Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Opening up ‘Zero-Knowledge Proof’ technology

blog.google

Post reply on HN
Print view View original

111–120 of 217 posts

Re: Opening up ‘Zero-Knowledge Proof’ technology

#111

Post by [deleted] »

IshKebab wrote: post #37
MatteoFrigo wrote: post #10

Earlier quoted context omitted.

Author (of the code) here. The context is the US mobile drivers licenses and the forthcoming digital identity documents in the EU. The government gives you an electronic document stored in your device, and now the problem is, why would you ever want to give a copy of your document to a third party. This code solves the problem via zero-knowledge presentations of the document. This is real stuff already integrated in…

How do you prevent kids just obtaining a copy of such electronic document from somewhere? The actual document itself doesn't prove anything about your age; it just proves that you have the document. Is it stored in a TEE or something like that?

[deleted]

Re: Opening up ‘Zero-Knowledge Proof’ technology

#112

Post by cyberax »

0xOsprey wrote: post #95
cyberax wrote: post #12

This might enable something like Scroll (the pay-to-view without ads network, acquired and destroyed by Twitter) but anonymous.

We're building a purpose built self-custodial payment rail using zero knowledge cryptography that could be leveraged for this use case: https://x.com/0x_Osprey/status/1925299005191577921 https://paygo.wtf/ Current benchmarks for proving costs are 33k txns per dollar and we expect this to go down x10-x100 over the coming months/years.

Blockchain => trash

A system that can be trusted needs to work in the real world, with credit card payments, bank accounts, VAT.

Re: Opening up ‘Zero-Knowledge Proof’ technology

#113

Post by deegles »

JanisErdmanis wrote: post #84
bobbiechen wrote: post #29

Anyone have a good explanation on the intuition of non-interactive zero-knowledge proofs? For example, I thought the "paint-mixing" analogy for Diffie-Hellman key exchange ( https://en.wikipedia.org/wiki/Diffie–Hellman_key_exchange#Ge... ) really helped me handwave the math into "mixing easy, unmixing hard". https://blog.cryptographyengineering.com/2014/11/27/zero-kno... was a good intro for interactive ZK proofs but…

An intuitive explanation is that of proving you can find Waldo in a picture without revealing his exact location. Digital wallets can be interpreted as fancy signature schemes that operate on third-party issued commitments C instead of public keys that directly link users to their identities. A simple signature scheme is based on proof of knowledge PoK{x : pk = g^x}, which is transformed into a noninteractive variant…

for explanation i've seen for the where's waldo analogy: imagine the single page of the where's waldo puzzle, and another giant piece of paper with the shape of waldo cut out of it.

by providing a picture of waldo in the cut-out, you can prove you know where he is without providing the location. a zero knowledge proof.

Re: Opening up ‘Zero-Knowledge Proof’ technology

#114

Post by WXLCKNO »

baby wrote: post #107

For people interested in zero-knowledge proofs check https://news.zksecurity.xyz/ which is a hackernews but for ZK!

It's interesting how painful that design is to my eyes compared to the HN home page, I can't say why at a quick glance it's just hard to parse for some reason / doesn't feel good.

Re: Opening up ‘Zero-Knowledge Proof’ technology

#115

Post by Spivak »

api wrote: post #32
rvnx wrote: post #18

Earlier quoted context omitted.

Now take an intentionally extreme opposite (as a thought experiment): if we put death penalty to people who participate in distributing or in relaying such content, could all of that be solved without the “internet pass” and IDing your internet history ?

Adults should be allowed to look at porn. I don't think it's necessarily good for people, but adults are also allowed to binge drink and smoke and eat ultra-processed foods and a lot of other things that are worse for you than porn. CP is an edge case but that's because it's almost impossible to make CP without abusing children and you could view CP as an incitement to violence -- as incitement to abuse children. Par…

Reddit being considered a space for women is the funniest take I've heard in a while. But regardless, you didn't adequately take into account that being choked is one of the top sexual fantasies of women. Whatever explanation you put forth has to also explain why it's also highly desirable to be on the receiving end.

The "porn has been giving men violent sexual fantasies" line has existed since before I was born but it always ignores that they're the top fantasies among women too. Among my friend group the more common refrain is women who want to be choked but their boyfriends are uncomfortable doing it.

Re: Opening up ‘Zero-Knowledge Proof’ technology

#116

Post by MatteoFrigo »

Confiks wrote: post #83
MatteoFrigo wrote: post #67

Earlier quoted context omitted.

