21–30 of 63 posts
for those who don't know, Monero is using bulletproofs.
A hard fork later this fall is expected to bring Bulletproofs to main net. Right now the code is being vetted by 3 external auditors, hired by the community through fund-raising.
The benefit to Monero, once this is implemented, is transactions that are almost an order of magnitude smaller. This is a huge win, for many reasons, and it doesn't even come at the cost of CPU time.
Tangent: I like that the logo for the organization 'adjoint' resembles the notation for adjoint functors.
Likewise! Looks like it was intentional: > Our name comes from advanced mathematics and represents the numerous ways in which we simplify financial processes and products using blockchain technology. ( https://www.adjoint.io/about/adjoint )
Earlier quoted context omitted.
What am I missing about the Ali Baba cave proof? Why does Victor ever need to hide which entrance she takes at first? (In fact this is brought up in the last paragraph with no reason as to why it's not the entire proof). Does Victor knowing the initial path make it non-zero-knowledge? Because if so, the example feels super contrived. I agree your Waldo example is much better.
One quirk about ZKPs is that they must be convincing only to the verifier[1]. If you know which entrance they used, it’s convincing to everyone , not just the verifier.[2] If you don’t know which entrance they used, than anyone besides the verifier can remain a Doubting Thomas: “okay, cool, your verifier came out B, then B, then A. So? You could just as well have conspired with them to start out at B, then B, then A!…
I think the parent's question is about what the "zero-knowledge" actually refers to. (scrollaway asked, "Does Victor knowing the initial path make it non-zero-knowledge?") The Wikipedia writing in 2 different places makes it confusing.
For Peggy's secret password X, the "zero knowledge" might mean:
(1) Victor has zero knowledge of what _X_ actually is even after Peggy proves she knows it: the first Wiki paragraph seems to emphasize this with "(the prover Peggy) can prove to another party (the verifier Victor) that she knows a value x, without conveying any information apart from the fact that she knows the value x."
(2) outside world (other than Victor) has zero knowledge that _Peggy_ knows what X is: the later Wiki paragraph is "Further notice that if Victor chooses his A's and B's by flipping a coin on-camera, this protocol loses its zero-knowledge property; the on-camera coin flip would probably be convincing to any person watching the recording later. Thus, although this does not reveal the secret word to Victor, it does make it possible for Victor to convince the world in general that Peggy has that knowledge—counter to Peggy's stated wishes."
Is the "zero knowledge" referring to keeping _X_ a secret , or is it keeping the fact that _Peggy_knows_X_ a secret, or are both secrets together required? The wikipedia article isn't clear on that so the article probably needs some revision to be more explicit.
(For some, an example of a ZKP would be email address verification for new user accounts: Vimeo(verifier) sends an email with a generated numeric code and Peggy(prover) has to enter that number in the webform to activate the account. This proves that Peggy "knows the secret password of that email account" but Vimeo still has "zero knowledge" of her email password. For this particular example, it doesn't matter that that the whole world knows that Peggy knows the password to her peggy@gmail.com so condition (2) is not a strong requirement.)
Bulletproofs are significant because they allows you to check that the amount being input and output in a Bitcoin transaction is correct without revealing the amounts to non-parties to the transaction. The size of a bulletproof is small enough (and they grow with O(c + log n)) that for transactions with a couple inputs and outputs, there is minimal overhead compared to a unblinded transaction. The link provided is to…
How is that possible? Bitcoin's whole premise is a globally verifiable balance of each address after each block (aka public ledger). I could see this being very helpful for new crypto currencies, but Bitcoin is pretty set in stone on this matter, no?
> They rely on the discrete logarithmic assumption > Range proofs do not leak any information about the secret value Could someone explain this? I can't say I followed the proof algorithm (don't have background on blinded Pederson commitments etc.), but to me these sound contradictory. If you're relying on a discrete log assumption then it means you are leaking information, but you hope it's not enough information to…
One thing I found useful is section 2.2 of https://crypto.stanford.edu/~dabo/papers/RSA-survey.pdf, on blinding in RSA.
Zero knowledge proofs are fascinating - as a non-mathematician, I particularly enjoy real-world examples. Two famous examples ("The Ali Baba Cave" and the "Two Balls and the Color Blind Friend") appear in the Wikipedia article on zero knowledge proofs [1]. My favorite, however, is this paper [2] on convincing another person you've found Waldo, without revealing his location and therefore ruining the game. It's extrao…
By that you mean someone wake who also found Waldo can verify if the shape matched. It still slightly ruins the game as you know the shape you're looking for now. This is why one way functions are used instead.
The other person won't know where Waldo is, because the cardboard is much bigger than the book, so Waldo could be anywhere on the page.
Earlier quoted context omitted.
By that you mean someone wake who also found Waldo can verify if the shape matched. It still slightly ruins the game as you know the shape you're looking for now. This is why one way functions are used instead.
No that's not the thing about it. The thing is you put the cardboard over the book then show it to the other person. The other person won't know where Waldo is, because the cardboard is much bigger than the book, so Waldo could be anywhere on the page.
Earlier quoted context omitted.
By that you mean someone wake who also found Waldo can verify if the shape matched. It still slightly ruins the game as you know the shape you're looking for now. This is why one way functions are used instead.
No that's not the thing about it. The thing is you put the cardboard over the book then show it to the other person. The other person won't know where Waldo is, because the cardboard is much bigger than the book, so Waldo could be anywhere on the page.