Outline

Definition: Collaborative zk-SNARK

General Approach

Customizing MVC Protocol

Handling Elliptic Curve Operations

Additive Sharing Scheme

Collaborative Proof Performance

Summary

Final Thoughts

What is a zk-SNARK?

Hashing Circuit

How does it work?

Requirements for preprocessing argument systems

Why setup procedure?

Better setup procedure

Universal trusted setup SNARKs

Example SNARK program

What does the adversary A do?

How do we build a zk-SNARK?

Overview of zkSNARK

How does zkSnarks work?

Anchoring example

Encrypted values

Calculating a value

Example

Conclusion

Introduction

Comparing zkSNARKs

General-purpose proof systems

Linear homomorphism

Verifier's final check

Multicommitments

Refinements

Benchmark

Summary

Prover efficiency

Authentication with a zkSNARK

Collaborative zkSNARKs

Knowledge soundness

Potential Bottlenecks

MPC Crash-Course

Implementation Goals

Experimental Setup

Discussion, Future Work

Creating a witness

Running the hash

Creating the proving key and verification key

Generate zero knowledge proof

Format of zkSnarks output

Exporting the contract

Deploying the contract

Testing the contract

Deploying to Test Network

Intro

What is zkSNARKS?

What is a bilinear map?

Negatives of prime numbers

Multiplication Gates

Polynomial assignments

Polynomials and Equations

Proof of Key

Improved Verification

Anchoring Example

Our Goal

Scalability

Approver and Verifier

What is a succinct proof?

Types of setup procedures

Examples of SNARKs

Other SNARK systems

What does it mean for the prover to know W?

Why is this a zero-knowledge proof?

How to build a ZK SNARK

IOPS Recap

Soundness Requirements

Polynomial Commitment Scheme

SNARK Approver and Verifier

High-level structure of zkSNARKs

Conclusion

Holography

Verifier key

Future Directions

Can you chunk and split polynomials?

Introduction

What Are ZK Proofs?

Use Cases of ZK Proofs

Interactive vs Non-Interactive ZK Proofs

Interactive ZK Proofs

Non-Interactive ZK Proofs

Types of Non-Interactive ZK Proofs (ZK-SNARK & ZK-STARK)

ZK-SNARKs

ZK-STARKS

Summary: SNARK vs STARK

FFLONK

Next Steps

What Snarks Are

Compliance

Finite Field

Random Oracle

Trivial Snark

Proving Algorithm

Functional Commitment

Non-Zero Polynomial

Univariate Polynomial

Interactive Oracle Proof

Intro - ZkProof Overview

ZkProof Verification Challenge

ZkSNARK

ZkSTARK

ZkSNARK - Trust Setup Ceremony

ZkSNARK vs ZkSTARK

ZkRollup

Ending

Intro

Security parameters

What does it mean to commit to a function?

Equivalent commitment schemes

What is a cyclic group

Commitment string formula

Commitment scheme performance

Batch Proofs

Interactive procedure

Conclusion

What are ZK proofs?

What are ZK STARKs?

Conclusion

Bitcoin's privacy problem (cont.)

Zerocash: divisible anonymous payments

SNARKs for clouds?

SNARK constructions

The Zerocash scheme

Adding variable denomination

Pouring Zerocash coins Single transaction type capturing

Example of a Zerocash Pour transaction

Zerocash implementation

Other applications of zk-SNARK for Bitcoin

ZKSNARKs - Recent progress and applications to blockchain protocols

Zero-knowledge Proof

Non-interactive Zero-knowledge

First zkSNARK (Micali 94)

Preprocessing zkSNARK

Computation to Constraint System

SNARK from QAP

NIZK for Composite Statements

Composite statements?

Solvency: Total assets Total liabilities

Proof of solvency

Best of all worlds?

Towards NIZK for Composite statements (AGM'18)

SNARK on committed input

Point addition

NIZK for Composite statements

Proof per address

Privacy-preserving credentials

Base on standard signature?

What's scandalous about a trusted setup?

Updatable CRS SNARK (GKMMM'18)

SNARK from Constraint System

Polynomial Commitment Scheme (KGZ'10)

Applications

Thank You!