5

There has been a lot of talk about leveraging zk-SNARKs to bring privacy features to the Ethereum Blockchain. My question is, how is Ethereum facilitating the verification of zk-SNARKs at the moment, and, moreover, what further steps are planned in this direction?

I am aware that Byzantinum, the first Metropolis hard fork, includes some changes (see EIP 198, EIP 212 (197) and EIP 213 (196) and compare with ELI5: Byzantium Changes) in the form of pre-compiled contracts that allow for operations used in zk-SNARK verification, such as, e.g., elliptic curve addition and pairing. I am furthermore aware of ZoKrates, a stand-alone program that is able to compile a program (from what seems to be a limited set of programs) into yet another program which can generate a non-interactive zero-knowledge proof and a Smart Contract that does the on-chain verification. Unfortunately, I wasn't able to find any documentation on it.

I am wondering whether there is anything besides these EIPs and whether the support for zk-SNARK verification is going to stay at that level? Personally, I suspect that because Ethereum Smart Contracts can have arbitrary computations, the quadratic arithmetic programs (QAP) used to conduct zk-SNARKs, in general, differ vastly depending on the application such that a more high-level support is rendered infeasible.

Improve this question
1

2 Answers 2

Reset to default
1

As far as I know, ZoKrates + Byzantium precompiles is the most generic solution currently available. Recently they also added sha256 support in ZoKrates, which extremely improves the applicability.

For tutorial and documentation for ZoKrates see https://zokrates.github.io/introduction.html

For more advanced examples see ZKDai, which basically reassembles with ZoKrates the ZCash features.

Beside that, there are other solutions targeting special cases like Aztec or ZK range proofs made by ING.

Open challenges with ZK-SNARKS are still:

  • trusted setup (toxic waste)
  • onchain proof verification costs (~1,5M gas / verification)
  • offchain proof creation (RAM consumption can easily go to couple of GB / proof)
Improve this answer
1

Here are the latest modern updates on this problem:

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.