Skip to main content
Share Your Experience: Take the 2024 Developer Survey
28 votes

zk-SNARKs vs. Zk-STARKs vs. BulletProofs? (Updated)

A few of your points are valid (e.g. SNARKs and STARKS are both faster than Bulletproofs) but there are also some mistakes: STARKs are only faster than SNARKs at the prover level (1.6s vs 2.3s), ...
Paul Razvan Berg's user avatar
12 votes

zk-SNARKs vs. Zk-STARKs vs. BulletProofs? (Updated)

Starks are almost better than Snarks all around: they require weaker crypto assumptions, don't require a trusted setup and are post-quantum resistant. But they have a major drawback, as in the proof ...
Alex Pinto's user avatar
8 votes

Does giving enough zero knowledge proofs give knowledge?

A proper zero-knowledge proof gives no information whatsoever EXCEPT about the statement it's proving. So, for example, no number of ideal digital signatures will ever serve to leak even a single bit ...
Glenn Willen's user avatar
6 votes
Accepted

Does giving enough zero knowledge proofs give knowledge?

Generally, privacy preservation is about hiding in a large set of possibilities, so anything that narrows the set of possibilities too much is a hazard. When multiple observations are possible, an ...
Rob Hitchens's user avatar
  • 55.3k
6 votes

Does giving enough zero knowledge proofs give knowledge?

Yes, if you give enough ZK proofs, you do eventually give knowledge about your exact age. An analogy would be if you were assembling pieces of a puzzle. If you assemble enough of the pieces, you will ...
Yongjian P.'s user avatar
  • 4,200
6 votes
Accepted

How to use the zksnarks capability of Ethereum?

A full answer would take a lot of time and space, and the general situation right now is that there's no easy way to use the zkSNARK precompiles. The general outline are as follows: Construct a ...
Tjaden Hess's user avatar
  • 37.1k
5 votes

Can ZKSnarks be implemented on the Ethereum ecosystem?

Disclaimer : I am not a cryptographer nor a mathematician nor a low level software engineer. Please correct me if any information provided below is incorrect. Very short answer: Yes Short answer: ...
PhABC's user avatar
  • 522
4 votes

Can I make a "secret" invite only Smart Contract?

Since nothing stored in a contract is actually private (any node can access the storage, even "private" variables aren't actually private), this isn't at all secure. A secure way to do this would be ...
natewelch_'s user avatar
  • 12.1k
4 votes
Accepted

Is there a decentralized zk-SNARK (zero-knowledge Succinct Non-Interactive ARgument of Knowledge)?

Yes, the verification key can be computed using multiparty computation (MPC). In this setup, n people participate in the construction and each independently and randomly generate the secret input. The ...
Tjaden Hess's user avatar
  • 37.1k
4 votes

Zero Trust vs Zero Knowledge -- Difference

They are quite different ideas. Zero trust You don't have to trust the other party for a transaction to take place because the system ensures neither party can cheat. For example you want to ...
Lauri Peltonen's user avatar
4 votes
Accepted

Can Ethereum verify zk-SNARK proofs?

Yes! There is a project called Zokrates, it allows you to create the algebraic circuit necessary for your proof and creates the smart contract that verifies it. You can find the toolbox you can get ...
Jaime's user avatar
  • 8,350
4 votes

Does giving enough zero knowledge proofs give knowledge?

A "zero knowledge proof" is a proof that gives zero knowledge of anything other than what it's proving. If you're proving that you're over 18, then a ZKP will prove that you're over 18, but ...
Acccumulation's user avatar
3 votes

Is there a decentralized zk-SNARK (zero-knowledge Succinct Non-Interactive ARgument of Knowledge)?

You also might want to check out the following resources. The ING blockchain team has submitted their proposal for efficient ZKP's to ethereum. It's not a SNARK but a range proof. https://github.com/...
Nico Vergauwen's user avatar
3 votes

An example on using "zk-SNARK" in "smart contract"?

The only thing that is in solidity are precompiled contracts for Ellyptic curve operations. For implementations check out Is there a decentralized zk-SNARK (zero-knowledge Succinct Non-Interactive ...
Nico Vergauwen's user avatar
3 votes

Updated: Is it possible to hide the sender or receiver of transactions by "zk-SNARK" or "Bulletproofs"?

