ZERO KNOWLEDGE IN BLOCKCHAIN APPLICATIONS DR JOHN T

ZERO KNOWLEDGE IN BLOCKCHAIN APPLICATIONS DR JOHN T. H. YUEN UNIVERSITY OF HONG KONG Summer Summit on Cryptocurrency and Blockchain Technologies 2019

ZERO KNOWLEDGE IN BLOCKCHAIN APPLICATIONS Introduction Simple ZK proof Blockchain and ZK Bulletproof zk. SNARK

ZERO KNOWLEDGE PROOFS Goldwasser, S. ; Micali, S. ; Rackoff, C. (1989), "The knowledge complexity of interactive proof systems" (PDF), SIAM Journal on Computing, 18 (1): 186– 208,

ZERO KNOWLEDGE PROOFS I know which ball is red and which ball is green Colour blindness Round 1: Shuffled or not? Round 1: No Round 2: Yes Round 2: Shuffled or not? N rounds accept or reject “Zero knowledge” of the colour of each ball is leaked to Bob.

PROPERTIES OF ZKP Completeness: if the statement is true, the honest verifier will be convinced of this fact by an honest prover. accept Soundness: if the statement is false, no cheating prover can convince the honest verifier that it is true, except with some small probability. false

PROPERTIES OF ZKP Zero-knowledge: if the statement is true, no verifier learns anything other than the fact that the statement is true. = green xxxxx yyyyy = red zzzzz She knows which ball is green/red Formalized by showing that every verifier has some simulator that, given only the statement to be proved (and no access to the prover), can produce a transcript that "looks like" an interaction between the honest prover and the verifier in question. simulator xxxxx yyyyy zzzzz

ZERO KNOWLEDGE IN BLOCKCHAIN APPLICATIONS Introduction Simple ZK proof Blockchain and ZK Bulletproof zk. SNARK

SIMPLE ZK PROOF: DISCRETE LOGARITHM

VARIANT: NON-INTERACTIVE ZK

ZK PROOFS FOR NP AND MORE All problems in NP have zero-knowledge proofs if one-way function exists. There exists a ZK proof system for the NP-complete graph colouring problem with three colours [1]. The graph non-isomorphism problem has a zero-knowledge proof. This problem is in co-NP, but is not currently known to be in either NP or any practical class. [1] Goldreich, Oded; Micali, Silvio; Wigderson, Avi (1991). "Proofs that yield nothing but their validity". Journal of the ACM. 38 (3): 690– 728.

ZK PROOFS FOR NP AND MORE

ZERO KNOWLEDGE IN BLOCKCHAIN APPLICATIONS Introduction Simple ZK proof Blockchain and ZK Bulletproof zk. SNARK

PRIVACY Blockchain Distributed Ledger Ø Ø Consensu s Single version of history Immutable Transparent Unforgeable (signature) Ø Transparency is good for some use cases, e. g. , supply chain management Ø Transparency is not desirable for sensitive information, e. g. , transaction details between two banks should not be known to other banks

PRIVACY-PRESERVING CRYPTOCURRENCY 3 Types of Privacy: ? ? → Sender anonymity Zcash (#26) Ø Use zero knowledge proof of circuit “zk-SNARK” to achieve all 3 types of privacy Ø Based on IEEE SP 2014 paper √ Can be extended to zk-smart contract (IEEE SP 2016) 1. Prove time = 30 sec. 2. Require trusted setup → Recipient anonymity Confidential transaction Monero (#13) Dash (#12) Ø Sender anonymity: linkable ring signature Ø Recipient anonymity: Diffie. Hellman key exchange Ø Confidential transaction: Pederson commitment + range proof Ø Mixing a few transactions’ input and output together √ Quite Practical Not scalable for sender anonymity √ Practical Limited anonymity

PRIVACY-PRESERVING CRYPTOCURRENCY Privacy: Popular among both researchers and practitioners Zero-knowledge proof approach: Ø zk-SNARK is implemented on top of Ethereum (#2) and JP Morgan’s Quorum platform Ø Very active research area, 10+ papers in top conferences since 2014 Coin-shuffling approach: Ø Improved in applications, such as Shared. Coins, Dark Wallet. Ø Coin. Shuffle paper in ESORICS 2014, works for bitcoin Linkable Ring Signature + Confidential Transaction approach: Ø Confidential transaction is used by top startups such as Blockstream and Chain. com Ø Monero developers proposed to use new scheme to improve the scalability of linkable ring signature

ZERO KNOWLEDGE IN BLOCKCHAIN APPLICATIONS Introduction Simple ZK proof Blockchain and ZK Bulletproof (The case of Monero) Zk-SNARK (The case of Zcash)

