Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Programming Zero Knowledge Proofs: From Zero to Hero

zkintro.com

Post reply on HN
Print view View original

41–50 of 170 posts

Re: Programming Zero Knowledge Proofs: From Zero to Hero

#41

Post by dataflow »

jlokier wrote: post #27
cosignal wrote: post #2

As someone with zero knowledge regarding Zero Knowledge Proofs in a programming context, can someone give me a basic explanation regarding the utility? I do understand the basic principle of ZKP’s, but as yet I’m failing to understand how this would be applied in industry.

For me, the most powerful use of ZKPs is proof of the output of general purpose computations of any kind. You can run an arbitrarily large, arbitrary long program, and whatever the program outputs, you can make a tiny proof-signature that says "this is the output you'll get if you run this program yourself". The proof-signatures are relatively small, and you can verify them on small devices in milliseconds. Another c…

> Or if the big computer says "this entire Debian distribution of binary files was indeed compiled with this version of GCC", you can quickly verify that all the binaries are exactly what they should be - without having to trust anyone.

> So amazed and intrigued that I had to learn how it's done

Any chance you could just illustrate this somehow with a basic example? I just don't see how you could possibly verify that a program is produced with GCC without going through approximately as much effort as it'd take to compile it.

Re: Programming Zero Knowledge Proofs: From Zero to Hero

#42

Post by jlokier »

p1necone wrote: post #38
cosignal wrote: post #2

As someone with zero knowledge regarding Zero Knowledge Proofs in a programming context, can someone give me a basic explanation regarding the utility? I do understand the basic principle of ZKP’s, but as yet I’m failing to understand how this would be applied in industry.

I can see applications in multiplayer gamedev - imagine being able to run the whole game simulation on a clients machine and have them assert back to you that they killed 7 goblins, looted a rare sword from a chest, and died 3 times - and you could just trust them. Your server costs would only need to be for the metaprogression/persistence related stuff that could be done relatively infrequently based on updates from…

I agree. Exploring this in game worlds came up in a job interview a few years ago :)

ZK proofs are potentially a transformative tool for real-tine distributed systems in general, not just games. They potentially improve laency ("ping"), by changing the communication patterns in a distributed consensus system. That's great for games and other real-time systems.

Re: Programming Zero Knowledge Proofs: From Zero to Hero

#43

Post by LegionMammal978 »

rvrs wrote: post #21
LegionMammal978 wrote: post #19

Earlier quoted context omitted.

> without disclosing the actual birthdate What prevents the birthdate from being gleaned through a simple binary search? Or, if it's specifically an "over 18 today?" query based on some decentralized timestamp source, what prevents the query from just being repeated every day until the result changes (assuming it returns "under 18" at first)?

The holder of the credential would have to present it log(N) times. If someone asks to scan your id a bunch of times, wouldn't you find it suspicious?

Different 'someone's could conceivably collude to whittle down the result of the search, fingerprinting users via separate means to align the results. Or, less conspiratorially, one could present an apparently-poorly-designed interface where the credential is only valid for the current login session, then wait for a few cycles of the user clearing their browser cookies.

Perhaps a very explicit prompt "This service wants to know if you're > X years old!" might give up the trick, but then users would have to be trained not to click through it within milliseconds, which is never the most viable solution.

Re: Programming Zero Knowledge Proofs: From Zero to Hero

#44

Post by rtpg »

shriphani wrote: post #31
rtpg wrote: post #29

Earlier quoted context omitted.

in your first example, how does Signal route messages in that model?

sender specifies recipient but the signal server cannot tell a group-chat message from a non-group chat message.

so in this world signal still knows I'm sending to N recipients? Or is the fanout happening in a different way?

I guess I'm wondering if Signal still basically has enough info to make good guesses at group existence.

Re: Programming Zero Knowledge Proofs: From Zero to Hero

#45

Post by AmericanChopper »

nowayno583 wrote: post #11
cosignal wrote: post #2

As someone with zero knowledge regarding Zero Knowledge Proofs in a programming context, can someone give me a basic explanation regarding the utility? I do understand the basic principle of ZKP’s, but as yet I’m failing to understand how this would be applied in industry.

Imagine you are Goldman Sachs and a client wants to make a 100mm USD wire transfer to one of their accounts at Citibank. How does citibank know that the account at GS has the money to cover this transfer? Right now, the way this works is essentially through a lot of trust and some guarantees by the fed. This has some downsides: because you need a lot of confirmations, it makes transfers take longer. Also, small playe…

> How does citibank know that the account at GS has the money to cover this transfer?

At the moment this is all handled with Swift, and I’m not sure you what you gain from adding ZKPs. Depending on the transaction you might send a Swift MT799 with a pre-advice letter, a proof of funds letter, or a blocked funds letter. Again depending on what you’re doing you might need a MT760 to send a bank guarantee or some sort of letter of credit, and finally a MT103 to initiate the actual transfer of funds.

At this point your counter party risk lies with the banking institution itself, and their willingness and ability to complete the transactions they have legally committed to, rather than the account holder, and this risk doesn’t go away with the addition of ZKPs.

Re: Programming Zero Knowledge Proofs: From Zero to Hero

#47

Post by ruuda »

cosignal wrote: post #2

As someone with zero knowledge regarding Zero Knowledge Proofs in a programming context, can someone give me a basic explanation regarding the utility? I do understand the basic principle of ZKP’s, but as yet I’m failing to understand how this would be applied in industry.

A toy example: suppose we have some sudoku. You want to show publicly (maybe in a HN comment) that you know the solution, without revealing the solution itself, because then anybody would know it and be able to post that they know it. A zero-knowledge proof enables this. You could also post a hash of the solution, but then you need to know the solution already to verify a submission. (It would also enable others to copy your answers without really knowing the solution, though that can be fixed using a technique that zero-knowledge proofs also use, a blinding factor).

More useful cases include decoupling payment information from users, to preserve their privacy. You can prove that somebody paid for the action you want to perform, without identifying the payer. For example to offer cloud storage without knowing which data belongs to which user, so when there is a data breach or law enforcement order, the answer to "tell me everything you know about user X" is their payment history, but not which data is theirs.

Re: Programming Zero Knowledge Proofs: From Zero to Hero

#48

Post by Uptrenda »

What does everyone think about the 'trusted' setup part of zero-knowledge proofs? Is this a deal breaker for some use-cases or can this phase be done without worrying that the entire process has been hijacked... As has been a core goal of many ah... 'security' councils in the past.

Re: Programming Zero Knowledge Proofs: From Zero to Hero

#49

Post by shriphani »

rtpg wrote: post #44
shriphani wrote: post #31

Earlier quoted context omitted.

sender specifies recipient but the signal server cannot tell a group-chat message from a non-group chat message.

so in this world signal still knows I'm sending to N recipients? Or is the fanout happening in a different way? I guess I'm wondering if Signal still basically has enough info to make good guesses at group existence.

Yeah I think you are correct that the protocol isn't safe from traffic analysis.

Re: Programming Zero Knowledge Proofs: From Zero to Hero

#50

Post by piotr93 »

nailer wrote: post #3

> We can take a digital identity card and prove that we are over 18 years old > Without revealing anything else, like your full name or address If you are in this articles audience you would simply state the producer of the ID card signs a statement that the person is over 18. No ZKP needed. The article like many others would be improved with a better example.

A signature is a zkp. So your example is also a good example :)
Post reply on HN