Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Programming Zero Knowledge Proofs: From Zero to Hero

zkintro.com

Post reply on HN
Print view View original

141–150 of 170 posts

Re: Programming Zero Knowledge Proofs: From Zero to Hero

#141

Post by nextaccountic »

jlokier wrote: post #27
cosignal wrote: post #2

As someone with zero knowledge regarding Zero Knowledge Proofs in a programming context, can someone give me a basic explanation regarding the utility? I do understand the basic principle of ZKP’s, but as yet I’m failing to understand how this would be applied in industry.

For me, the most powerful use of ZKPs is proof of the output of general purpose computations of any kind. You can run an arbitrarily large, arbitrary long program, and whatever the program outputs, you can make a tiny proof-signature that says "this is the output you'll get if you run this program yourself". The proof-signatures are relatively small, and you can verify them on small devices in milliseconds. Another c…

Is anyone actually using this to cache the artifacts of a compiler? Do you have a link? Like a proof of concept compiler that can produce both a binary and a proof that it was compiled correctly.

Re: Programming Zero Knowledge Proofs: From Zero to Hero

#142

Post by sshine »

rrr_oh_man wrote: post #67
hbbio wrote: post #57

Earlier quoted context omitted.

You can prove that too with zk!

How could this look like?

If the loan assessment criteria are objective, they can be quantified.

The basic concept here is: ZKP lets you prove arbitrary statements.

Instead of:

  Here is entire bank history, you decide.
You can say:

  Had a fixed income above $X for 12 months.
  Had a surplus of $X after fixed expenses in the last 3 months.
  Did not buy anything irregular above $1000 in the last 3 months.
"Did not gamble" is a moral judgement. Who knows, maybe I'm buying gum at the local casino, is that gambling? Maybe I'm tossing a coin every night after work as to whether I should drive in the opposite lane, is that not gambling? You can only objectively measure financially risky behavior in statistical terms.

Think of a ZK proof as a program that can take both public and private knowledge as input, and produce public and private knowledge as output.

This is what seems magical to me: A program with secret input. You can't run the program to verify that my execution of the program is correct, but you can verify a proof that I ran the program with input you didn't have.

The way private knowledge works is through cryptographic commitments.

For example, the bank may start by giving you a signed, structured document with your transactions.

You can then feed their signature and the document to your program, and produce any derivation.

Re: Programming Zero Knowledge Proofs: From Zero to Hero

#143

Post by sshine »

foota wrote: post #86
sshine wrote: post #52

Earlier quoted context omitted.

One place I wish there was zero knowledge proofs involved, or even any kind of cryptography, is when you perform credit assessment for loans outside your bank: an external loan provide peeks at your full bank account history to assess whether you’re eligible. They don’t need to know where I buy my socks, or even how much money I have. Only that I have a big enough deposit and a steady enough cashflow.

This isnt a cryptographic problem really. The loan checker is already trusting your bank to give them the correct information, it's only a matter of anonymization (e.g., they could return merchant types instead of merchant names etc.,.) but theres no real incentive for this.

> theres no real incentive for this

Correct.

People who need the privacy can set up isolated bank accounts and legal entities.

Less cryptography, your accountant will even understand.

Re: Programming Zero Knowledge Proofs: From Zero to Hero

#144

Post by eru »

gbasin wrote: post #79
eru wrote: post #32

Earlier quoted context omitted.

I come from a traditional finance background. One underappreciated possible role for ZKP is in compliance. Eg Goldman Sachs could encode all their compliance rules in a program, and publish a proof that their books pass the check by that program, without revealing anything about their accounting. More crypto focussed: suppose you build a 'better FTX'. You could publish a proof that you ain't hiding an Alameda, ie tha…

I am building in the mortgage origination space and have these sorts of enhancements on the drawing board... you hit the nail on the head that the bottleneck will be in QC and legal review, as 3rd-parties (especially regulators) may want to manually see the data you used to reach the conclusions you did. Although I'm still digging. You'd be interested in what we're creating btw, it's a crypto-based mechanism that ena…

Sounds interesting! I have an email address in my profile.

Re: Programming Zero Knowledge Proofs: From Zero to Hero

#145

Post by eru »

cyberax wrote: post #91
eru wrote: post #36

Earlier quoted context omitted.

