Giter VIP home page Giter VIP logo

pazk's Introduction

What is this?

This is where I'll be collecting resources related to the Study Group on Dr. Justin Thaler's Proofs Arguments And Zero Knowledge Book. The notes posted here will be copied out of my personal Obsidian note client; certain features like image and latex embedding will not render on Github, though should still be readable. If you would like to read them with latex rendering, a hack solution might be to copy them to a HackMD document.

The group open to everyone, and runs out of the ZK hack discord server by myself and the nice folks at the Zero Knowledge Podcast.

Have a nice repo of your own? I'd love to link to it! Questions about this resource? DM me on Twitter.

Links

  • Bryan's explainer on multilinear Lagrange interpolation
  • A Zoo to visit weird and wonderful Complexity classes (note that complexity theory is not required or even core knowledge for this book, but exists as one of many rabbit holes to dive into)

Protocols to be implemented in the PAZK study group

A list of protocols to be implemented in Rust and Python by me over the course of the Thaler Study club, run out of the ZK hack discord server, published at github.com/thor314/pazk, in the (approximate) period April 2022-December 2022. The list is subject to change.

  • Freivalds Algorithm
  • Multilinear Lagrange Interpolation
  • Sumcheck
  • GKR
  • Fiat Shamir transformation outline
  • R1CS Front end over GKR
  • A Succinct Circuit Satisfiability Interactive Proof
  • Several Implementations of Polynomial Commitment schemes over:
    • Merkle Trees
    • Low degree tests
    • Both of the above
  • A Multi-Prover Interactive Interactive prover for Circuit satisfiability
  • A PCP of Quasilinear length for Circuit Sat
  • A Polynomial IOP for R1CS-sat via Univariate sumcheck
  • A Polynomial IOP from GKR
  • A Polynomial IOP from Clover
  • Minimal implementations of:
    • FRI
    • Ligero
  • Schnorr's sigma protocol for knowledge of Discrete Log
  • Sigma protocols, including Pedersen commitments
  • Fiat Shamir applied to the above sigma protocols
  • a Zero knowledge circuit via masking polynomials
  • several Polynomial commitments from hardness of discrete log
  • a naive bulletproof implementation
  • KZG univariate polynomial commitments from pairings and a trusted setup, and extensions to multilinear polynomials
  • The transparent Dory scheme
  • Hydrax
  • GGPR13
  • Groth16
  • Plonk, and modifications

pazk's People

Contributors

thor314 avatar

Stargazers

SunJc avatar Harry Chen avatar Antonin F. avatar timofey avatar Franco avatar アレーク avatar  avatar Parisa Hassanizadeh avatar Yansong Feng avatar Godspower Eze avatar  avatar  avatar GengTeng avatar Omar Seifelnasr avatar Yiğit Gürbulak avatar Ahmad avatar Gelois avatar tl2cents avatar leo avatar Bryan Cole avatar Javed Khan avatar EulerLagrange.eth avatar Prateek Banerjee avatar Wasabi avatar  avatar Ginika Chinonso avatar Danai Balla avatar Brian Seong avatar Jithin Jose avatar Keeks avatar Sriram avatar hung_ng__ avatar nullity avatar Harvey Specter avatar Sam Polgar avatar Michael Zaikin avatar Denis avatar bing avatar Josh Klopfenstein avatar Ak36 avatar Kurt Pan avatar Andrejs Agejevs avatar Erwan Or avatar Howard Li avatar Bob Niu avatar kkiyama117 avatar 0xhatsume avatar Cheng JIANG avatar liquan.eth avatar Hins avatar Prajwol Gyawali avatar  avatar Jasper Chou avatar HAOYUatHZ avatar Kevin Mai-Husan Chia avatar Filip Laurentiu avatar Rajesh Muppalla avatar Paul-T.C-Yu avatar Abhishek avatar Ruud Erie avatar Sonal K Singh avatar  avatar Arihant Bansal avatar Vyom Sharma avatar  avatar Tobias Leinss avatar mincut03E5 avatar BigSky avatar Josh Beal avatar Vijayendra Gaur avatar Sombra avatar Axel Iota avatar Mohammed avatar Bisola Olasehinde avatar sudo rm -rf --no-preserve-root / avatar Zhiyang Chen avatar Shabbir Hasan avatar Dan Lee avatar Georgios Konstantopoulos avatar Rami avatar Asmee Dhungana avatar  avatar 张双俊 avatar Naman Kumar avatar Yan-Tong Lin avatar Kevin W avatar Eric Ruleman avatar Michael Maker avatar Etch avatar Zeke Mostov avatar Will Pankiewicz avatar Obi avatar  avatar kaioh33 avatar  avatar  avatar Clover avatar Gaurav Bhattacharjee avatar Diganta Kalita avatar Fedor Sakharov avatar