Roughly, there are three aspects relative to privacy of transactions. Hiding the sender of the transaction -> Ring Signatures. See Will be a ring signature scheme possible to implement at Ethereum?...
ivicaa's user avatar
  • 7,519
3 votes

Is "Pinocchio zk-SNARK" a specific type of zk-SNARK?

Pinocchio is one of the early implementation of SNARK ( Succinct Non Interactive Arguments of Knowledge) without the aid of Probabilistic Checkable Proofs (PCP). In 2010, Groth constructed a Non ...
Gokul Alex's user avatar
3 votes
Accepted

Current state of zero knowledge proofs?

The Ropsten testnet has just verified a tranasction from the zCash network via a zkSNARK. For more details, have a look at the zkSNARK code, available here.
István András Seres's user avatar
3 votes

Does giving enough zero knowledge proofs give knowledge?

I know this is not a math/signal processing forum, but your question kind of is. The problem is that "Zero knowledge" is a name of the protocol, often called a proof, but not a proof in the ...
Ander Biguri's user avatar
3 votes
Accepted

zK learning, don't know where to start

Alright, here is my list of recommendations. I have summarized it because in my experience, people don't look at everything if there is too much to look for. So I'll give you the best of the best (IMO)...
upavloff's user avatar
  • 1,110
3 votes

Why do we use circom circuit in zero knowledge?

Good question! I think the main reason is that the underlying framework of ZK systems is somewhat different. For example, integers in ZK are field elements instead of regular integers. They behave ...
Lauri Peltonen's user avatar
2 votes

Did I actually just win 1 Ethereum? Is it truly mine?

Just to clarify, Ether is a real cryptocurrency. On Coinbase.com, 1 Ether can be exchanged for about $67 today. However, on the top of the page at the URL in your question, you will see ROPSTEN (...
Ajoy Bhatia's user avatar
  • 1,446
2 votes

Where can I find the snarkverify precompile (opcode) implementation in parity and the example coin mixing contract that utilizes it?

The commit that implements snarkverify in Parity: https://github.com/gancherj/parity/commit/b820abf755e216ccf24640549735412ec02dac62 The example coin mixing contract: https://github.com/zcash/babyzoe/...
shoraibit's user avatar
2 votes

Is "Pinocchio zk-SNARK" a specific type of zk-SNARK?

Yes, Pinocchio is a practical zk-SNARK that allows a prover to perform cryptographically verifiable computations with verification effort potentially less than performing the computation itself. A ...
Woodstock's user avatar
  • 338
2 votes

zk-SNARK use cases in blockchain (except payment)?

The main feature of ZK-SNARKs is to "cryptographically verify the correctness of a computation". In extreme, this means that you could offload lot of smart contract computation from the chain, but be ...
ivicaa's user avatar
  • 7,519
2 votes

Updated: Is it possible to hide the sender or receiver of transactions by "zk-SNARK" or "Bulletproofs"?

Strictly speaking, it is not possible to hide the sender of an Ethereum transaction. This is due to the fact that it is possible to extract the public key of the sender, and thereby the address, ...
DurandA's user avatar
  • 130
2 votes
Accepted

Zero Knowledge v Multi Party Computation (MPC)

It would be better for you to ask for this question on a specific resource like https://crypto.stackexchange.com. In cryptography, these are two quite different concepts. You could also look into ...
Mikhail Koipish's user avatar
2 votes
Accepted

crypto-signing in a smart contract -> verify the identity of a smart contract

is it possible to digitally sign some data by a smart contract (e.g. with a secret key of the contract) No. Contracts don't have signing keys, can't initiate action (it always starts with a ...
Rob Hitchens's user avatar
  • 55.3k
2 votes
Accepted

Why TornadoCash smart contract calls address = 8?

Address 8 is a pairing "precompiled contract". More specifically, EIP-197: Precompiled contracts for optimal ate pairing check on the elliptic curve alt_bn128. For a cyclic group G (written ...
eth's user avatar
  • 85.9k
1 vote
Accepted

Create zkProof onchain

You can definitely do the prover, here's a library that creates the Verifier.sol used in tornado cash and other zk contracts: https://github.com/iden3/snarkjs. The big issue with doing everything on-...
thefett's user avatar
  • 3,890
1 vote

Is it possible to prove ETH balance without revealing the holding address?

It should be possible with a ZKP. without revealing the address That's the "zero-knowledge" part. The ZKP part will be challenging in itself but I foresee another problem. prove that I ...
Rob Hitchens's user avatar
  • 55.3k

Only top scored, non community-wiki answers of a minimum length are eligible