SENDER ANONYMITY BY RING SIGNATURES Prove in ZK that I know the secret key of Alice or Bob or Carol

LINKABLE RING SIGNATURE Problem of using ring signature for sender anonymity: Cannot detect double spending, because the sender is perfectly anonymous! Use “Linkable Ring Signature”: Detect when if someone signed twice with the same secret key Linkable Ring Sign ZK: I know the sk of Alice or Bob or Carol F: deterministic one-way function of sk

LINKABLE RING SIGNATURE IN MONERO Monero’s limitation: Ø Signature size is O(N), where N = number of public keys (PKs) to “hide” the signer not scalable Goal: Ø Signature size is O(log N) Method 1: One-out-of-many commitment approach • View the public key as a commitment of zero, where the randomness is the secret key the set of public keys secret key signer index Pk = Com(0; sk)

One-out-of-many commitment approach Proof size = O(log (N)) Remark: this is ring signature only. Need to add “linkability” J. Groth, M. Kohlweiss. One-Out-of-Many Proofs: Or How to Leak a Secret and Spend a Coin. Eurocrypt 2015.

O(LOG N)-SIZE RING SIGNATURE Method 2: Bulletproof approach (inner product argument) • Define: • We need a ZK proof for the above statement with size O(log n)! • Inner product argument T. H. Yuen, S. Sun, J. K. Liu, M. H. Au, M. F. Esgin, Q. Zhang, D. Gu. Ring. CT 3. 0 for Blockchain Confidential Transaction: Shorter Size and Stronger Security. e. Print 2019: 508

Inner product argument approach ZK proof for Proof size = O(log (N)) B. Bünz, J. Bootle, D. Boneh, A. Poelstra, P. Wuille, and G. Maxwell. 2018. Bulletproofs: Short Proofs for Confidential Transactions and More. In IEEE SP 2018.

CONFIDENTIAL TRANSACTION IN MONERO

ZERO KNOWLEDGE IN BLOCKCHAIN APPLICATIONS Introduction Simple ZK proof Blockchain and ZK Bulletproof (The case of Monero) zk-SNARK (The case of Zcash)

ZK-SNARK Zero-Knowledge Succinct Non-Interactive Argument of Knowledge Used in ZCash Prove in ZK that I know a SK, where the hash of the corresponding PK (= address) is included in a Merkle tree (of a block of transactions). ZK involving hash function is complicated zk-SNARK The high level steps for generating a zero-knowledge proof by zk-SNARK: Computation → Arithmetic Circuit → R 1 CS → QAP → zk-SNARK Let’s understand it by an example:

ZK-SNARK Computation → Arithmetic Circuit → R 1 CS → QAP → zk. SNARK Computation → Arithmetic Circuit: Give a circuit for the expression (x * x)*x + 5 x x +

ZK-SNARK: R 1 CS Computation → Arithmetic Circuit → R 1 CS → QAP → zk. SNARK 3 x 9 x 2 7 + 3 0 + 3

ZK-SNARK: R 1 CS Computation → Arithmetic Circuit → R 1 CS → QAP → zk. SNARK The complete R 1 CS put together is: A [0, 1, 0, 0] [0, 0, 0, 1, 0, 0] [0, 1, 0, 0, 1, 0] [5, 0, 0, 1] B [0, 1, 0, 0, 0, 0] [1, 0, 0, 0] C [0, 0, 0, 1, 0, 0] [0, 0, 1, 0] [0, 0, 0, 1] [0, 0, 1, 0, 0, 0] • R 1 CS: Rank 1 Constraint System • check that the values are “traveling correctly” in the circuit

ZK-SNARK: QAP Computation → Arithmetic Circuit → R 1 CS → QAP → zk. SNARK R 1 CS → QAP (Quadratic Arithmetic Programs): implements the exact same logic except using polynomials instead of dot products E. g. , four groups of three vectors (A, B, C) of length six groups of three degree-3 polynomials. When evaluating the polynomials at x=1, we get the first set of vector. When evaluating the polynomials at x=2, we get the 2 nd set of vector… Transformation can be done by Lagrange interpolation Use Fast Fourier Transform to optimize

