28th, 2014 [one month after Monero launched], on vacation with my family in the middle of the desert, to find a copy of my private source code plastered across the bitcointalk message board. Announced as a "new optimized version" of the Monero currency miner, it was enthusiastically adopted by cryptocurrency miners across the world. And in the process of doing so, my daily profit from the Monero Mining Project dropped by over five thousand dollars per day.

...

> [Monero] was a fork of Bytecoin designed to not have the 80% premine. But its initial developer either didn't know, didn't care, or wanted to profit from the de-optimized hashing. That initial developer was pretty quickly given the boot by the community, and in came an unrelated group of developers who took it over---who were, as far as I can tell, completely unaware of the deoptimization. So things sat there for a few weeks in the same state as Bytecoin.

...

> This was a brilliantly designed proof-of-work function targeting the strengths of modern CPUs -- native AES encryption and fast 64 bit multipliers -- tuned to use a scratchpad exactly the size of the per-core L3 cache on Intel CPUs (about 2MB) that someone then wrapped in such a thick blanket of crap it was nearly unrecognizable until you started jumping in, tearing it apart, and putting it back together again.

https://da-data.blogspot.com/2014/08/minting-money-with-mone...

Re: The Dark Side of Zero Knowledge: Masking the initial setup in Zk-SNARK

#29

Post by _Drygin »

ewillbefull wrote: post #21
hendi_ wrote: post #8

Earlier quoted context omitted.

Wrong. "One of the first things anyone learns about Zcash" is that at least one of the ceremony's participants must be trusted to have securely destroyed his toxic waste. This article is about the fact that there could be a backdoor, whose absence can only be proven by revealing all participants' toxic waste. You'll note that these two things are at odds with each other.

There is nothing new about this article. The article is pointing out that in addition to the trapdoors of the proving system, it's possible to subvert the arithmetic circuit used as well. The ceremonies used by Zcash have the property that the parameters are perfectly bound to the circuit. Not sure why this isn't mentioned in the article. > This article is about the fact that there could be a backdoor, whose absence…

You're right, I removed misleading information from the article. Thank you for your comment.

Re: The Dark Side of Zero Knowledge: Masking the initial setup in Zk-SNARK

#30

Post by _Drygin »

matthewdgreen wrote: post #19
hendi_ wrote: post #8

Earlier quoted context omitted.

Wrong. "One of the first things anyone learns about Zcash" is that at least one of the ceremony's participants must be trusted to have securely destroyed his toxic waste. This article is about the fact that there could be a backdoor, whose absence can only be proven by revealing all participants' toxic waste. You'll note that these two things are at odds with each other.

I don’t think that’s true. The article seems to be saying that you can sneak a backdoor into the circuit. You can also verify that the parameters implement the circuit, and you don’t need the toxic waste to do that.

Thank you for your comment. Unfortunately I made a mistake. I have removed misleading information from the article.
Post reply on HN