Watchers

 avatar 3for avatar  avatar BoC avatar Eyal Kushnir avatar

pazk's Issues

Question on the 4.5.1 (Super-Efficient IP for counting triangle)

I was thinking to post this question in the discord, but feeling the timeline style of conversion there is difficult to track of. Not sure if this is the best place to ask implementation questions relating the knowledge in the survey paper. If not, please let me know if there is an alternative.

The sum check and the triangle counting example is intriguing. Currently I am making an implementation to demonstrate the sumcheck protocol over the triangle counting, with the MatMul IP optimization described in the section 4.4.2 of the survey paper. While implementing for the example definitely helps me understand the concepts thoroughly, I think this might serve as another examples to help others enhance the understanding the combination usage of the related concepts in addition to the existing vanilla sumcheck implementations.

One area in the protocol puzzles me for quite a while is how the two sum check protocols used in the triangle counting example wire up. To describe the question in details, I outline my understanding of the procedures of invoking the sum check and MatMul IP protocols below.

1st sumcheck

1.1 Prover calculates the MLEs give the entries of matrix $A$ and $A^2$, and invokes the sumcheck protocol using the following equation and send univariate $g$ polynomial to verifier
$$\tilde{f}_{A^2}(X, Y) \cdot \tilde{f}_A(X, Y)$$
1.2 Verifier recursively checks
$$g_{j-1}(r_{j-1})=g_j(0)+g_j(1)$$
1.3 until the last round
$$g_v\left(X_v\right)=g\left(r_1, \ldots, X_v\right)$$

Because it is expensive for the verifier to validate the result in the last round by evaluating the $g(r_1,r_2,...,r_v)$, which corresponds to $\widetilde{f}_{A^{2}} \cdot \widetilde{f}_A$ given the entries of $A$ matrix, so it invokes the matmul IP to complete the check for the final round in the 1st sumcheck.

2nd sumcheck

2.1 Verifier chooses $(r_1, r_2)$ and invokes MatMul IP
2.2 Prover responses $$s(X):=\widetilde{f}_A\left(r_1, X\right) \cdot \widetilde{f}_A\left(X, r_2\right)=\left(r_1(1-X)+\left(1-r_1\right) X\right) \cdot\left(X\left(1-r_2\right)+r_2(1-X)\right)$$
2.3 Verifier evaluates $$\tilde{f}_{A^2}\left(r_1, r_2\right)=s(0)+s(1)=r_1 r_2+\left(1-r_1\right)\left(1-r_2\right)$$, and multiplies it with $\tilde{f}_A\left(r_1, r_2\right)$ in order to get the target result $$\widetilde{f}_{A^{2}}\left(r_1, r_2\right) \cdot \widetilde{f}_A\left(r_1, r_2\right)$$
In my understanding, to convince the verifier the result of the double sumcheck protocol, the values from the equations of (1.3) and (2.3) should be equal.

However, in the first sumcheck, the random values $(r_1, r_2,...,r_{v-1})$ are already bounded(or I should call it "determined"). But in the second sumcheck in the matmul IP, the $(r_1, r_2)$ are newly chosen random values, unrelated to the corresponding ones although synthetically the same.

If $(r_1, r_2)$ doesn't represent the same random numbers as in the first sumcheck, the resulting value in the (1.3) won't be equal to (2.3). So I assume applying a new random number $r_3$ to both $s(X)$ in (2.2) and $g_v(X_v)$ in (1.3) neither makes them equal.

Then how can the verifier be convinced of the whole process? It is probably something I am missing during the process described above. Appreciate any hints.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.