ZK-SNARK: QAP Computation → Arithmetic Circuit → R 1 CS → QAP → zk. SNARK After some computations…… A polynomials [-5. 0, 9. 166, -5. 0, 0. 833] [8. 0, -11. 333, 5. 0, -0. 666] [0. 0, 0. 0] [-6. 0, 9. 5, -4. 0, 0. 5] [4. 0, -7. 0, 3. 5, -0. 5] [-1. 0, 1. 833, -1. 0, 0. 166] B polynomials [3. 0, -5. 166, 2. 5, -0. 333] [-2. 0, 5. 166, -2. 5, 0. 333] [0. 0, 0. 0] C polynomials [0. 0, 0. 0] [-1. 0, 1. 833, -1. 0, 0. 166] [4. 0, -4. 333, 1. 5, -0. 166] [-6. 0, 9. 5, -4. 0, 0. 5] [4. 0, -7. 0, 3. 5, -0. 5] A results at x=1 0 0 0 0 0. 833 x 3 - 5 x 2 + 9. 166 x - 5 -0. 333 x 3 + 2. 5 x 2 - 5. 166 x + 3 0. 166 x 3 - x 2 + 1. 833 x - 1 Put x =1 B results at x=1 0 0 0 0 C results at x=1 0 0 0 1 0 0

ZK-SNARK: QAP Computation → Arithmetic Circuit → R 1 CS → QAP → zk. SNARK = t(x)

ZK-SNARK: QAP Computation → Arithmetic Circuit → R 1 CS → QAP → zk. SNARK For example, A. s = [43. 0, -73. 333, 38. 5, -5. 166] degree 3 polynomial B. s = [-3. 0, 10. 333, -5. 0, 0. 666] C. s = [-41. 0, 71. 666, -24. 5, 2. 833] t = [-88. 0, 592. 666, -1063. 777, 805. 833, -294. 777, 51. 5, -3. 444] degree 6 polynomial Z = [24, -50, 35, -10, 1] degree 4 polynomial t / Z = [-3. 666, 17. 055, -3. 444] degree 2 polynomial with no remainder √ If the value of s is incorrect, t/Z will have a reminder

ZK-SNARK Computation → Arithmetic Circuit → R 1 CS → QAP → zk. SNARK QAP → zk-SNARK Remember that the solution to a QAP is a set of polynomials (A, B, C, H) such that A(x) * B(x) - C(x) = H(x) * Z(x), where: A is a linear combination of a set of polynomials {A_1…A_m} B is the linear combination of {B_1…B_m} with the same coefficients C is a linear combination of {C_1…C_m} with the same coefficients The sets {A_1…A_m}, {B_1…B_m} and {C_1…C_m} and the polynomial Z are part of the problem statement. The final ZK proof for (A, B, C, H) consists of 3 steps.

ZK-SNARK PROOF 1 Computation → Arithmetic Circuit → R 1 CS → QAP → zk. SNARK Setup: The following ECC points are given: [A_i(t)]G, [k_a A_i(t)]G, [B_i(t)]G, [k_b B_i(t)]G, [C_i(t)]G, [k_c C_i(t)]G, for i=1, …, m. Here t, k_a, k_b and k_c are secret numbers chosen by a trusted party. Proof 1: Knowledge of exponent By using the linear combination of polynomials A, B, C, the prover can compute: π_a = [A(t)]G, π’_a = [k_a A(t)]G π_b = [B(t)]G, π’_b = [k_b B(t)]G π_c = [C(t)]G, π’_c = [k_c C(t)]G e(π_a, [k_a]G) ? = e(π’_a, G) Verify e(π_b, [k_b]G) ? = e(π’_b, G) e(π_c, [k_c]G) ? = e(π’_c, G)

ZK-SNARK PROOF 2 Verify Computation → Arithmetic Circuit → R 1 CS → QAP → zk. SNARK

ZK-SNARK PROOF 3 Computation → Arithmetic Circuit → R 1 CS → QAP → zk. SNARK Additional setup: the values G, [t]G, [t 2]G, … are given in system parameter the values G, [Z(t)]G are also given in system parameter Proof 3: QAP divisibility. A(x) * B(x) – C(x) = H(x) * Z(x) π_h = [H(t)] G Verify e(π_a, π_b) / e(π_c, G) ? = e(π_h, [Z(t)]G) Sum up: Computation → Arithmetic Circuit → R 1 CS → QAP → zk-SNARK Proof is 8 ECC points: π_a, π’_a, π_b, π’_b , π_c, π’_c , π_k, π’_h = 288 bytes, no matter how large is the circuit!

USAGE OF ZK-SNARK “Shielded transaction” in Zcash creating a shielded Zcash transaction can take up to 40 seconds, while verifying that a transaction is valid only takes milliseconds Can be applied to smart contract zk-SNARK is implemented on top of Ethereum and JP Morgan’s Quorum platform

THANK YOU!