Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Opening up ‘Zero-Knowledge Proof’ technology

blog.google

Post reply on HN
Print view View original

141–150 of 217 posts

Re: Opening up ‘Zero-Knowledge Proof’ technology

#141

Post by endgame »

tzs wrote: post #139
coldpie wrote: post #109

Earlier quoted context omitted.

> This is great. Do you still feel that way knowing that it introduces a hard requirement for all users to have their private data managed by one of Apple, Google, or Microsoft[1]? I want to be excited about this, and about Passkeys, but the people working in this space keep fumbling this ball :( [1] " Using the MDOC requires a signature from a hardware security key in the phone " https://news.ycombinator.com/item?id…

You can have a password manage your passkey private data. Several now have passkey support, including some that work on Linux such as 1Password and Bitwarden letting you use passkeys even if your household is completely Apple-free, Microsoft-free, and Google-free.

https://github.com/keepassxreboot/keepassxc/issues/10407#iss...

> To be very honest here, you risk having KeePassXC blocked by relying parties

Even if the bigtechs don't "officially" make the passkey standards require bigtech involvement, it seems very likely to me that conservative businesses like banks will only accept bigtech implementations. And then you're sunk.

Similarly, look at how OpenID turned into "Sign in with AppleGooFaceSoft".

This ZKP+hardware secure element stuff seems even worse, because how are you going to make it work on old hardware, or with free software, or with open devices?

Re: Opening up ‘Zero-Knowledge Proof’ technology

#142

Post by tzs »

MatteoFrigo wrote: post #127
miki123211 wrote: post #89

Earlier quoted context omitted.

If you can achieve RCE on the chip and run arbitrary code without invalidating signatures, does the protocol still stay secure? If so, what's the point of requiring your implementation to run on a verified secure element? If not, the protocol seems only as strong as the weakest chip, as obtaining just a single private key from a single chip would let you generate arbitrary proofs.

The role of the secure element is only to "bind" the credential to the device, so that if you copy the credential somewhere else then the credential is useless. Concretely, the secure element produces a ECDSA signature that must be presented together with the credential. This is the normal protocol without ZKP. Concretely, the SE is in the phone, but could be a yubikey or something else. The ZKP library does not run…

Am I correctly understanding that I'd get the credential from say my state DMV once, and then later whenever I want to prove my age to a website the proof protocol is just between that website and my device? The DMV gets no information about what websites I use the DMV credential with and they get no information about when I use the credential even if the website and the DMV decide to cooperate? All they would be able to get was that at time T someone used a credential on the site that came from the DMV?

I tried to sketch out a design an age verification system, but it involved the DMV in each verification, which made timing attacks a problem. Briefly the website would issue a token, you'd get a blind signature of the token from the DMV's "this person is 18+" service, and return the token and unblinded signature to the website. I think that can be made to work but if the site and DMV cooperated they would likely be able to unmask many anonymous site users by comparing timing.

Getting the DMV out of the picture once your device is set up with the credential from them nicely eliminates that problem.

Re: Opening up ‘Zero-Knowledge Proof’ technology

#143

Post by tptacek »

_alternator_ wrote: post #130
remram wrote: post #117

Earlier quoted context omitted.

That's only for interactive proofs though. Like GP I have no problem understanding those.

There is a trick to convert an IP to a non-IP. Usually in an IP, the prover (Bob) has to answer questions from the verifier (Alice), and Alice chooses her questions by flipping a coin. If the Bob doesn’t really know the answer, he’ll get caught cheating with high probability. So now the trick: Bob starts generates his initial answer. Then he hashes it (“commits” in the jargon), and uses the hash as “Alice’s first coi…

This is Fiat-Shamir, right?

Re: Opening up ‘Zero-Knowledge Proof’ technology

#144

Post by hrdwdmrbl »

Can someone compare their tech to the current research frontier of ZK-p tech?