On the contrary, any undergraduate can understand our solution. In contrast, I don't know anybody who can explain the bilinear pairing in BBS.

Perhaps "unfathomably" was too strong, but "any undergraduate" is at least very easy to falsify.

Jokes aside, I really believe that once all is said and done our system is way simpler than BBS.

How are you going to check the document expiration date in BBS? Yes I know about range proofs, I know about the quaternion norms and the four prime theorem and all that jazz. But nobody is talking about it.

How are you going to bind to a hardware secure element that only uses NIST primes? Yes, there is a very clever variant called BBS# which I believe works, but that's not simple either.

How are you going to deal with existing standard formats? 80% of our complexity is in this step. BBS most likely cannot do it at all. If we can change the format then a lot of my complexity disappears too.

How are you going to deal with the fact that BBS signs an array and not a set, and thus you are leaking the fact that "family_name" is attribute at array index 42? Are you going to leak the schema (which re-introduces tracking) or are you going to agree in advance, now and forever, on a schema? (Our system hides the schema and works on an arbitrary key/value dictionary, up to a maximum size.)

It's easy to say "simple" when one has not built the real thing.

Re: Opening up ‘Zero-Knowledge Proof’ technology

#117

Post by remram »

tptacek wrote: post #56
bobbiechen wrote: post #29

Anyone have a good explanation on the intuition of non-interactive zero-knowledge proofs? For example, I thought the "paint-mixing" analogy for Diffie-Hellman key exchange ( https://en.wikipedia.org/wiki/Diffie–Hellman_key_exchange#Ge... ) really helped me handwave the math into "mixing easy, unmixing hard". https://blog.cryptographyengineering.com/2014/11/27/zero-kno... was a good intro for interactive ZK proofs but…

If you're looking for something at the level of paint cans, I think you want Matthew Green's "crayons and hats": https://blog.cryptographyengineering.com/2014/11/27/zero-kno...

That's only for interactive proofs though. Like GP I have no problem understanding those.

Re: Opening up ‘Zero-Knowledge Proof’ technology

#118

Post by bobbiechen »

quantumgarbage wrote: post #78
bobbiechen wrote: post #40

Earlier quoted context omitted.

This is an interactive example, isn't it? It doesn't help me understand non-interactive proofs like SNARKs/STARKs, where the verifier isn't communicating live with the prover.

Look for the "Fiat Shamir heuristic" to understand the non interactive part. It basically consists in the prover getting its random challenges from hashing public inputs, rather than from the verifier's coin tosses.

Thank you!!

If I understand correctly:

* The prover commits to a starting value (public input)

* Instead of waiting for an interactive challenge, they hash it and use the resulting hash output as if it were a challenge

If we believe the hash is a random oracle (as we do for cryptographic hash functions), then it is hard for the prover to manipulate the challenges. Is that it?

Re: Opening up ‘Zero-Knowledge Proof’ technology

#119

Post by yababa_y »

deegles wrote: post #113
JanisErdmanis wrote: post #84

Earlier quoted context omitted.

An intuitive explanation is that of proving you can find Waldo in a picture without revealing his exact location. Digital wallets can be interpreted as fancy signature schemes that operate on third-party issued commitments C instead of public keys that directly link users to their identities. A simple signature scheme is based on proof of knowledge PoK{x : pk = g^x}, which is transformed into a noninteractive variant…

for explanation i've seen for the where's waldo analogy: imagine the single page of the where's waldo puzzle, and another giant piece of paper with the shape of waldo cut out of it. by providing a picture of waldo in the cut-out, you can prove you know where he is without providing the location. a zero knowledge proof.

everyone in this thread needs to read this paper: https://dl.acm.org/doi/abs/10.1145/3411497.3420225

Where’s Waldo as presented isn’t even a proof of knowledge

Re: Opening up ‘Zero-Knowledge Proof’ technology

#120

Post by pinoy420 »

deegles wrote: post #113
JanisErdmanis wrote: post #84

Earlier quoted context omitted.

An intuitive explanation is that of proving you can find Waldo in a picture without revealing his exact location. Digital wallets can be interpreted as fancy signature schemes that operate on third-party issued commitments C instead of public keys that directly link users to their identities. A simple signature scheme is based on proof of knowledge PoK{x : pk = g^x}, which is transformed into a noninteractive variant…

for explanation i've seen for the where's waldo analogy: imagine the single page of the where's waldo puzzle, and another giant piece of paper with the shape of waldo cut out of it. by providing a picture of waldo in the cut-out, you can prove you know where he is without providing the location. a zero knowledge proof.

[dead]
Post reply on HN