Programming Zero Knowledge Proofs: From Zero to Hero

Post by knowaveragejoe » Tue, Sep 03, 2024, 9:20 PM UTC

cyberax wrote: post #131

knowaveragejoe wrote: post #127

Earlier quoted context omitted.

The general takeaway is that you can prove you know something without revealing what it is, or how you know! If you can't think of the possibilities that unlocks beyond the examples others have already discussed(none of which were crypto related), that's a limitation on your end.

> The general takeaway is that you can prove you know something without revealing what it is, or how you know! And? Why is it better than good old PKI?

Post by TimJRobinson » Wed, Sep 04, 2024, 8:38 AM UTC

bschmidt1 wrote: post #136

TimJRobinson wrote: post #132

Earlier quoted context omitted.

> you definitely do not need "ZKPs" to do this trivial task. You haven't provided an alternative way though? If you're looking for more complicated things they can do see: https://news.ycombinator.com/item?id=41430157 > Yeah you can, you log them in then link them to that userData with an identifier - typically an email address or unique user ID. You can easily write the login API to know nothing but hashes, or you c…

> Re: Validating passwords > You haven't provided an alternative way though? Check if it has numbers: \d Check if it has symbols: \W Check if it's 6-64 chars long: {6,64} > This doesn't make sense Promise you it's how it works. > Hashes are binary yes/no checks Nope, just means encrypted text. > every government in the world runs an API Hilarious you think a decentralized approach where every participant has a copy o…

Post by bschmidt1 » Wed, Sep 04, 2024, 5:05 PM UTC

TimJRobinson wrote: post #153

cyberax wrote: post #149

Earlier quoted context omitted.

> You think peoples licenses / passports are little computers with API's built into them that return arbitrary information on demand? Literally yes, in some places. Passports have a chip in them, and licenses in some countries as well. > Over the internet? Tunneling private information over untrusted networks is literally how you're seeing this message.

Yea the chip gives the information written on the device. It doesn't answer arbitrary questions about the data. The whole point of ZK proofs is the zero knowledge part. If you don't care about the person being able to see the information of course there's no need for them.

Post by bschmidt1 » Wed, Sep 04, 2024, 7:46 PM UTC

bschmidt1 wrote: post #155

TimJRobinson wrote: post #154

Earlier quoted context omitted.

- Do you not understand that client side checks are insecure? - As you're still not getting it, how about this: This is a sha256 hash of my birthday, write a function that returns if I'm over 21: `1028d7ea22cbbcb17c4926b08b591506227d7b0e32ce6ce76122461e551a5ab2` - Nothing I've mentioned needs an append only log, where are you even getting that from? A ZK proof is created from only the data stored on the passport chip…

[flagged]

    interface User {
      id: sha256;
      name: string;
      age: number;
    }

    const users: User[] = fetchUsers();

    const isOver21 = plaintextId => users[encrypt(plaintextId)]?.age >= 21;

    const validHashes: BirthdateHashSha256[] = seedHashesForToday();
    
    const isOver21 = hash => validHashes.includes(hash);

Post by TimJRobinson » Thu, Sep 05, 2024, 12:39 AM UTC

bschmidt1 wrote: post #156

TimJRobinson wrote: post #153

Earlier quoted context omitted.

Yea the chip gives the information written on the device. It doesn't answer arbitrary questions about the data. The whole point of ZK proofs is the zero knowledge part. If you don't care about the person being able to see the information of course there's no need for them.

First you described exactly the concept of password hashing, now you're describing something else entirely: > It doesn't answer arbitrary questions about the data. Why would you need a "ZKP" to prevent anyone from "asking arbitrary questions" you simply don't build that functionality. When I create a web server and allow people to login through an endpoint, they can't ask arbitrary questions about user data either -…