Avatar
YODL
d28413712171c33e117d4bd0930ac05b2c51b30eb3021ef8d4f1233f02c90a2b
YODL-AY-HEE-HOO
Replying to Avatar waxwing

It's hard to recommend one thing, there's a whole stack of knowledge that this stuff is based on, and it depends what you're already comfortable with. For example if you wanted to learn STARKs (as I do, but haven't yet), there's a whole different bunch of mathematical machinery compared with SNARKs or Bulletproofs. This uses the latter. You could do worse than read my old doc that slowly builds up the concepts behind bulletproofs, including what 'ZK' means: https://github.com/AdamISZ/from0k2bp . You can look for detailed books that cover all the preliminaries like the "moonmath manual" (search it), or shorter more conceptual things like Matthew Green's cryptography blog that has iirc a 3 part intro to ZKPs. You can find much more rigorous academic stuff like the Crypto Book of Boneh and Shoup which gives pieces of the picture but isn't yet completed. You can read Vitalik Buterin's old blog posts explaining zkSNARKs from the ground up (he's always been a really good technical writer, one of the best actually). And at the end of the day, the academic papers will really help too. If you need more general cryptography knowledge, different recommendations would apply :)

Btw on bulletproofs specifically look up the dalek cryptography blogs/docs, they are the best in terms of details, diagrams.

Thank you very much for the thoughtful reply. Had a feeling it was rather spread out, so this will help point me in the right direction. Wish me luck

Replying to Avatar waxwing

Re: the 55MB file generic/custom: it comes from parsing the taproot-only utxo set at a particular block height (you see that in the filename). It's a list of curve points, each one of them is basically P + vJ where P is the taproot pubkey of the utxo and v is the value in satoshis of the utxo. It's also filtered with minimum value to prevent being too large. Also it should be half that size (and that's one of the largest I've seen so far) because I never bothered to change it from hex to binary.

The processing takes time: yes, this pre-processing step, which reads in and modifies the curve points, is currently more friction than we'd like. That one took 4 minutes for a 440K key set. For some applications it might be fine to have this setup, then run a daemon in the background so that you can keep verifying instantly, but for this one, maybe not. Farming this out to others, I'm not sure if there's a way to do that that's more interesting than have the "other" do the whole verification. Maybe? Also, it *might* be possible to have the proof size be larger (e.g. 1MB instead of 10kb) and then the verifier only needs the tree root, but it's a significantly different algorithm and I'm not sure about if/how that would work.

The range: the range here was a from a chosen minimum of 1 million sats to a maximum of 1 million + 2^18. The minimum is completely prover choice. The range being a power of 2 is because ZKPs of range are most efficiently done as "prove that the number has the following bit representation", hence a power of 2. My feeling is that k+2^n is flexible *enough* but with some extra machinery you could make it more flexible (you can also change the base from 2 to 3 or whatever, but that doesn't help a ton I think).

Window for cheating: as above it's a utxo snapshot at a certain block. It isn't valid for any other time. So frequency of checks can't be that fast. Now I think about it, that is a big drawback here, if you want real time checking.

I'm not sure what your "custom to the prover" sentence was really asking. As per above ,the keyset/snapshot is generic for everyone, it's a snapshot of a blockheight. The prover and verifier have to agree on: the block height, and the minimum value filter, so that they have the same keyset file. If you try to verify a proof with a different keyset it just doesn't verify, even if the utxo is shared between the two conflicting keysets, because it's a tree like a merkle tree, and the roots won't match.

I’m intrigued but lack the background to really understand these things. I plan to learn more soon, but would appreciate if anyone could point me to a solid resource for understanding ZKPs and the like as a starting point

Would make a cool handle

Replying to Avatar Melvin Carvalho

A classic email. It turns out the biggest failure mode in mid stage FOSS projects is "bike shedding". Ubuntu was one of the first major projects to really point this out and fix the problem. Love how the colour of the page changes on each refresh.

https://bikeshed.com/

Parkinson shows how you can go in to the board of directors and

get approval for building a multi-million or even billion dollar

atomic power plant, but if you want to build a bike shed you will

be tangled up in endless discussions.

Parkinson explains that this is because an atomic plant is so vast,

so expensive and so complicated that people cannot grasp it, and

rather than try, they fall back on the assumption that somebody

else checked all the details before it got this far. Richard P.

Feynmann gives a couple of interesting, and very much to the point,

examples relating to Los Alamos in his books.

A bike shed on the other hand. Anyone can build one of those over

a weekend, and still have time to watch the game on TV. So no

matter how well prepared, no matter how reasonable you are with

your proposal, somebody will seize the chance to show that he is

doing his job, that he is paying attention, that he is *here*.

In Denmark we call it "setting your fingerprint". It is about

personal pride and prestige, it is about being able to point

somewhere and say "There! *I* did that." It is a strong trait in

politicians, but present in most people given the chance. Just

think about footsteps in wet cement.

The color change lol