The reason I ask is that I know that many teams working in the b-word field are _regularly_ making great progress. So I'm just wondering if this work is actually novel / useful or whether it's Google releasing something that is already stale.

Re: Opening up ‘Zero-Knowledge Proof’ technology

#145

Post by [deleted] »

bobbiechen wrote: post #29

Anyone have a good explanation on the intuition of non-interactive zero-knowledge proofs? For example, I thought the "paint-mixing" analogy for Diffie-Hellman key exchange ( https://en.wikipedia.org/wiki/Diffie–Hellman_key_exchange#Ge... ) really helped me handwave the math into "mixing easy, unmixing hard". https://blog.cryptographyengineering.com/2014/11/27/zero-kno... was a good intro for interactive ZK proofs but…

[deleted]

Re: Opening up ‘Zero-Knowledge Proof’ technology

#146

Post by arcastroe »

deegles wrote: post #113
JanisErdmanis wrote: post #84

Earlier quoted context omitted.

An intuitive explanation is that of proving you can find Waldo in a picture without revealing his exact location. Digital wallets can be interpreted as fancy signature schemes that operate on third-party issued commitments C instead of public keys that directly link users to their identities. A simple signature scheme is based on proof of knowledge PoK{x : pk = g^x}, which is transformed into a noninteractive variant…

for explanation i've seen for the where's waldo analogy: imagine the single page of the where's waldo puzzle, and another giant piece of paper with the shape of waldo cut out of it. by providing a picture of waldo in the cut-out, you can prove you know where he is without providing the location. a zero knowledge proof.

Plot twist: In addition to the cutout paper, the prover also brings their OWN picture of waldo, which they always place behind the cutout.

Re: Opening up ‘Zero-Knowledge Proof’ technology

#147

Post by goopypoop »

cma wrote: post #135
goopypoop wrote: post #122

Earlier quoted context omitted.

Is that "Draw a Waldo with this outline"?

Imagine it isn't Waldo, but an unknown figure and you are only given the silhouette to find. If you can draw what's within the silhouette or something, you've proven you've located it to high certainty without saying where. Say the whole image looked like noise and was generated from quantum measurements, and the coordinates to hash for the problem were generated with quantum measurements, and you were given the silh…

Thanks. So is it really different from "what's (the hash of) word x on page y of the manual?"?

Re: Opening up ‘Zero-Knowledge Proof’ technology

#148

Post by EulerLagrange »

baby wrote: post #110
vvpan wrote: post #86

A cool technology that builds on ZK is zkTLS that can prove that you have access to some data on the internet, for example that you have an account with some service without revealing your username. So more private oauth I suppose?

Great intro to how zkTLS works: https://blog.zksecurity.xyz/posts/zktls/

im in the background of that talk

Re: Opening up ‘Zero-Knowledge Proof’ technology

#149

Post by ranger_danger »

> In layperson’s terms, ZKP makes it possible for people to prove that something about them is true without exchanging any other data. So, for example, a person visiting a website can verifiably prove he or she is over 18, without sharing anything else at all.

But how does it prove that the request is actually made by a person and not a bot? Surely that part is technically impossible right now?

Re: Opening up ‘Zero-Knowledge Proof’ technology

#150

Post by [deleted] »

MatteoFrigo wrote: post #42
coldpie wrote: post #38

Earlier quoted context omitted.

Yeah I'm also interested in some of the details here, but the linked library repo is a bit too low-level for my current understanding. For example, in the usecase of providing a proof-of-age to a website: who provides the verification data (the government?); what form does that take (a file in a standard format?); who holds/owns the verification data (the user?); who runs the verification software (the end-user's web…

The specifics depend on local regulations, but roughy speaking: the government gives you a document in a standard format (eg MDOC). Your phone stores the document, with cooperation from a secure element that binds the document to the phone. The website you visit verifies the proof. The government gives documents to whatever wallet they want, which may be a special government wallet. They may or may not give the docum…

[deleted]
Post reply on HN