They are useful from a mathematical point of view. (And explore the relationship between P and NP, for example.) Not sure if that counts as a 'real use' to you. See also https://en.wikipedia.org/wiki/PCP_theorem At the moment, producing a zero knowledge proof has roughly a million-fold overhead compared to running a program directly. So there aren't many applications where that's acceptable. So I am very grateful tha…

Again, this is exactly the cryptocrap-derived nonsense I meant. "Goldman Sachs could..." but they do NOT. Like they don't use blockcrap for interbank settlements, asset tracking, notary, etc. So basically, no actual uses so far. And it's not even clear _why_ I would want to use ZKP.

I carefully gave examples of where ZKP can be useful outside of blockchains.

> Like they don't use blockcrap for interbank settlements, asset tracking, notary, etc.

Yes. So far the only way to track real world assets on a blockchain is to have a trusted third party (or third parties) that connect whatever your blockchain says to the real world.

But if you have that trusted third party, you might as well have them run the database that keeps track of who owns what. No need for a blockchain.

ZKP is different in the sense that it's one of only a few things to come out of the 'crypto' world that has at least a _chance_ of being useful in the real world. One day. Perhaps.

(Cryptography in general is enormously useful. Have a look at HTTPS for one example. When I just say 'crypto' I mean specifically everything to do with the blockchain ecosystem. So far the only real applications of crypto / blockchains that I've seen are gambling (generously called 'speculation' or 'investment') and ransomware payments. Cryptocurrencies aren't even good for buying drugs on the black market so far.)

In any case, ZKP is still very immature. But we are very fortunate that the crypto-people are generously funding this area of essentially pure mathematics research.

Re: Programming Zero Knowledge Proofs: From Zero to Hero

#146

Post by IanCal »

numtel wrote: post #81
clarus wrote: post #69

Earlier quoted context omitted.

There are RISC-V based zero-knowledge virtual machines, to which a GCC version can be compiled. So this should be possible, although probably very slow, maybe a thousand times slower than a normal GCC execution.

Risc Zero runs at about 500hz on high-end desktop hardware. They're working on speed ups though. (Source: their presentation in Brussels in July)

Link to risc zero, looks like a fascinating project https://www.risczero.com/

Re: Programming Zero Knowledge Proofs: From Zero to Hero

#147

Post by baby »

If people are interested in trying ZKPs you can write programs in noname[1] in the noname playground[2] and have them compiled down to circuit and also prove/verify them. It's mostly a demo but the language is actively being developed and there's a list of easy tasks to pick up on in the main repo.

[1]: https://github.com/zksecurity/noname

[2]: https://noname-playground.xyz/

Re: Programming Zero Knowledge Proofs: From Zero to Hero

#148

Post by nailer »

eru wrote: post #139
BHSPitMonkey wrote: post #97

Earlier quoted context omitted.

> Bob trusts all 50 issuers, but Alice doesn't want to reveal who her issuer is. So, just a form of certificate chaining? With the same old challenges that come up if Bob learns that one of the issuers was compromised for some period of time?

Sorry, what is certificate chaining in this context? ZKP allows you to run arbitrary logic, without the id providers having to anticipate what you are trying to do nor having to cooperate. Eg you could prove that 'either your age is a prime number or that you have green eyes and live in New York'.

> Sorry, what is certificate chaining in this context?

crypto people need to learn crypto.

Re: Programming Zero Knowledge Proofs: From Zero to Hero

#149

Post by cyberax »

TimJRobinson wrote: post #133
cyberax wrote: post #129

Earlier quoted context omitted.

And the next question is: why bother? We have well-established protocols for the ID card: a police scanner creates a nonce and sends it to the card, the card signs it with its private key, and provides a certificate signed by the government. The police scanner then verifies the signature and checks that the certificate is correctly signed by the government's public key. No need for ZKP.

You think peoples licenses / passports are little computers with API's built into them that return arbitrary information on demand? Over the internet?

> You think peoples licenses / passports are little computers with API's built into them that return arbitrary information on demand?

Literally yes, in some places. Passports have a chip in them, and licenses in some countries as well.

> Over the internet?

Tunneling private information over untrusted networks is literally how you're seeing this message.

Re: Programming Zero Knowledge Proofs: From Zero to Hero

#150

Post by cyberax »

fisf wrote: post #140
cyberax wrote: post #89

Earlier quoted context omitted.

> I've created a simple demo program to illustrate the concept of a human passport, inspired by World ID. It uses a zero-knowledge virtual machine (zkVM) to verify certain properties of a password without actually seeing the password itself. Why would I need it in practice?

Because you can enforce password policies without the password ever leaving the (untrusted) client in clear text. I.e. the server only sees the hash and still knows it's dealing with a strong PW.

A client-side script can do that. What is the attack model? A client maliciously changing the client script to supply a weak password?
Post reply on HN